* [OE-core][dunfell 00/12] Patch review
@ 2022-01-09 22:04 Steve Sakoman
2022-01-09 22:04 ` [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 Steve Sakoman
` (11 more replies)
0 siblings, 12 replies; 24+ messages in thread
From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Tuesday.
Passed a-full on auto builder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3096
with the exception of a known intermmitent autobuilder issue on oe-selftest-fedora,
which passed on subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/86/builds/3004
The following changes since commit 1ab7aee542589f6b6c76f8515b4230ce870a8678:
selftest: skip virgl test on fedora 34 entirely (2021-12-23 06:21:37 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
lib/oe/reproducible: correctly set .git location when recursively
looking for git repos
Marek Vasut (1):
weston: Backport patches to always activate the top-level surface
Marta Rybczynska (1):
grub: fix CVE-2020-14372 and CVE-2020-27779
Richard Purdie (4):
openssl: Add reproducibility fix
oeqa/selftest/bbtests: Use YP sources mirror instead of GNU
oeqa/selftest/tinfoil: Update to use test command
scripts: Update to use exec_module() instead of load_module()
Steve Sakoman (3):
libpcre2: update SRC_URI
selftest: skip virgl test on fedora 35
asciidoc: properly detect and compare Python versions >= 3.10
Tim Orling (1):
scripts/buildhistory-diff: drop use of distutils
wangmy (1):
linux-firmware: upgrade 20211027 -> 20211216
meta/lib/oe/reproducible.py | 2 +-
meta/lib/oeqa/selftest/cases/bbtests.py | 2 +-
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
meta/lib/oeqa/selftest/cases/tinfoil.py | 6 +-
.../grub/files/CVE-2020-14372.patch | 76 +++
.../grub/files/CVE-2020-14372_1.patch | 130 ++++++
.../grub/files/CVE-2020-14372_2.patch | 431 ++++++++++++++++++
.../grub/files/CVE-2020-14372_3.patch | 57 +++
.../grub/files/CVE-2020-14372_4.patch | 52 +++
.../grub/files/CVE-2020-14372_5.patch | 158 +++++++
.../grub/files/CVE-2020-27779.patch | 70 +++
.../grub/files/CVE-2020-27779_2.patch | 105 +++++
.../grub/files/CVE-2020-27779_3.patch | 37 ++
.../grub/files/CVE-2020-27779_4.patch | 35 ++
.../grub/files/CVE-2020-27779_5.patch | 62 +++
.../grub/files/CVE-2020-27779_6.patch | 61 +++
.../grub/files/CVE-2020-27779_7.patch | 65 +++
.../grub/files/no-insmod-on-sb.patch | 107 +++++
meta/recipes-bsp/grub/grub2.inc | 14 +
.../openssl/openssl/reproducibility.patch | 22 +
.../openssl/openssl_1.1.1l.bb | 1 +
.../asciidoc/detect-python-version.patch | 42 ++
.../asciidoc/asciidoc_8.6.9.bb | 3 +-
...move-no-op-de-activation-of-the-xdg-.patch | 32 ++
...name-gain-lose-keyboard-focus-to-act.patch | 57 +++
...bed-keyboard-focus-handle-code-when-.patch | 99 ++++
meta/recipes-graphics/wayland/weston_8.0.0.bb | 3 +
...20211027.bb => linux-firmware_20211216.bb} | 4 +-
.../recipes-support/libpcre/libpcre2_10.34.bb | 2 +-
scripts/buildhistory-diff | 5 -
scripts/lib/scriptutils.py | 7 +-
scripts/lib/wic/pluginbase.py | 8 +-
32 files changed, 1739 insertions(+), 18 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch
create mode 100644 meta/recipes-bsp/grub/files/no-insmod-on-sb.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/reproducibility.patch
create mode 100644 meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch
create mode 100644 meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20211027.bb => linux-firmware_20211216.bb} (99%)
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 02/12] linux-firmware: upgrade 20211027 -> 20211216 Steve Sakoman ` (10 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Marta Rybczynska <rybczynska@gmail.com> Fix issues with grub in secure boot mode where an attacker could circumvent secure boot by using acpi and cutmem commands. Also include patches fixing similar issues. Most patches are backported directly from grub. One patch (no-insmod-on-sb.patch) comes from Debian, as the upstream implementation is too complicated to backport. CVE-2020-14372 description (from NVD [1]): A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability. CVE-2020-27779 description (from NVD [2]): A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. [1] https://nvd.nist.gov/vuln/detail/CVE-2020-14372 [2] https://nvd.nist.gov/vuln/detail/CVE-2020-27779 Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../grub/files/CVE-2020-14372.patch | 76 +++ .../grub/files/CVE-2020-14372_1.patch | 130 ++++++ .../grub/files/CVE-2020-14372_2.patch | 431 ++++++++++++++++++ .../grub/files/CVE-2020-14372_3.patch | 57 +++ .../grub/files/CVE-2020-14372_4.patch | 52 +++ .../grub/files/CVE-2020-14372_5.patch | 158 +++++++ .../grub/files/CVE-2020-27779.patch | 70 +++ .../grub/files/CVE-2020-27779_2.patch | 105 +++++ .../grub/files/CVE-2020-27779_3.patch | 37 ++ .../grub/files/CVE-2020-27779_4.patch | 35 ++ .../grub/files/CVE-2020-27779_5.patch | 62 +++ .../grub/files/CVE-2020-27779_6.patch | 61 +++ .../grub/files/CVE-2020-27779_7.patch | 65 +++ .../grub/files/no-insmod-on-sb.patch | 107 +++++ meta/recipes-bsp/grub/grub2.inc | 14 + 15 files changed, 1460 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch create mode 100644 meta/recipes-bsp/grub/files/no-insmod-on-sb.patch diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372.patch new file mode 100644 index 0000000000..08e7666cde --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372.patch @@ -0,0 +1,76 @@ +From 0d237c0b90f0c6d4a3662c569b2371ae3ed69574 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Mon, 28 Sep 2020 20:08:41 +0200 +Subject: [PATCH] acpi: Don't register the acpi command when locked down +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The command is not allowed when lockdown is enforced. Otherwise an +attacker can instruct the GRUB to load an SSDT table to overwrite +the kernel lockdown configuration and later load and execute +unsigned code. + +Fixes: CVE-2020-14372 + +Reported-by: Máté Kukri <km@mkukri.xyz> +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=3e8e4c0549240fa209acffceb473e1e509b50c95] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 5 +++++ + grub-core/commands/acpi.c | 15 ++++++++------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 0786427..47ac7ff 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3986,6 +3986,11 @@ Normally, this command will replace the Root System Description Pointer + (RSDP) in the Extended BIOS Data Area to point to the new tables. If the + @option{--no-ebda} option is used, the new tables will be known only to + GRUB, but may be used by GRUB's EFI emulation. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ Otherwise an attacker can instruct the GRUB to load an SSDT table to ++ overwrite the kernel lockdown configuration and later load and execute ++ unsigned code. + @end deffn + + +diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c +index 5a1499a..1215f2a 100644 +--- a/grub-core/commands/acpi.c ++++ b/grub-core/commands/acpi.c +@@ -27,6 +27,7 @@ + #include <grub/mm.h> + #include <grub/memory.h> + #include <grub/i18n.h> ++#include <grub/lockdown.h> + + #ifdef GRUB_MACHINE_EFI + #include <grub/efi/efi.h> +@@ -775,13 +776,13 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(acpi) + { +- cmd = grub_register_extcmd ("acpi", grub_cmd_acpi, 0, +- N_("[-1|-2] [--exclude=TABLE1,TABLE2|" +- "--load-only=TABLE1,TABLE2] FILE1" +- " [FILE2] [...]"), +- N_("Load host ACPI tables and tables " +- "specified by arguments."), +- options); ++ cmd = grub_register_extcmd_lockdown ("acpi", grub_cmd_acpi, 0, ++ N_("[-1|-2] [--exclude=TABLE1,TABLE2|" ++ "--load-only=TABLE1,TABLE2] FILE1" ++ " [FILE2] [...]"), ++ N_("Load host ACPI tables and tables " ++ "specified by arguments."), ++ options); + } + + GRUB_MOD_FINI(acpi) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch new file mode 100644 index 0000000000..745f335501 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch @@ -0,0 +1,130 @@ +From fe7a13df6200bda934fcc0246458df249f1ef4f2 Mon Sep 17 00:00:00 2001 +From: Marco A Benatto <mbenatto@redhat.com> +Date: Wed, 23 Sep 2020 11:33:33 -0400 +Subject: [PATCH] verifiers: Move verifiers API to kernel image + +Move verifiers API from a module to the kernel image, so it can be +used there as well. There are no functional changes in this patch. + +Signed-off-by: Marco A Benatto <mbenatto@redhat.com> +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9e95f45ceeef36fcf93cbfffcf004276883dbc99] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/Makefile.am | 1 + + grub-core/Makefile.core.def | 6 +----- + grub-core/kern/main.c | 4 ++++ + grub-core/{commands => kern}/verifiers.c | 8 ++------ + include/grub/verify.h | 9 ++++++--- + 5 files changed, 14 insertions(+), 14 deletions(-) + rename grub-core/{commands => kern}/verifiers.c (97%) + +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 3ea8e7f..375c30d 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -90,6 +90,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/verify.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm_private.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/net.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/memory.h +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 474a63e..cff02f2 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -140,6 +140,7 @@ kernel = { + common = kern/rescue_parser.c; + common = kern/rescue_reader.c; + common = kern/term.c; ++ common = kern/verifiers.c; + + noemu = kern/compiler-rt.c; + noemu = kern/mm.c; +@@ -942,11 +943,6 @@ module = { + cppflags = '-I$(srcdir)/lib/posix_wrap'; + }; + +-module = { +- name = verifiers; +- common = commands/verifiers.c; +-}; +- + module = { + name = shim_lock; + common = commands/efi/shim_lock.c; +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 9cad0c4..73967e2 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -29,6 +29,7 @@ + #include <grub/command.h> + #include <grub/reader.h> + #include <grub/parser.h> ++#include <grub/verify.h> + + #ifdef GRUB_MACHINE_PCBIOS + #include <grub/machine/memory.h> +@@ -274,6 +275,9 @@ grub_main (void) + grub_printf ("Welcome to GRUB!\n\n"); + grub_setcolorstate (GRUB_TERM_COLOR_STANDARD); + ++ /* Init verifiers API. */ ++ grub_verifiers_init (); ++ + grub_load_config (); + + grub_boot_time ("Before loading embedded modules."); +diff --git a/grub-core/commands/verifiers.c b/grub-core/kern/verifiers.c +similarity index 97% +rename from grub-core/commands/verifiers.c +rename to grub-core/kern/verifiers.c +index 0dde481..aa3dc7c 100644 +--- a/grub-core/commands/verifiers.c ++++ b/grub-core/kern/verifiers.c +@@ -217,12 +217,8 @@ grub_verify_string (char *str, enum grub_verify_string_type type) + return GRUB_ERR_NONE; + } + +-GRUB_MOD_INIT(verifiers) ++void ++grub_verifiers_init (void) + { + grub_file_filter_register (GRUB_FILE_FILTER_VERIFY, grub_verifiers_open); + } +- +-GRUB_MOD_FINI(verifiers) +-{ +- grub_file_filter_unregister (GRUB_FILE_FILTER_VERIFY); +-} +diff --git a/include/grub/verify.h b/include/grub/verify.h +index ea04914..cd129c3 100644 +--- a/include/grub/verify.h ++++ b/include/grub/verify.h +@@ -64,7 +64,10 @@ struct grub_file_verifier + grub_err_t (*verify_string) (char *str, enum grub_verify_string_type type); + }; + +-extern struct grub_file_verifier *grub_file_verifiers; ++extern struct grub_file_verifier *EXPORT_VAR (grub_file_verifiers); ++ ++extern void ++grub_verifiers_init (void); + + static inline void + grub_verifier_register (struct grub_file_verifier *ver) +@@ -78,7 +81,7 @@ grub_verifier_unregister (struct grub_file_verifier *ver) + grub_list_remove (GRUB_AS_LIST (ver)); + } + +-grub_err_t +-grub_verify_string (char *str, enum grub_verify_string_type type); ++extern grub_err_t ++EXPORT_FUNC (grub_verify_string) (char *str, enum grub_verify_string_type type); + + #endif /* ! GRUB_VERIFY_HEADER */ diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch new file mode 100644 index 0000000000..a98b5d0455 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch @@ -0,0 +1,431 @@ +From d8aac4517fef0f0188a60a2a8ff9cafdd9c7ca42 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Mon, 28 Sep 2020 20:08:02 +0200 +Subject: [PATCH] kern: Add lockdown support + +When the GRUB starts on a secure boot platform, some commands can be +used to subvert the protections provided by the verification mechanism and +could lead to booting untrusted system. + +To prevent that situation, allow GRUB to be locked down. That way the code +may check if GRUB has been locked down and further restrict the commands +that are registered or what subset of their functionality could be used. + +The lockdown support adds the following components: + +* The grub_lockdown() function which can be used to lockdown GRUB if, + e.g., UEFI Secure Boot is enabled. + +* The grub_is_lockdown() function which can be used to check if the GRUB + was locked down. + +* A verifier that flags OS kernels, the GRUB modules, Device Trees and ACPI + tables as GRUB_VERIFY_FLAGS_DEFER_AUTH to defer verification to other + verifiers. These files are only successfully verified if another registered + verifier returns success. Otherwise, the whole verification process fails. + + For example, PE/COFF binaries verification can be done by the shim_lock + verifier which validates the signatures using the shim_lock protocol. + However, the verification is not deferred directly to the shim_lock verifier. + The shim_lock verifier is hooked into the verification process instead. + +* A set of grub_{command,extcmd}_lockdown functions that can be used by + code registering command handlers, to only register unsafe commands if + the GRUB has not been locked down. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + conf/Makefile.common | 2 + + docs/grub-dev.texi | 27 +++++++++++++ + docs/grub.texi | 8 ++++ + grub-core/Makefile.am | 5 ++- + grub-core/Makefile.core.def | 1 + + grub-core/commands/extcmd.c | 23 +++++++++++ + grub-core/kern/command.c | 24 +++++++++++ + grub-core/kern/lockdown.c | 80 +++++++++++++++++++++++++++++++++++++ + include/grub/command.h | 5 +++ + include/grub/extcmd.h | 7 ++++ + include/grub/lockdown.h | 44 ++++++++++++++++++++ + 11 files changed, 225 insertions(+), 1 deletion(-) + create mode 100644 grub-core/kern/lockdown.c + create mode 100644 include/grub/lockdown.h + +diff --git a/conf/Makefile.common b/conf/Makefile.common +index 6cd71cb..2a1a886 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -84,7 +84,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER + CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_TERMINAL_LIST += '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' ++CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' ++CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \ +diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi +index ee389fd..635ec72 100644 +--- a/docs/grub-dev.texi ++++ b/docs/grub-dev.texi +@@ -86,6 +86,7 @@ This edition documents version @value{VERSION}. + * PFF2 Font File Format:: + * Graphical Menu Software Design:: + * Verifiers framework:: ++* Lockdown framework:: + * Copying This Manual:: Copying This Manual + * Index:: + @end menu +@@ -2086,6 +2087,32 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just + the context. If you return no error during any of @samp{init}, @samp{write} and + @samp{fini} then the file is considered as having succeded verification. + ++@node Lockdown framework ++@chapter Lockdown framework ++ ++The GRUB can be locked down, which is a restricted mode where some operations ++are not allowed. For instance, some commands cannot be used when the GRUB is ++locked down. ++ ++The function ++@code{grub_lockdown()} is used to lockdown GRUB and the function ++@code{grub_is_lockdown()} function can be used to check whether lockdown is ++enabled or not. When enabled, the function returns @samp{GRUB_LOCKDOWN_ENABLED} ++and @samp{GRUB_LOCKDOWN_DISABLED} when is not enabled. ++ ++The following functions can be used to register the commands that can only be ++used when lockdown is disabled: ++ ++@itemize ++ ++@item @code{grub_cmd_lockdown()} registers command which should not run when the ++GRUB is in lockdown mode. ++ ++@item @code{grub_cmd_lockdown()} registers extended command which should not run ++when the GRUB is in lockdown mode. ++ ++@end itemize ++ + @node Copying This Manual + @appendix Copying This Manual + +diff --git a/docs/grub.texi b/docs/grub.texi +index 8779507..d778bfb 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5581,6 +5581,7 @@ environment variables and commands are listed in the same order. + * Using digital signatures:: Booting digitally signed code + * UEFI secure boot and shim:: Booting digitally signed PE files + * Measured Boot:: Measuring boot components ++* Lockdown:: Lockdown when booting on a secure setup + @end menu + + @node Authentication and authorisation +@@ -5794,6 +5795,13 @@ into @file{core.img} in order to avoid a potential gap in measurement between + + Measured boot is currently only supported on EFI platforms. + ++@node Lockdown ++@section Lockdown when booting on a secure setup ++ ++The GRUB can be locked down when booted on a secure boot environment, for example ++if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will ++be restricted and some operations/commands cannot be executed. ++ + @node Platform limitations + @chapter Platform limitations + +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 375c30d..3096241 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -79,6 +79,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/kernel.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/list.h ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lockdown.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/misc.h + if COND_emu + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/compiler-rt-emu.h +@@ -376,8 +377,10 @@ command.lst: $(MARKER_FILES) + b=`basename $$pp .marker`; \ + sed -n \ + -e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ ++ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ + -e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ +- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \ ++ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \ ++ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \ + done) | sort -u > $@ + platform_DATA += command.lst + CLEANFILES += command.lst +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index cff02f2..651ea2a 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -204,6 +204,7 @@ kernel = { + efi = term/efi/console.c; + efi = kern/acpi.c; + efi = kern/efi/acpi.c; ++ efi = kern/lockdown.c; + i386_coreboot = kern/i386/pc/acpi.c; + i386_multiboot = kern/i386/pc/acpi.c; + i386_coreboot = kern/acpi.c; +diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c +index 69574e2..90a5ca2 100644 +--- a/grub-core/commands/extcmd.c ++++ b/grub-core/commands/extcmd.c +@@ -19,6 +19,7 @@ + + #include <grub/mm.h> + #include <grub/list.h> ++#include <grub/lockdown.h> + #include <grub/misc.h> + #include <grub/extcmd.h> + #include <grub/script_sh.h> +@@ -110,6 +111,28 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func, + summary, description, parser, 1); + } + ++static grub_err_t ++grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)), ++ int argc __attribute__ ((unused)), ++ char **argv __attribute__ ((unused))) ++{ ++ return grub_error (GRUB_ERR_ACCESS_DENIED, ++ N_("%s: the command is not allowed when lockdown is enforced"), ++ ctxt->extcmd->cmd->name); ++} ++ ++grub_extcmd_t ++grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func, ++ grub_command_flags_t flags, const char *summary, ++ const char *description, ++ const struct grub_arg_option *parser) ++{ ++ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED) ++ func = grub_extcmd_lockdown; ++ ++ return grub_register_extcmd (name, func, flags, summary, description, parser); ++} ++ + void + grub_unregister_extcmd (grub_extcmd_t ext) + { +diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c +index acd7218..4aabcd4 100644 +--- a/grub-core/kern/command.c ++++ b/grub-core/kern/command.c +@@ -17,6 +17,7 @@ + * along with GRUB. If not, see <http://www.gnu.org/licenses/>. + */ + ++#include <grub/lockdown.h> + #include <grub/mm.h> + #include <grub/command.h> + +@@ -77,6 +78,29 @@ grub_register_command_prio (const char *name, + return cmd; + } + ++static grub_err_t ++grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)), ++ int argc __attribute__ ((unused)), ++ char **argv __attribute__ ((unused))) ++ ++{ ++ return grub_error (GRUB_ERR_ACCESS_DENIED, ++ N_("%s: the command is not allowed when lockdown is enforced"), ++ cmd->name); ++} ++ ++grub_command_t ++grub_register_command_lockdown (const char *name, ++ grub_command_func_t func, ++ const char *summary, ++ const char *description) ++{ ++ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED) ++ func = grub_cmd_lockdown; ++ ++ return grub_register_command_prio (name, func, summary, description, 0); ++} ++ + void + grub_unregister_command (grub_command_t cmd) + { +diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c +new file mode 100644 +index 0000000..1e56c0b +--- /dev/null ++++ b/grub-core/kern/lockdown.c +@@ -0,0 +1,80 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see <http://www.gnu.org/licenses/>. ++ * ++ */ ++ ++#include <grub/dl.h> ++#include <grub/file.h> ++#include <grub/lockdown.h> ++#include <grub/verify.h> ++ ++static int lockdown = GRUB_LOCKDOWN_DISABLED; ++ ++static grub_err_t ++lockdown_verifier_init (grub_file_t io __attribute__ ((unused)), ++ enum grub_file_type type, ++ void **context __attribute__ ((unused)), ++ enum grub_verify_flags *flags) ++{ ++ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION; ++ ++ switch (type & GRUB_FILE_TYPE_MASK) ++ { ++ case GRUB_FILE_TYPE_GRUB_MODULE: ++ case GRUB_FILE_TYPE_LINUX_KERNEL: ++ case GRUB_FILE_TYPE_MULTIBOOT_KERNEL: ++ case GRUB_FILE_TYPE_XEN_HYPERVISOR: ++ case GRUB_FILE_TYPE_BSD_KERNEL: ++ case GRUB_FILE_TYPE_XNU_KERNEL: ++ case GRUB_FILE_TYPE_PLAN9_KERNEL: ++ case GRUB_FILE_TYPE_NTLDR: ++ case GRUB_FILE_TYPE_TRUECRYPT: ++ case GRUB_FILE_TYPE_FREEDOS: ++ case GRUB_FILE_TYPE_PXECHAINLOADER: ++ case GRUB_FILE_TYPE_PCCHAINLOADER: ++ case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER: ++ case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE: ++ case GRUB_FILE_TYPE_ACPI_TABLE: ++ case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE: ++ *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH; ++ ++ /* Fall through. */ ++ ++ default: ++ return GRUB_ERR_NONE; ++ } ++} ++ ++struct grub_file_verifier lockdown_verifier = ++ { ++ .name = "lockdown_verifier", ++ .init = lockdown_verifier_init, ++ }; ++ ++void ++grub_lockdown (void) ++{ ++ lockdown = GRUB_LOCKDOWN_ENABLED; ++ ++ grub_verifier_register (&lockdown_verifier); ++} ++ ++int ++grub_is_lockdown (void) ++{ ++ return lockdown; ++} +diff --git a/include/grub/command.h b/include/grub/command.h +index eee4e84..2a6f7f8 100644 +--- a/include/grub/command.h ++++ b/include/grub/command.h +@@ -86,6 +86,11 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name, + const char *summary, + const char *description, + int prio); ++grub_command_t ++EXPORT_FUNC(grub_register_command_lockdown) (const char *name, ++ grub_command_func_t func, ++ const char *summary, ++ const char *description); + void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd); + + static inline grub_command_t +diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h +index 19fe592..fe9248b 100644 +--- a/include/grub/extcmd.h ++++ b/include/grub/extcmd.h +@@ -62,6 +62,13 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name, + const char *description, + const struct grub_arg_option *parser); + ++grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name, ++ grub_extcmd_func_t func, ++ grub_command_flags_t flags, ++ const char *summary, ++ const char *description, ++ const struct grub_arg_option *parser); ++ + grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name, + grub_extcmd_func_t func, + grub_command_flags_t flags, +diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h +new file mode 100644 +index 0000000..40531fa +--- /dev/null ++++ b/include/grub/lockdown.h +@@ -0,0 +1,44 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see <http://www.gnu.org/licenses/>. ++ */ ++ ++#ifndef GRUB_LOCKDOWN_H ++#define GRUB_LOCKDOWN_H 1 ++ ++#include <grub/symbol.h> ++ ++#define GRUB_LOCKDOWN_DISABLED 0 ++#define GRUB_LOCKDOWN_ENABLED 1 ++ ++#ifdef GRUB_MACHINE_EFI ++extern void ++EXPORT_FUNC (grub_lockdown) (void); ++extern int ++EXPORT_FUNC (grub_is_lockdown) (void); ++#else ++static inline void ++grub_lockdown (void) ++{ ++} ++ ++static inline int ++grub_is_lockdown (void) ++{ ++ return GRUB_LOCKDOWN_DISABLED; ++} ++#endif ++#endif /* ! GRUB_LOCKDOWN_H */ diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch new file mode 100644 index 0000000000..93fdd2cb1a --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch @@ -0,0 +1,57 @@ +From bfb9c44298aa202c176fef8dc5ea48f9b0e76e5e Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Tue, 2 Feb 2021 19:59:48 +0100 +Subject: [PATCH] kern/lockdown: Set a variable if the GRUB is locked down + +It may be useful for scripts to determine whether the GRUB is locked +down or not. Add the lockdown variable which is set to "y" when the GRUB +is locked down. + +Suggested-by: Dimitri John Ledkov <xnox@ubuntu.com> +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d90367471779c240e002e62edfb6b31fc85b4908] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 3 +++ + grub-core/kern/lockdown.c | 4 ++++ + 2 files changed, 7 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index d778bfb..5e6cace 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5802,6 +5802,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl + if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will + be restricted and some operations/commands cannot be executed. + ++The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. ++Otherwise it does not exit. ++ + @node Platform limitations + @chapter Platform limitations + +diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c +index 1e56c0b..0bc70fd 100644 +--- a/grub-core/kern/lockdown.c ++++ b/grub-core/kern/lockdown.c +@@ -18,6 +18,7 @@ + */ + + #include <grub/dl.h> ++#include <grub/env.h> + #include <grub/file.h> + #include <grub/lockdown.h> + #include <grub/verify.h> +@@ -71,6 +72,9 @@ grub_lockdown (void) + lockdown = GRUB_LOCKDOWN_ENABLED; + + grub_verifier_register (&lockdown_verifier); ++ ++ grub_env_set ("lockdown", "y"); ++ grub_env_export ("lockdown"); + } + + int diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch new file mode 100644 index 0000000000..ac509b63c7 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch @@ -0,0 +1,52 @@ +From 0d809c0979ced9db4d0e500b3e812bba95e52972 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Mon, 28 Sep 2020 20:08:29 +0200 +Subject: [PATCH] efi: Lockdown the GRUB when the UEFI Secure Boot is enabled + +If the UEFI Secure Boot is enabled then the GRUB must be locked down +to prevent executing code that can potentially be used to subvert its +verification mechanisms. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=98b00a403cbf2ba6833d1ac0499871b27a08eb77] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/kern/efi/init.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index 3dfdf2d..db84d82 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -20,6 +20,7 @@ + #include <grub/efi/efi.h> + #include <grub/efi/console.h> + #include <grub/efi/disk.h> ++#include <grub/lockdown.h> + #include <grub/term.h> + #include <grub/misc.h> + #include <grub/env.h> +@@ -39,6 +40,20 @@ grub_efi_init (void) + /* Initialize the memory management system. */ + grub_efi_mm_init (); + ++ /* ++ * Lockdown the GRUB and register the shim_lock verifier ++ * if the UEFI Secure Boot is enabled. ++ */ ++ if (grub_efi_secure_boot ()) ++ { ++ grub_lockdown (); ++ /* NOTE: Our version does not have the shim_lock_verifier, ++ * need to update below if added */ ++#if 0 ++ grub_shim_lock_verifier_setup (); ++#endif ++ } ++ + efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer, + 0, 0, 0, NULL); + diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch new file mode 100644 index 0000000000..12ec4e1c17 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch @@ -0,0 +1,158 @@ +From 1ad728b08ba2a21573e5f81a565114f74ca33988 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Mon, 28 Sep 2020 20:08:33 +0200 +Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled + modules list + +Now the GRUB can check if it has been locked down and this can be used to +prevent executing commands that can be utilized to circumvent the UEFI +Secure Boot mechanisms. So, instead of hardcoding a list of modules that +have to be disabled, prevent the usage of commands that can be dangerous. + +This not only allows the commands to be disabled on other platforms, but +also properly separate the concerns. Since the shim_lock verifier logic +should be only about preventing to run untrusted binaries and not about +defining these kind of policies. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=8f73052885892bc0dbc01e297f79d7cf4925e491] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 10 ++++++++++ + grub-core/commands/i386/wrmsr.c | 5 +++-- + grub-core/commands/iorw.c | 19 ++++++++++--------- + grub-core/commands/memrw.c | 19 ++++++++++--------- + 4 files changed, 33 insertions(+), 20 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 5e6cace..0786427 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5256,6 +5256,9 @@ only applies to the particular cpu/core/thread that runs the command. + Also, if you specify a reserved or unimplemented MSR address, it will + cause a general protection exception (which is not currently being handled) + and the system will reboot. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This is done to prevent subverting various security mechanisms. + @end deffn + + @node xen_hypervisor +@@ -5758,6 +5761,13 @@ security reasons. All above mentioned requirements are enforced by the + shim_lock module. And itself it is a persistent module which means that + it cannot be unloaded if it was loaded into the memory. + ++All GRUB modules not stored in the @file{core.img}, OS kernels, ACPI tables, ++Device Trees, etc. have to be signed, e.g, using PGP. Additionally, the commands ++that can be used to subvert the UEFI secure boot mechanism, such as @command{iorw} ++and @command{memrw} will not be available when the UEFI secure boot is enabled. ++This is done for security reasons and are enforced by the GRUB Lockdown mechanism ++(@pxref{Lockdown}). ++ + @node Measured Boot + @section Measuring boot components + +diff --git a/grub-core/commands/i386/wrmsr.c b/grub-core/commands/i386/wrmsr.c +index 9c5e510..56a29c2 100644 +--- a/grub-core/commands/i386/wrmsr.c ++++ b/grub-core/commands/i386/wrmsr.c +@@ -24,6 +24,7 @@ + #include <grub/env.h> + #include <grub/command.h> + #include <grub/extcmd.h> ++#include <grub/lockdown.h> + #include <grub/i18n.h> + #include <grub/i386/cpuid.h> + #include <grub/i386/wrmsr.h> +@@ -83,8 +84,8 @@ grub_cmd_msr_write (grub_command_t cmd __attribute__ ((unused)), int argc, char + + GRUB_MOD_INIT(wrmsr) + { +- cmd_write = grub_register_command ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"), +- N_("Write a value to a CPU model specific register.")); ++ cmd_write = grub_register_command_lockdown ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"), ++ N_("Write a value to a CPU model specific register.")); + } + + GRUB_MOD_FINI(wrmsr) +diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c +index a0c164e..584baec 100644 +--- a/grub-core/commands/iorw.c ++++ b/grub-core/commands/iorw.c +@@ -23,6 +23,7 @@ + #include <grub/env.h> + #include <grub/cpu/io.h> + #include <grub/i18n.h> ++#include <grub/lockdown.h> + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -131,17 +132,17 @@ GRUB_MOD_INIT(memrw) + N_("PORT"), N_("Read 32-bit value from PORT."), + options); + cmd_write_byte = +- grub_register_command ("outb", grub_cmd_write, +- N_("PORT VALUE [MASK]"), +- N_("Write 8-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outb", grub_cmd_write, ++ N_("PORT VALUE [MASK]"), ++ N_("Write 8-bit VALUE to PORT.")); + cmd_write_word = +- grub_register_command ("outw", grub_cmd_write, +- N_("PORT VALUE [MASK]"), +- N_("Write 16-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outw", grub_cmd_write, ++ N_("PORT VALUE [MASK]"), ++ N_("Write 16-bit VALUE to PORT.")); + cmd_write_dword = +- grub_register_command ("outl", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 32-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outl", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 32-bit VALUE to PORT.")); + } + + GRUB_MOD_FINI(memrw) +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index 98769ea..d401a6d 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -22,6 +22,7 @@ + #include <grub/extcmd.h> + #include <grub/env.h> + #include <grub/i18n.h> ++#include <grub/lockdown.h> + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -133,17 +134,17 @@ GRUB_MOD_INIT(memrw) + N_("ADDR"), N_("Read 32-bit value from ADDR."), + options); + cmd_write_byte = +- grub_register_command ("write_byte", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 8-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_byte", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 8-bit VALUE to ADDR.")); + cmd_write_word = +- grub_register_command ("write_word", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 16-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_word", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 16-bit VALUE to ADDR.")); + cmd_write_dword = +- grub_register_command ("write_dword", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 32-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_dword", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 32-bit VALUE to ADDR.")); + } + + GRUB_MOD_FINI(memrw) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779.patch new file mode 100644 index 0000000000..c82423b8af --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779.patch @@ -0,0 +1,70 @@ +From 584263eca1546e5cab69ba6fe7b4b07df2630a21 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 14 Oct 2020 16:33:42 +0200 +Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown + is enforced + +The cutmem and badram commands can be used to remove EFI memory regions +and potentially disable the UEFI Secure Boot. Prevent the commands to be +registered if the GRUB is locked down. + +Fixes: CVE-2020-27779 + +Reported-by: Teddy Reed <teddy.reed@gmail.com> +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 4 ++++ + grub-core/mmap/mmap.c | 13 +++++++------ + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 47ac7ff..a1aaee6 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4051,6 +4051,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns + that are often result of memory damage, due to physical distribution of memory + cells. + ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This prevents removing EFI memory regions to potentially subvert the ++ security mechanisms provided by the UEFI secure boot. ++ + @node blocklist + @subsection blocklist + +diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c +index 57b4e9a..7ebf32e 100644 +--- a/grub-core/mmap/mmap.c ++++ b/grub-core/mmap/mmap.c +@@ -20,6 +20,7 @@ + #include <grub/memory.h> + #include <grub/machine/memory.h> + #include <grub/err.h> ++#include <grub/lockdown.h> + #include <grub/misc.h> + #include <grub/mm.h> + #include <grub/command.h> +@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut; + \f + GRUB_MOD_INIT(mmap) + { +- cmd = grub_register_command ("badram", grub_cmd_badram, +- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), +- N_("Declare memory regions as faulty (badram).")); +- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem, +- N_("FROM[K|M|G] TO[K|M|G]"), +- N_("Remove any memory regions in specified range.")); ++ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram, ++ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), ++ N_("Declare memory regions as faulty (badram).")); ++ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem, ++ N_("FROM[K|M|G] TO[K|M|G]"), ++ N_("Remove any memory regions in specified range.")); + + } + diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch new file mode 100644 index 0000000000..e33c96a05b --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch @@ -0,0 +1,105 @@ +From 4ff1dfdf8c4c71bf4b0dd0488d9fa40ff2617f41 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 24 Feb 2021 09:00:05 +0100 +Subject: [PATCH] commands: Restrict commands that can load BIOS or DT blobs + when locked down + +There are some more commands that should be restricted when the GRUB is +locked down. Following is the list of commands and reasons to restrict: + + * fakebios: creates BIOS-like structures for backward compatibility with + existing OSes. This should not be allowed when locked down. + + * loadbios: reads a BIOS dump from storage and loads it. This action + should not be allowed when locked down. + + * devicetree: loads a Device Tree blob and passes it to the OS. It replaces + any Device Tree provided by the firmware. This also should + not be allowed when locked down. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=468a5699b249fe6816b4e7e86c5dc9d325c9b09e] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 3 +++ + grub-core/commands/efi/loadbios.c | 16 ++++++++-------- + grub-core/loader/arm/linux.c | 6 +++--- + grub-core/loader/efi/fdt.c | 4 ++-- + 4 files changed, 16 insertions(+), 13 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index a1aaee6..ccf1908 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4236,6 +4236,9 @@ Load a device tree blob (.dtb) from a filesystem, for later use by a Linux + kernel. Does not perform merging with any device tree supplied by firmware, + but rather replaces it completely. + @ref{GNU/Linux}. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This is done to prevent subverting various security mechanisms. + @end deffn + + @node distrust +diff --git a/grub-core/commands/efi/loadbios.c b/grub-core/commands/efi/loadbios.c +index d41d521..5c7725f 100644 +--- a/grub-core/commands/efi/loadbios.c ++++ b/grub-core/commands/efi/loadbios.c +@@ -205,14 +205,14 @@ static grub_command_t cmd_fakebios, cmd_loadbios; + + GRUB_MOD_INIT(loadbios) + { +- cmd_fakebios = grub_register_command ("fakebios", grub_cmd_fakebios, +- 0, N_("Create BIOS-like structures for" +- " backward compatibility with" +- " existing OS.")); +- +- cmd_loadbios = grub_register_command ("loadbios", grub_cmd_loadbios, +- N_("BIOS_DUMP [INT10_DUMP]"), +- N_("Load BIOS dump.")); ++ cmd_fakebios = grub_register_command_lockdown ("fakebios", grub_cmd_fakebios, ++ 0, N_("Create BIOS-like structures for" ++ " backward compatibility with" ++ " existing OS.")); ++ ++ cmd_loadbios = grub_register_command_lockdown ("loadbios", grub_cmd_loadbios, ++ N_("BIOS_DUMP [INT10_DUMP]"), ++ N_("Load BIOS dump.")); + } + + GRUB_MOD_FINI(loadbios) +diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c +index d70c174..ed23dc7 100644 +--- a/grub-core/loader/arm/linux.c ++++ b/grub-core/loader/arm/linux.c +@@ -493,9 +493,9 @@ GRUB_MOD_INIT (linux) + 0, N_("Load Linux.")); + cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd, + 0, N_("Load initrd.")); +- cmd_devicetree = grub_register_command ("devicetree", grub_cmd_devicetree, +- /* TRANSLATORS: DTB stands for device tree blob. */ +- 0, N_("Load DTB file.")); ++ cmd_devicetree = grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, ++ /* TRANSLATORS: DTB stands for device tree blob. */ ++ 0, N_("Load DTB file.")); + my_mod = mod; + current_fdt = (const void *) grub_arm_firmware_get_boot_data (); + machine_type = grub_arm_firmware_get_machine_type (); +diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c +index ee9c559..003d07c 100644 +--- a/grub-core/loader/efi/fdt.c ++++ b/grub-core/loader/efi/fdt.c +@@ -165,8 +165,8 @@ static grub_command_t cmd_devicetree; + GRUB_MOD_INIT (fdt) + { + cmd_devicetree = +- grub_register_command ("devicetree", grub_cmd_devicetree, 0, +- N_("Load DTB file.")); ++ grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, 0, ++ N_("Load DTB file.")); + } + + GRUB_MOD_FINI (fdt) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch new file mode 100644 index 0000000000..f9a6a73ebc --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch @@ -0,0 +1,37 @@ +From e4f5c16f76e137b3beb6b61a6d2435e54fcb495c Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 24 Feb 2021 22:59:59 +0100 +Subject: [PATCH] commands/setpci: Restrict setpci command when locked down + +This command can set PCI devices register values, which makes it dangerous +in a locked down configuration. Restrict it so can't be used on this setup. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=58b77d4069823b44c5fa916fa8ddfc9c4cd51e02] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/commands/setpci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/setpci.c b/grub-core/commands/setpci.c +index d5bc97d..fa2ba7d 100644 +--- a/grub-core/commands/setpci.c ++++ b/grub-core/commands/setpci.c +@@ -329,10 +329,10 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(setpci) + { +- cmd = grub_register_extcmd ("setpci", grub_cmd_setpci, 0, +- N_("[-s POSITION] [-d DEVICE] [-v VAR] " +- "REGISTER[=VALUE[:MASK]]"), +- N_("Manipulate PCI devices."), options); ++ cmd = grub_register_extcmd_lockdown ("setpci", grub_cmd_setpci, 0, ++ N_("[-s POSITION] [-d DEVICE] [-v VAR] " ++ "REGISTER[=VALUE[:MASK]]"), ++ N_("Manipulate PCI devices."), options); + } + + GRUB_MOD_FINI(setpci) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch new file mode 100644 index 0000000000..a756f8d1cf --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch @@ -0,0 +1,35 @@ +From 7949671de268ba3116d113778e5d770574e9f9e3 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 24 Feb 2021 12:59:29 +0100 +Subject: [PATCH] commands/hdparm: Restrict hdparm command when locked down + +The command can be used to get/set ATA disk parameters. Some of these can +be dangerous since change the disk behavior. Restrict it when locked down. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5c97492a29c6063567b65ed1a069f5e6f4e211f0] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/commands/hdparm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/hdparm.c b/grub-core/commands/hdparm.c +index d3fa966..2e2319e 100644 +--- a/grub-core/commands/hdparm.c ++++ b/grub-core/commands/hdparm.c +@@ -436,9 +436,9 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(hdparm) + { +- cmd = grub_register_extcmd ("hdparm", grub_cmd_hdparm, 0, +- N_("[OPTIONS] DISK"), +- N_("Get/set ATA disk parameters."), options); ++ cmd = grub_register_extcmd_lockdown ("hdparm", grub_cmd_hdparm, 0, ++ N_("[OPTIONS] DISK"), ++ N_("Get/set ATA disk parameters."), options); + } + + GRUB_MOD_FINI(hdparm) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch new file mode 100644 index 0000000000..b52273ff50 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch @@ -0,0 +1,62 @@ +From 6993cce7c3a9d15e6573845f455d2f0de424a717 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 24 Feb 2021 15:03:26 +0100 +Subject: [PATCH] gdb: Restrict GDB access when locked down + +The gdbstub* commands allow to start and control a GDB stub running on +local host that can be used to connect from a remote debugger. Restrict +this functionality when the GRUB is locked down. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=508270838998f151a82e9c13e7cb8a470a2dc23d] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/gdb/gdb.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/grub-core/gdb/gdb.c b/grub-core/gdb/gdb.c +index 847a1e1..1818cb6 100644 +--- a/grub-core/gdb/gdb.c ++++ b/grub-core/gdb/gdb.c +@@ -75,20 +75,24 @@ static grub_command_t cmd, cmd_stop, cmd_break; + GRUB_MOD_INIT (gdb) + { + grub_gdb_idtinit (); +- cmd = grub_register_command ("gdbstub", grub_cmd_gdbstub, +- N_("PORT"), +- /* TRANSLATORS: GDB stub is a small part of +- GDB functionality running on local host +- which allows remote debugger to +- connect to it. */ +- N_("Start GDB stub on given port")); +- cmd_break = grub_register_command ("gdbstub_break", grub_cmd_gdb_break, +- /* TRANSLATORS: this refers to triggering +- a breakpoint so that the user will land +- into GDB. */ +- 0, N_("Break into GDB")); +- cmd_stop = grub_register_command ("gdbstub_stop", grub_cmd_gdbstop, +- 0, N_("Stop GDB stub")); ++ cmd = grub_register_command_lockdown ("gdbstub", grub_cmd_gdbstub, ++ N_("PORT"), ++ /* ++ * TRANSLATORS: GDB stub is a small part of ++ * GDB functionality running on local host ++ * which allows remote debugger to ++ * connect to it. ++ */ ++ N_("Start GDB stub on given port")); ++ cmd_break = grub_register_command_lockdown ("gdbstub_break", grub_cmd_gdb_break, ++ /* ++ * TRANSLATORS: this refers to triggering ++ * a breakpoint so that the user will land ++ * into GDB. ++ */ ++ 0, N_("Break into GDB")); ++ cmd_stop = grub_register_command_lockdown ("gdbstub_stop", grub_cmd_gdbstop, ++ 0, N_("Stop GDB stub")); + } + + GRUB_MOD_FINI (gdb) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch new file mode 100644 index 0000000000..474826ade5 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch @@ -0,0 +1,61 @@ +From 73f214761cff76a18a2a867976bdd3a9adb00b67 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Wed, 24 Feb 2021 14:44:38 +0100 +Subject: [PATCH] loader/xnu: Don't allow loading extension and packages when + locked down + +The shim_lock verifier validates the XNU kernels but no its extensions +and packages. Prevent these to be loaded when the GRUB is locked down. + +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c5565135f12400a925ee901b25984e7af4442f5] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/loader/xnu.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index 77d7060..07232d2 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -1482,20 +1482,23 @@ GRUB_MOD_INIT(xnu) + N_("Load XNU image.")); + cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64, + 0, N_("Load 64-bit XNU image.")); +- cmd_mkext = grub_register_command ("xnu_mkext", grub_cmd_xnu_mkext, 0, +- N_("Load XNU extension package.")); +- cmd_kext = grub_register_command ("xnu_kext", grub_cmd_xnu_kext, 0, +- N_("Load XNU extension.")); +- cmd_kextdir = grub_register_command ("xnu_kextdir", grub_cmd_xnu_kextdir, +- /* TRANSLATORS: OSBundleRequired is a +- variable name in xnu extensions +- manifests. It behaves mostly like +- GNU/Linux runlevels. +- */ +- N_("DIRECTORY [OSBundleRequired]"), +- /* TRANSLATORS: There are many extensions +- in extension directory. */ +- N_("Load XNU extension directory.")); ++ cmd_mkext = grub_register_command_lockdown ("xnu_mkext", grub_cmd_xnu_mkext, 0, ++ N_("Load XNU extension package.")); ++ cmd_kext = grub_register_command_lockdown ("xnu_kext", grub_cmd_xnu_kext, 0, ++ N_("Load XNU extension.")); ++ cmd_kextdir = grub_register_command_lockdown ("xnu_kextdir", grub_cmd_xnu_kextdir, ++ /* ++ * TRANSLATORS: OSBundleRequired is ++ * a variable name in xnu extensions ++ * manifests. It behaves mostly like ++ * GNU/Linux runlevels. ++ */ ++ N_("DIRECTORY [OSBundleRequired]"), ++ /* ++ * TRANSLATORS: There are many extensions ++ * in extension directory. ++ */ ++ N_("Load XNU extension directory.")); + cmd_ramdisk = grub_register_command ("xnu_ramdisk", grub_cmd_xnu_ramdisk, 0, + /* TRANSLATORS: ramdisk here isn't identifier. It can be translated. */ + N_("Load XNU ramdisk. " diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch new file mode 100644 index 0000000000..e5d372a2b1 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch @@ -0,0 +1,65 @@ +From dcc5a434e59f721b03cc809db0375a24aa2ac6d0 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas <javierm@redhat.com> +Date: Sat, 7 Nov 2020 01:03:18 +0100 +Subject: [PATCH] docs: Document the cutmem command + +The command is not present in the docs/grub.texi user documentation. + +Reported-by: Daniel Kiper <daniel.kiper@oracle.com> +Signed-off-by: Javier Martinez Canillas <javierm@redhat.com> +Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> +Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f05e79a0143beb2d9a482a3ebf4fe0ce76778122] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + docs/grub.texi | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index ccf1908..ae85f55 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3892,6 +3892,7 @@ you forget a command, you can run the command @command{help} + * cpuid:: Check for CPU features + * crc:: Compute or check CRC32 checksums + * cryptomount:: Mount a crypto device ++* cutmem:: Remove memory regions + * date:: Display or set current date and time + * devicetree:: Load a device tree blob + * distrust:: Remove a pubkey from trusted keys +@@ -4051,6 +4052,8 @@ this page is to be filtered. This syntax makes it easy to represent patterns + that are often result of memory damage, due to physical distribution of memory + cells. + ++The command is similar to @command{cutmem} command. ++ + Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). + This prevents removing EFI memory regions to potentially subvert the + security mechanisms provided by the UEFI secure boot. +@@ -4214,6 +4217,24 @@ GRUB suports devices encrypted using LUKS and geli. Note that necessary modules + be used. + @end deffn + ++@node cutmem ++@subsection cutmem ++ ++@deffn Command cutmem from[K|M|G] to[K|M|G] ++Remove any memory regions in specified range. ++@end deffn ++ ++This command notifies the memory manager that specified regions of RAM ought to ++be filtered out. This remains in effect after a payload kernel has been loaded ++by GRUB, as long as the loaded kernel obtains its memory map from GRUB. Kernels ++that support this include Linux, GNU Mach, the kernel of FreeBSD and Multiboot ++kernels in general. ++ ++The command is similar to @command{badram} command. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This prevents removing EFI memory regions to potentially subvert the ++ security mechanisms provided by the UEFI secure boot. + + @node date + @subsection date diff --git a/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch b/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch new file mode 100644 index 0000000000..504352b4e3 --- /dev/null +++ b/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch @@ -0,0 +1,107 @@ +From b5a6aa7d77439bfeb75f200abffe15c6f685c907 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett <mjg@redhat.com> +Date: Mon, 13 Jan 2014 12:13:09 +0000 +Subject: Don't permit loading modules on UEFI secure boot + +Author: Colin Watson <cjwatson@ubuntu.com> +Origin: vendor, http://pkgs.fedoraproject.org/cgit/grub2.git/tree/grub-2.00-no-insmod-on-sb.patch +Forwarded: no +Last-Update: 2013-12-25 + +Patch-Name: no-insmod-on-sb.patch + +Upstream-Status: Inappropriate [other, https://salsa.debian.org/grub-team/grub/-/blob/debian/2.04-20/debian/patches/no-insmod-on-sb.patch] + +Backport of a Debian (and Fedora) patch implementing a way to get secure boot status +for CVE-2020-14372_4.patch. The upstream solution has too many dependencies to backport. +Source: https://salsa.debian.org/grub-team/grub/-/blob/debian/2.04-20/debian/patches/no-insmod-on-sb.patch + +Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> +--- + grub-core/kern/dl.c | 13 +++++++++++++ + grub-core/kern/efi/efi.c | 28 ++++++++++++++++++++++++++++ + include/grub/efi/efi.h | 1 + + 3 files changed, 42 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 48eb5e7b6..074dfc3c6 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -38,6 +38,10 @@ + #define GRUB_MODULES_MACHINE_READONLY + #endif + ++#ifdef GRUB_MACHINE_EFI ++#include <grub/efi/efi.h> ++#endif ++ + \f + + #pragma GCC diagnostic ignored "-Wcast-align" +@@ -686,6 +690,15 @@ grub_dl_load_file (const char *filename) + void *core = 0; + grub_dl_t mod = 0; + ++#ifdef GRUB_MACHINE_EFI ++ if (grub_efi_secure_boot ()) ++ { ++ grub_error (GRUB_ERR_ACCESS_DENIED, ++ "Secure Boot forbids loading module from %s", filename); ++ return 0; ++ } ++#endif ++ + grub_boot_time ("Loading module %s", filename); + + file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE); +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 6e1ceb905..96204e39b 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -273,6 +273,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid, + return NULL; + } + ++grub_efi_boolean_t ++grub_efi_secure_boot (void) ++{ ++ grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID; ++ grub_size_t datasize; ++ char *secure_boot = NULL; ++ char *setup_mode = NULL; ++ grub_efi_boolean_t ret = 0; ++ ++ secure_boot = grub_efi_get_variable ("SecureBoot", &efi_var_guid, &datasize); ++ ++ if (datasize != 1 || !secure_boot) ++ goto out; ++ ++ setup_mode = grub_efi_get_variable ("SetupMode", &efi_var_guid, &datasize); ++ ++ if (datasize != 1 || !setup_mode) ++ goto out; ++ ++ if (*secure_boot && !*setup_mode) ++ ret = 1; ++ ++ out: ++ grub_free (secure_boot); ++ grub_free (setup_mode); ++ return ret; ++} ++ + #pragma GCC diagnostic ignored "-Wcast-align" + + /* Search the mods section from the PE32/PE32+ image. This code uses +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index e90e00dc4..a237952b3 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -82,6 +82,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var, + const grub_efi_guid_t *guid, + void *data, + grub_size_t datasize); ++grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void); + int + EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1, + const grub_efi_device_path_t *dp2); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 180e3752f8..db7c23a84a 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -31,6 +31,20 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch \ file://CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch \ file://determinism.patch \ + file://no-insmod-on-sb.patch \ + file://CVE-2020-14372_1.patch \ + file://CVE-2020-14372_2.patch \ + file://CVE-2020-14372_3.patch \ + file://CVE-2020-14372_4.patch \ + file://CVE-2020-14372_5.patch \ + file://CVE-2020-14372.patch \ + file://CVE-2020-27779.patch \ + file://CVE-2020-27779_2.patch \ + file://CVE-2020-27779_3.patch \ + file://CVE-2020-27779_4.patch \ + file://CVE-2020-27779_5.patch \ + file://CVE-2020-27779_6.patch \ + file://CVE-2020-27779_7.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 02/12] linux-firmware: upgrade 20211027 -> 20211216 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 03/12] libpcre2: update SRC_URI Steve Sakoman ` (9 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: wangmy <wangmy@fujitsu.com> License-Update: version of license file updated. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 07dc668ddc50de14821aff1b6850d8b4999702bd) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...{linux-firmware_20211027.bb => linux-firmware_20211216.bb} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename meta/recipes-kernel/linux-firmware/{linux-firmware_20211027.bb => linux-firmware_20211216.bb} (99%) diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb similarity index 99% rename from meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb rename to meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb index 76aed9d443..92b6ff5157 100644 --- a/meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb +++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb @@ -132,7 +132,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENCE.xc4000;md5=0ff51d2dc49fce04814c9155081092f0 \ file://LICENCE.xc5000;md5=1e170c13175323c32c7f4d0998d53f66 \ file://LICENCE.xc5000c;md5=12b02efa3049db65d524aeb418dd87ca \ - file://WHENCE;md5=d627873bd934d7c52b2c8191304a8eb7 \ + file://WHENCE;md5=79f477f9d53eedee5a65b45193785963 \ " # These are not common licenses, set NO_GENERIC_LICENSE for them @@ -205,7 +205,7 @@ PE = "1" SRC_URI = "${KERNELORG_MIRROR}/linux/kernel/firmware/${BPN}-${PV}.tar.xz" -SRC_URI[sha256sum] = "bc2657dd8eb82386a9a7ec6df9ccf31c32c7e9073c05d37786c1edc273f9440a" +SRC_URI[sha256sum] = "eeddb4e6bef31fd1a3757f12ccc324929bbad97855c0b9ec5ed780f74de1837d" inherit allarch -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 03/12] libpcre2: update SRC_URI 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 02/12] linux-firmware: upgrade 20211027 -> 20211216 Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 04/12] openssl: Add reproducibility fix Steve Sakoman ` (8 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core Version 10.34 tarball is no longer available at current URL, use downloads.yoctoproject.org mirror instead Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/recipes-support/libpcre/libpcre2_10.34.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-support/libpcre/libpcre2_10.34.bb b/meta/recipes-support/libpcre/libpcre2_10.34.bb index cbbb632f87..f2c36944d8 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.34.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.34.bb @@ -10,7 +10,7 @@ SECTION = "devel" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENCE;md5=b1588d3bb4cb0e1f5a597d908f8c5b37" -SRC_URI = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ +SRC_URI = "http://downloads.yoctoproject.org/mirror/sources/pcre2-${PV}.tar.bz2 \ file://pcre-cross.patch \ " -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 04/12] openssl: Add reproducibility fix 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (2 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 03/12] libpcre2: update SRC_URI Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 05/12] oeqa/selftest/bbtests: Use YP sources mirror instead of GNU Steve Sakoman ` (7 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Richard Purdie <richard.purdie@linuxfoundation.org> When the date rolled from one year to another, it highlighted a reproducibility issue in openssl. Patch a workaround for this to avoid autobuilder failures. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f8281e290737dba16a46d7ae937c66b3266e0fe8) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../openssl/openssl/reproducibility.patch | 22 +++++++++++++++++++ .../openssl/openssl_1.1.1l.bb | 1 + 2 files changed, 23 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/reproducibility.patch diff --git a/meta/recipes-connectivity/openssl/openssl/reproducibility.patch b/meta/recipes-connectivity/openssl/openssl/reproducibility.patch new file mode 100644 index 0000000000..8accbc9df2 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/reproducibility.patch @@ -0,0 +1,22 @@ +Using localtime() means the output can depend on the timezone of the build machine. +Using gmtime() is safer. For complete reproducibility use SOURCE_DATE_EPOCH if set. + +Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> +Upstream-Status: Pending [should be suitable] + +Index: openssl-3.0.1/apps/progs.pl +=================================================================== +--- openssl-3.0.1.orig/apps/progs.pl ++++ openssl-3.0.1/apps/progs.pl +@@ -21,7 +21,10 @@ die "Unrecognised option, must be -C or + my %commands = (); + my $cmdre = qr/^\s*int\s+([a-z_][a-z0-9_]*)_main\(\s*int\s+argc\s*,/; + my $apps_openssl = shift @ARGV; +-my $YEAR = [localtime()]->[5] + 1900; ++my $YEAR = [gmtime()]->[5] + 1900; ++if (defined($ENV{SOURCE_DATE_EPOCH}) && $ENV{SOURCE_DATE_EPOCH} !~ /\D/) { ++ $YEAR = [gmtime($ENV{SOURCE_DATE_EPOCH})]->[5] + 1900; ++} + + # because the program apps/openssl has object files as sources, and + # they then have the corresponding C files as source, we need to chain diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb index 9412b19fa5..bf7cd6527e 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ file://afalg.patch \ file://reproducible.patch \ + file://reproducibility.patch \ " SRC_URI_append_class-nativesdk = " \ -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 05/12] oeqa/selftest/bbtests: Use YP sources mirror instead of GNU 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (3 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 04/12] openssl: Add reproducibility fix Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 06/12] oeqa/selftest/tinfoil: Update to use test command Steve Sakoman ` (6 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Richard Purdie <richard.purdie@linuxfoundation.org> The gnu sources server has been known to disappear. Use the YP sources mirror instead. If that breaks, the autobuilder is broken anyway. This should reduce test failures from upstream network issues. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5459e42f1a6be9c08f303653cc1f73514eca9ef) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/lib/oeqa/selftest/cases/bbtests.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oeqa/selftest/cases/bbtests.py b/meta/lib/oeqa/selftest/cases/bbtests.py index d4f6a08991..e659be5341 100644 --- a/meta/lib/oeqa/selftest/cases/bbtests.py +++ b/meta/lib/oeqa/selftest/cases/bbtests.py @@ -157,7 +157,7 @@ SSTATE_DIR = \"${TOPDIR}/download-selftest\" """) self.track_for_cleanup(os.path.join(self.builddir, "download-selftest")) - data = 'SRC_URI = "${GNU_MIRROR}/aspell/aspell-${PV}.tar.gz;downloadfilename=test-aspell.tar.gz"' + data = 'SRC_URI = "https://downloads.yoctoproject.org/mirror/sources/aspell-${PV}.tar.gz;downloadfilename=test-aspell.tar.gz"' self.write_recipeinc('aspell', data) result = bitbake('-f -c fetch aspell', ignore_status=True) self.delete_recipeinc('aspell') -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 06/12] oeqa/selftest/tinfoil: Update to use test command 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (4 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 05/12] oeqa/selftest/bbtests: Use YP sources mirror instead of GNU Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 07/12] weston: Backport patches to always activate the top-level surface Steve Sakoman ` (5 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Richard Purdie <richard.purdie@linuxfoundation.org> We've had IO load issues on the autobuilder with this test. Avoid those by using a specilised test command instead. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 106445b1eb74fc37e03c72a0c011541b50a16c19) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/lib/oeqa/selftest/cases/tinfoil.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/lib/oeqa/selftest/cases/tinfoil.py b/meta/lib/oeqa/selftest/cases/tinfoil.py index a51c6048d3..0204537d49 100644 --- a/meta/lib/oeqa/selftest/cases/tinfoil.py +++ b/meta/lib/oeqa/selftest/cases/tinfoil.py @@ -94,14 +94,13 @@ class TinfoilTests(OESelftestTestCase): pass pattern = 'conf' - res = tinfoil.run_command('findFilesMatchingInDir', pattern, 'conf/machine') + res = tinfoil.run_command('testCookerCommandEvent', pattern) self.assertTrue(res) eventreceived = False commandcomplete = False start = time.time() # Wait for maximum 60s in total so we'd detect spurious heartbeat events for example - # The test is IO load sensitive too while (not (eventreceived == True and commandcomplete == True) and (time.time() - start < 60)): # if we received both events (on let's say a good day), we are done @@ -111,7 +110,8 @@ class TinfoilTests(OESelftestTestCase): commandcomplete = True elif isinstance(event, bb.event.FilesMatchingFound): self.assertEqual(pattern, event._pattern) - self.assertIn('qemuarm.conf', event._matches) + self.assertIn('A', event._matches) + self.assertIn('B', event._matches) eventreceived = True elif isinstance(event, logging.LogRecord): continue -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 07/12] weston: Backport patches to always activate the top-level surface 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (5 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 06/12] oeqa/selftest/tinfoil: Update to use test command Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 08/12] scripts/buildhistory-diff: drop use of distutils Steve Sakoman ` (4 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Marek Vasut <marex@denx.de> In case the device has only touchscreen input device and no keyboard or mouse, the top level surface is never activated. The behavior differs from a device which has a keyboard (or gpio-keys, or even uinput-emulated keyboard), where callchain activate()->weston_view_activate()->weston_seat_set_keyboard_focus()-> weston_keyboard_set_focus()->wl_signal_emit(&keyboard->focus_signal, keyboard)-> handle_keyboard_focus()->weston_desktop_surface_set_activated(..., true); sets the top level surface as activated. On device with touchscreen, the above is never called, hence the top level surface is never activated. Add explicit weston_desktop_surface_set_activated(shsurf->desktop_surface, true); into activate() to always active the top level surface. This fixes at least two known issues on such devices: - Wayland terminal cursor is an empty bar (full bar with keyboard present) - Chromium dropdown menus are randomly placed (they are placed correctly when keyboard is present, because then chromium can find the activated top level surface) Signed-off-by: Marek Vasut <marex@denx.de> Cc: Steve Sakoman <steve@sakoman.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> --- ...move-no-op-de-activation-of-the-xdg-.patch | 32 ++++++ ...name-gain-lose-keyboard-focus-to-act.patch | 57 +++++++++++ ...bed-keyboard-focus-handle-code-when-.patch | 99 +++++++++++++++++++ meta/recipes-graphics/wayland/weston_8.0.0.bb | 3 + 4 files changed, 191 insertions(+) create mode 100644 meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch create mode 100644 meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch create mode 100644 meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch diff --git a/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch b/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch new file mode 100644 index 0000000000..fb36d3817a --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch @@ -0,0 +1,32 @@ +From 5c74a0640e873694bf60a88eceb21f664cb4b8f7 Mon Sep 17 00:00:00 2001 +From: Marius Vlad <marius.vlad@collabora.com> +Date: Fri, 5 Mar 2021 20:03:49 +0200 +Subject: [PATCH 2/5] desktop-shell: Remove no-op de-activation of the xdg + top-level surface + +The shsurf is calloc'ed so the surface count is always 0. Not only +that but the surface is not set as active by default, so there's no +need to de-activate it. + +Upstream-Status: Backport [05bef4c18a3e82376a46a4a28d978389c4c0fd0f] +Signed-off-by: Marius Vlad <marius.vlad@collabora.com> +--- + desktop-shell/shell.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index 442a625f..3791be25 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -2427,8 +2427,6 @@ desktop_surface_added(struct weston_desktop_surface *desktop_surface, + wl_list_init(&shsurf->children_link); + + weston_desktop_surface_set_user_data(desktop_surface, shsurf); +- weston_desktop_surface_set_activated(desktop_surface, +- shsurf->focus_count > 0); + } + + static void +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch b/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch new file mode 100644 index 0000000000..dcd0700fca --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch @@ -0,0 +1,57 @@ +From edb31c456ae3da7ffffefb668a37ab88075c4b67 Mon Sep 17 00:00:00 2001 +From: Marius Vlad <marius.vlad@collabora.com> +Date: Fri, 5 Mar 2021 21:40:22 +0200 +Subject: [PATCH 3/5] desktop-shell: Rename gain/lose keyboard focus to + activate/de-activate + +This way it better reflects that it handles activation rather that input +focus. + +Upstream-Status: Backport [ab39e1d76d4f6715cb300bc37f5c2a0e2d426208] +Signed-off-by: Marius Vlad <marius.vlad@collabora.com> +--- + desktop-shell/shell.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index 3791be25..c4669f11 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -1869,14 +1869,14 @@ handle_pointer_focus(struct wl_listener *listener, void *data) + } + + static void +-shell_surface_lose_keyboard_focus(struct shell_surface *shsurf) ++shell_surface_deactivate(struct shell_surface *shsurf) + { + if (--shsurf->focus_count == 0) + weston_desktop_surface_set_activated(shsurf->desktop_surface, false); + } + + static void +-shell_surface_gain_keyboard_focus(struct shell_surface *shsurf) ++shell_surface_activate(struct shell_surface *shsurf) + { + if (shsurf->focus_count++ == 0) + weston_desktop_surface_set_activated(shsurf->desktop_surface, true); +@@ -1891,7 +1891,7 @@ handle_keyboard_focus(struct wl_listener *listener, void *data) + if (seat->focused_surface) { + struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); + if (shsurf) +- shell_surface_lose_keyboard_focus(shsurf); ++ shell_surface_deactivate(shsurf); + } + + seat->focused_surface = weston_surface_get_main_surface(keyboard->focus); +@@ -1899,7 +1899,7 @@ handle_keyboard_focus(struct wl_listener *listener, void *data) + if (seat->focused_surface) { + struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); + if (shsurf) +- shell_surface_gain_keyboard_focus(shsurf); ++ shell_surface_activate(shsurf); + } + } + +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch b/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch new file mode 100644 index 0000000000..7ca72f8494 --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch @@ -0,0 +1,99 @@ +From 899ad5a6a8a92f2c10e0694a45c982b7d878aed6 Mon Sep 17 00:00:00 2001 +From: Marius Vlad <marius.vlad@collabora.com> +Date: Fri, 5 Mar 2021 21:44:26 +0200 +Subject: [PATCH 4/5] desktop-shell: Embed keyboard focus handle code when + activating + +We shouldn't be constrained by having a keyboard plugged-in, so avoid +activating/de-activating the window/surface in the keyboard focus +handler and embed it straight into the window activation part. + +Upstream-Status: Backport [f12697bb3e4c6eb85437ed905e7de44ae2a0ba69] +Signed-off-by: Marius Vlad <marius.vlad@collabora.com> +--- + desktop-shell/shell.c | 41 +++++++++++++++++++++++++---------------- + 1 file changed, 25 insertions(+), 16 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index c4669f11..c6a4fe91 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -1885,22 +1885,7 @@ shell_surface_activate(struct shell_surface *shsurf) + static void + handle_keyboard_focus(struct wl_listener *listener, void *data) + { +- struct weston_keyboard *keyboard = data; +- struct shell_seat *seat = get_shell_seat(keyboard->seat); +- +- if (seat->focused_surface) { +- struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); +- if (shsurf) +- shell_surface_deactivate(shsurf); +- } +- +- seat->focused_surface = weston_surface_get_main_surface(keyboard->focus); +- +- if (seat->focused_surface) { +- struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); +- if (shsurf) +- shell_surface_activate(shsurf); +- } ++ /* FIXME: To be removed later. */ + } + + /* The surface will be inserted into the list immediately after the link +@@ -2438,6 +2423,7 @@ desktop_surface_removed(struct weston_desktop_surface *desktop_surface, + struct shell_surface *shsurf_child, *tmp; + struct weston_surface *surface = + weston_desktop_surface_get_surface(desktop_surface); ++ struct weston_seat *seat; + + if (!shsurf) + return; +@@ -2448,6 +2434,18 @@ desktop_surface_removed(struct weston_desktop_surface *desktop_surface, + } + wl_list_remove(&shsurf->children_link); + ++ wl_list_for_each(seat, &shsurf->shell->compositor->seat_list, link) { ++ struct shell_seat *shseat = get_shell_seat(seat); ++ /* activate() controls the focused surface activation and ++ * removal of a surface requires invalidating the ++ * focused_surface to avoid activate() use a stale (and just ++ * removed) surface when attempting to de-activate it. It will ++ * also update the focused_surface once it has a chance to run. ++ */ ++ if (surface == shseat->focused_surface) ++ shseat->focused_surface = NULL; ++ } ++ + wl_signal_emit(&shsurf->destroy_signal, shsurf); + + if (shsurf->fullscreen.black_view) +@@ -3836,6 +3834,7 @@ activate(struct desktop_shell *shell, struct weston_view *view, + struct workspace *ws; + struct weston_surface *old_es; + struct shell_surface *shsurf, *shsurf_child; ++ struct shell_seat *shseat = get_shell_seat(seat); + + main_surface = weston_surface_get_main_surface(es); + shsurf = get_shell_surface(main_surface); +@@ -3855,6 +3854,16 @@ activate(struct desktop_shell *shell, struct weston_view *view, + + weston_view_activate(view, seat, flags); + ++ if (shseat->focused_surface) { ++ struct shell_surface *current_focus = ++ get_shell_surface(shseat->focused_surface); ++ assert(current_focus); ++ shell_surface_deactivate(current_focus); ++ } ++ ++ shseat->focused_surface = main_surface; ++ shell_surface_activate(shsurf); ++ + state = ensure_focus_state(shell, seat); + if (state == NULL) + return; +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston_8.0.0.bb b/meta/recipes-graphics/wayland/weston_8.0.0.bb index 2b120d7404..e647fbc686 100644 --- a/meta/recipes-graphics/wayland/weston_8.0.0.bb +++ b/meta/recipes-graphics/wayland/weston_8.0.0.bb @@ -12,6 +12,9 @@ SRC_URI = "https://wayland.freedesktop.org/releases/${BPN}-${PV}.tar.xz \ file://systemd-notify.weston-start \ file://xwayland.weston-start \ file://0001-weston-launch-Provide-a-default-version-that-doesn-t.patch \ + file://0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch \ + file://0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch \ + file://0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch \ " SRC_URI[md5sum] = "53e4810d852df0601d01fd986a5b22b3" SRC_URI[sha256sum] = "7518b49b2eaa1c3091f24671bdcc124fd49fc8f1af51161927afa4329c027848" -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 08/12] scripts/buildhistory-diff: drop use of distutils 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (6 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 07/12] weston: Backport patches to always activate the top-level surface Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 09/12] selftest: skip virgl test on fedora 35 Steve Sakoman ` (3 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Tim Orling <timothy.t.orling@intel.com> The use of distutils.version.LooseVersion to check for GitPython > 0.3.1 is not really needed anymore since any supported distribution has at least 1.0.0 (centos-7 via epel7, debian-9, ubuntu-16.04) If we want to reinstate this check, alternatives would be to require python3-packaging on all hosts and use packaging.version.Version or use an imported LooseVersion in bb.version. [YOCTO #14610] Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bc90dcae9f53ddc246942f4d9b8ae8943e3b9754) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- scripts/buildhistory-diff | 5 ----- 1 file changed, 5 deletions(-) diff --git a/scripts/buildhistory-diff b/scripts/buildhistory-diff index 833f7c33a5..02eedafd6e 100755 --- a/scripts/buildhistory-diff +++ b/scripts/buildhistory-diff @@ -11,7 +11,6 @@ import sys import os import argparse -from distutils.version import LooseVersion # Ensure PythonGit is installed (buildhistory_analysis needs it) try: @@ -71,10 +70,6 @@ def main(): parser = get_args_parser() args = parser.parse_args() - if LooseVersion(git.__version__) < '0.3.1': - sys.stderr.write("Version of GitPython is too old, please install GitPython (python-git) 0.3.1 or later in order to use this script\n") - sys.exit(1) - if len(args.revisions) > 2: sys.stderr.write('Invalid argument(s) specified: %s\n\n' % ' '.join(args.revisions[2:])) parser.print_help() -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 09/12] selftest: skip virgl test on fedora 35 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (7 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 08/12] scripts/buildhistory-diff: drop use of distutils Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 10/12] scripts: Update to use exec_module() instead of load_module() Steve Sakoman ` (2 subsequent siblings) 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core This test will fail any time the host has libdrm > 2.4.107 Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/lib/oeqa/selftest/cases/runtime_test.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/lib/oeqa/selftest/cases/runtime_test.py b/meta/lib/oeqa/selftest/cases/runtime_test.py index f5b3ba27a9..20dc1c9482 100644 --- a/meta/lib/oeqa/selftest/cases/runtime_test.py +++ b/meta/lib/oeqa/selftest/cases/runtime_test.py @@ -183,6 +183,8 @@ class TestImage(OESelftestTestCase): self.skipTest('virgl isn\'t working with Centos 8') if distro and distro == 'fedora-34': self.skipTest('virgl isn\'t working with Fedora 34') + if distro and distro == 'fedora-35': + self.skipTest('virgl isn\'t working with Fedora 35') if distro and distro == 'opensuseleap-15.0': self.skipTest('virgl isn\'t working with Opensuse 15.0') -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 10/12] scripts: Update to use exec_module() instead of load_module() 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (8 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 09/12] selftest: skip virgl test on fedora 35 Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 11/12] lib/oe/reproducible: correctly set .git location when recursively looking for git repos Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 12/12] asciidoc: properly detect and compare Python versions >= 3.10 Steve Sakoman 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Richard Purdie <richard.purdie@linuxfoundation.org> This is deprecated in python 3.12 and Fedora 35 is throwing warnings so move to the new functions. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 655cd3f614d736416eab0d708b7c49674bf5c977) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- scripts/lib/scriptutils.py | 7 +++++-- scripts/lib/wic/pluginbase.py | 8 ++++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/scripts/lib/scriptutils.py b/scripts/lib/scriptutils.py index 3164171eb2..47a08194d0 100644 --- a/scripts/lib/scriptutils.py +++ b/scripts/lib/scriptutils.py @@ -18,7 +18,8 @@ import sys import tempfile import threading import importlib -from importlib import machinery +import importlib.machinery +import importlib.util class KeepAliveStreamHandler(logging.StreamHandler): def __init__(self, keepalive=True, **kwargs): @@ -82,7 +83,9 @@ def load_plugins(logger, plugins, pluginpath): logger.debug('Loading plugin %s' % name) spec = importlib.machinery.PathFinder.find_spec(name, path=[pluginpath] ) if spec: - return spec.loader.load_module() + mod = importlib.util.module_from_spec(spec) + spec.loader.exec_module(mod) + return mod def plugin_name(filename): return os.path.splitext(os.path.basename(filename))[0] diff --git a/scripts/lib/wic/pluginbase.py b/scripts/lib/wic/pluginbase.py index d9b4e57747..b64568339b 100644 --- a/scripts/lib/wic/pluginbase.py +++ b/scripts/lib/wic/pluginbase.py @@ -9,9 +9,11 @@ __all__ = ['ImagerPlugin', 'SourcePlugin'] import os import logging +import types from collections import defaultdict -from importlib.machinery import SourceFileLoader +import importlib +import importlib.util from wic import WicError from wic.misc import get_bitbake_var @@ -54,7 +56,9 @@ class PluginMgr: mname = fname[:-3] mpath = os.path.join(ppath, fname) logger.debug("loading plugin module %s", mpath) - SourceFileLoader(mname, mpath).load_module() + spec = importlib.util.spec_from_file_location(mname, mpath) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) return PLUGINS.get(ptype) -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 11/12] lib/oe/reproducible: correctly set .git location when recursively looking for git repos 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (9 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 10/12] scripts: Update to use exec_module() instead of load_module() Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 12/12] asciidoc: properly detect and compare Python versions >= 3.10 Steve Sakoman 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core From: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ffdaa1a0527691d66dd28e86bd015bfad7a020f6) Signed-off-by: Steve Sakoman <steve@sakoman.com> --- meta/lib/oe/reproducible.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oe/reproducible.py b/meta/lib/oe/reproducible.py index 204b9bd734..0938e4cb39 100644 --- a/meta/lib/oe/reproducible.py +++ b/meta/lib/oe/reproducible.py @@ -41,7 +41,7 @@ def find_git_folder(d, sourcedir): for root, dirs, files in os.walk(workdir, topdown=True): dirs[:] = [d for d in dirs if d not in exclude] if '.git' in dirs: - return root + return os.path.join(root, ".git") bb.warn("Failed to find a git repository in WORKDIR: %s" % workdir) return None -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 12/12] asciidoc: properly detect and compare Python versions >= 3.10 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman ` (10 preceding siblings ...) 2022-01-09 22:04 ` [OE-core][dunfell 11/12] lib/oe/reproducible: correctly set .git location when recursively looking for git repos Steve Sakoman @ 2022-01-09 22:04 ` Steve Sakoman 11 siblings, 0 replies; 24+ messages in thread From: Steve Sakoman @ 2022-01-09 22:04 UTC (permalink / raw) To: openembedded-core asciidoc.py cannot properly detect versions of Python >= 3.10 Backport patch from upstream to correct this: https://github.com/asciidoc-py/asciidoc-py/commit/44d2d6095246124c024230f89c1029794491839f Fixed upstream in version 9.04, so this patch is not required in master. Signed-off-by: Steve Sakoman <steve@sakoman.com> --- .../asciidoc/detect-python-version.patch | 42 +++++++++++++++++++ .../asciidoc/asciidoc_8.6.9.bb | 3 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch diff --git a/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch b/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch new file mode 100644 index 0000000000..14c1cd806e --- /dev/null +++ b/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch @@ -0,0 +1,42 @@ +From 44d2d6095246124c024230f89c1029794491839f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz> +Date: Fri, 30 Oct 2020 15:10:35 +0100 +Subject: [PATCH] Properly detect and compare Python version 3.10+ (#151) + +Upstream commit: https://github.com/asciidoc-py/asciidoc-py/commit/44d2d6095246124c024230f89c1029794491839f + +Slightly modified to cleanly apply to asciidoc 8.6.9: +- VERSION and MIN_PYTHON_VERSION changed to reflect values in 8.6.9 +- line numbers corrected to eliminate offset warnings + +Upstream-Status: Backport +Signed-off-by: Steve Sakoman <steve@sakoman.com> + +--- + asciidoc.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/asciidoc.py b/asciidoc.py +index f960e7d8..42868c4b 100755 +--- a/asciidoc.py ++++ b/asciidoc.py +@@ -30,7 +30,7 @@ + # Used by asciidocapi.py # + VERSION = '8.6.10' # See CHANGELOG file for version history. + +-MIN_PYTHON_VERSION = '3.4' # Require this version of Python or better. ++MIN_PYTHON_VERSION = (3, 4) # Require this version of Python or better. + + # --------------------------------------------------------------------------- + # Program constants. +@@ -4704,8 +4704,8 @@ def init(self, cmd): + directory. + cmd is the asciidoc command or asciidoc.py path. + """ +- if float(sys.version[:3]) < float(MIN_PYTHON_VERSION): +- message.stderr('FAILED: Python %s or better required' % MIN_PYTHON_VERSION) ++ if sys.version_info[:2] < MIN_PYTHON_VERSION: ++ message.stderr('FAILED: Python %d.%d or better required' % MIN_PYTHON_VERSION) + sys.exit(1) + if not os.path.exists(cmd): + message.stderr('FAILED: Missing asciidoc command: %s' % cmd) diff --git a/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb b/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb index 932339f739..62738dc8d9 100644 --- a/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb +++ b/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb @@ -9,7 +9,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b \ file://COPYRIGHT;md5=029ad5428ba5efa20176b396222d4069" SRC_URI = "git://github.com/asciidoc/asciidoc-py3;protocol=https;branch=main \ - file://auto-catalogs.patch" + file://auto-catalogs.patch \ + file://detect-python-version.patch" SRCREV = "618f6e6f6b558ed1e5f2588cd60a5a6b4f881ca0" PV .= "+py3-git${SRCPV}" -- 2.25.1 ^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][dunfell 00/12] Patch review
@ 2024-03-20 16:43 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2024-03-20 16:43 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Friday, March 22
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6692
The following changes since commit b49b0a3dd74c24f3a011c9c0b5cf8f6530956cfa:
build-appliance-image: Update to dunfell head revision (2024-03-01 03:19:51 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alex Kiernan (1):
wireless-regdb: Upgrade 2023.09.01 -> 2024.01.23
Alexander Kanavin (1):
linux-firmware: upgrade 20231211 -> 20240220
Alexander Sverdlin (1):
linux-firmware: upgrade 20231030 -> 20231211
Michael Halstead (1):
yocto-uninative: Update to 4.4 for glibc 2.39
Vijay Anusuri (1):
libxml2: Backport fix for CVE-2024-25062
Wang Mingyu (1):
wireless-regdb: upgrade 2023.05.03 -> 2023.09.01
Yoann Congal (6):
cve-update-nvd2-native: Fix typo in comment
cve-update-nvd2-native: Add an age threshold for incremental update
cve-update-nvd2-native: Remove duplicated CVE_CHECK_DB_FILE definition
cve-update-nvd2-native: nvd_request_next: Improve comment
cve-update-nvd2-native: Fix CVE configuration update
cve-update-nvd2-native: Remove rejected CVE from database
meta/conf/distro/include/yocto-uninative.inc | 10 ++---
.../libxml/libxml2/CVE-2024-25062-pre1.patch | 38 +++++++++++++++++++
.../libxml/libxml2/CVE-2024-25062.patch | 33 ++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 2 +
.../meta/cve-update-nvd2-native.bb | 35 +++++++++++++----
...20231030.bb => linux-firmware_20240220.bb} | 7 ++--
....05.03.bb => wireless-regdb_2024.01.23.bb} | 4 +-
7 files changed, 111 insertions(+), 18 deletions(-)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2024-25062-pre1.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2024-25062.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20231030.bb => linux-firmware_20240220.bb} (99%)
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2023.05.03.bb => wireless-regdb_2024.01.23.bb} (88%)
--
2.34.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2023-02-04 21:48 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2023-02-04 21:48 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4885
The following changes since commit 4f069121ddb99bb6e2f186724cd60ca07f74f503:
python3: fix packaging of Windows distutils installer stubs (2023-02-04 04:34:20 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (2):
linux-yocto/5.4: update to v5.4.229
linux-yocto/5.4: update to v5.4.230
Khem Raj (1):
libtirpc: Check if file exists before operating on it
Niko Mauno (1):
Fix missing leading whitespace with ':append'
Ranjitsinh Rathod (1):
libsdl2: Add fix for CVE-2022-4743
Steve Sakoman (4):
lttng-modules: update 2.11.6 -> 2.11.7
lttng-modules: update 2.11.7 -> 2.11.8
lttng-modules: update 2.11.8 -> 2.11.9
lttng-modules: fix build with 5.4.229 kernel
Thomas Roos (1):
devtool: fix devtool finish when gitmodules file is empty
Vivek Kumbhar (1):
go: fix CVE-2022-1962 go/parser stack exhaustion in all Parse*
functions
Xiaobing Luo (1):
devtool: Fix _copy_file() TypeError
meta/classes/externalsrc.bbclass | 2 +-
meta/classes/populate_sdk_ext.bbclass | 2 +-
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2022-1962.patch | 357 ++++++++++++++++++
.../libtirpc/libtirpc_1.2.6.bb | 2 +-
.../libsdl2/libsdl2/CVE-2022-4743.patch | 38 ++
.../libsdl2/libsdl2_2.0.12.bb | 1 +
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
...ncpy-equals-destination-size-warning.patch | 42 ---
...jtool-Rename-frame.h-objtool.h-v5.10.patch | 88 -----
...oints-output-proper-root-owner-for-t.patch | 316 ----------------
...rdered-extent-tracepoint-take-btrfs_.patch | 179 ---------
...ext4-fast-commit-recovery-path-v5.10.patch | 91 -----
...intr-vectoring-info-and-error-code-t.patch | 124 ------
...x86-mmu-Add-TDP-MMU-PF-handler-v5.10.patch | 82 ----
...Return-unique-RET_PF_-values-if-the-.patch | 71 ----
...int-Optimize-using-static_call-v5.10.patch | 155 --------
...-fix-include-order-for-older-kernels.patch | 31 --
.../0011-Add-release-maintainer-script.patch | 59 ---
.../0012-Improve-the-release-script.patch | 173 ---------
...fix-ext4-fast-commit-recovery-path-v.patch | 32 --
...-fix-include-order-for-older-kernels.patch | 32 --
...fix-tracepoint-Optimize-using-static.patch | 46 ---
...ion-range-for-trace_find_free_extent.patch | 30 --
...ix-jbd2-use-the-correct-print-format.patch | 147 ++++++++
...ules_2.11.6.bb => lttng-modules_2.11.9.bb} | 21 +-
scripts/lib/devtool/standard.py | 2 +-
29 files changed, 569 insertions(+), 1591 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2022-1962.patch
create mode 100644 meta/recipes-graphics/libsdl2/libsdl2/CVE-2022-4743.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-fix-strncpy-equals-destination-size-warning.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0002-fix-objtool-Rename-frame.h-objtool.h-v5.10.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0003-fix-btrfs-tracepoints-output-proper-root-owner-for-t.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0004-fix-btrfs-make-ordered-extent-tracepoint-take-btrfs_.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0005-fix-ext4-fast-commit-recovery-path-v5.10.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0006-fix-KVM-x86-Add-intr-vectoring-info-and-error-code-t.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0007-fix-kvm-x86-mmu-Add-TDP-MMU-PF-handler-v5.10.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0008-fix-KVM-x86-mmu-Return-unique-RET_PF_-values-if-the-.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0009-fix-tracepoint-Optimize-using-static_call-v5.10.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0010-fix-include-order-for-older-kernels.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0011-Add-release-maintainer-script.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0012-Improve-the-release-script.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0013-fix-backport-of-fix-ext4-fast-commit-recovery-path-v.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0014-Revert-fix-include-order-for-older-kernels.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0015-fix-backport-of-fix-tracepoint-Optimize-using-static.patch
delete mode 100644 meta/recipes-kernel/lttng/lttng-modules/0016-fix-adjust-version-range-for-trace_find_free_extent.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/fix-jbd2-use-the-correct-print-format.patch
rename meta/recipes-kernel/lttng/{lttng-modules_2.11.6.bb => lttng-modules_2.11.9.bb} (59%)
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2022-06-30 16:23 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2022-06-30 16:23 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3844
With the exception of a known autobuilder intermittent issue:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14788
which passed on subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/42/builds/5413
The following changes since commit c6f5fb5e7545636ef7948ad1562548b7b64dac35:
linux-firmware: upgrade 20220509 -> 20220610 (2022-06-20 07:32:00 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Ahmed Hossam (1):
insane.bbclass: host-user-contaminated: Correct per package home path
Alexander Kanavin (1):
wireless-regdb: upgrade 2022.04.08 -> 2022.06.06
Hitendra Prajapati (3):
golang: CVE-2022-24675 encoding/pem: fix stack overflow in Decode
golang: CVE-2021-31525 net/http: panic in ReadRequest and ReadResponse
when reading a very large header
grub2: CVE-2021-3981 Incorrect permission in grub.cfg allow
unprivileged user to read the file content
Joe Slater (1):
unzip: fix CVE-2021-4217
Marek Vasut (1):
lttng-modules: Backport Linux 5.18+, 5.15.44+, 5.10.119+ fixes
Marta Rybczynska (2):
cve-check: add support for Ignored CVEs
oeqa/selftest/cve_check: add tests for Ignored and partial reports
Martin Jansa (1):
wic: fix WicError message
Muhammad Hamza (1):
initramfs-framework: move storage mounts to actual rootfs
Richard Purdie (1):
unzip: Port debian fixes for two CVEs
meta/classes/cve-check.bbclass | 41 ++-
meta/classes/insane.bbclass | 2 +-
meta/lib/oeqa/selftest/cases/cve_check.py | 82 ++++++
.../grub/files/CVE-2021-3981.patch | 32 +++
meta/recipes-bsp/grub/grub2.inc | 1 +
.../initrdscripts/initramfs-framework/finish | 9 +
meta/recipes-devtools/go/go-1.14.inc | 2 +
.../go/go-1.14/CVE-2021-31525.patch | 38 +++
.../go/go-1.14/CVE-2022-24675.patch | 271 ++++++++++++++++++
.../unzip/unzip/CVE-2021-4217.patch | 67 +++++
.../unzip/unzip/CVE-2022-0529.patch | 39 +++
.../unzip/unzip/CVE-2022-0530.patch | 33 +++
meta/recipes-extended/unzip/unzip_6.0.bb | 3 +
...ndom-remove-unused-tracepoints-v5.18.patch | 46 +++
...emove-unused-tracepoints-v5.10-v5.15.patch | 45 +++
...racepoints-removed-in-stable-kernels.patch | 51 ++++
.../lttng/lttng-modules_2.11.6.bb | 3 +
....04.08.bb => wireless-regdb_2022.06.06.bb} | 2 +-
scripts/wic | 2 +-
19 files changed, 754 insertions(+), 15 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2021-3981.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2021-31525.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2022-24675.patch
create mode 100644 meta/recipes-extended/unzip/unzip/CVE-2021-4217.patch
create mode 100644 meta/recipes-extended/unzip/unzip/CVE-2022-0529.patch
create mode 100644 meta/recipes-extended/unzip/unzip/CVE-2022-0530.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0017-fix-random-remove-unused-tracepoints-v5.18.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0018-fix-random-remove-unused-tracepoints-v5.10-v5.15.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0019-fix-random-tracepoints-removed-in-stable-kernels.patch
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2022.04.08.bb => wireless-regdb_2022.06.06.bb} (94%)
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2022-06-19 19:34 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2022-06-19 19:34 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3790
The following changes since commit 7e056e79a5acce8261cb5124c172cc40ad608b82:
linux-yocto/5.4: update to v5.4.196 (2022-06-07 08:56:30 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Jose Quaresma (2):
archiver: use bb.note instead of echo
archiver: don't use machine variables in shared recipes
Marcel Ziswiler (1):
alsa-plugins: fix libavtp vs. avtp packageconfig
Martin Jansa (1):
rootfs.py: close kernel_abi_ver_file
Mingli Yu (1):
oescripts: change compare logic in OEListPackageconfigTests
Pawan Badganchi (1):
openssh: Whitelist CVE-2021-36368
Peter Kjellerstedt (1):
license.bbclass: Bound beginline and endline in copy_license_files()
Rasmus Villemoes (1):
e2fsprogs: add alternatives handling of lsattr as well
Richard Purdie (2):
vim: Upgrade 8.2.5034 -> 8.2.5083
gcc-source: Fix incorrect task dependencies from ${B}
Stefan Wiehler (1):
kernel-yocto.bbclass: Reset to exiting on non-zero return code at end
of task
Steve Sakoman (1):
cups: fix CVE-2022-26691
meta/classes/archiver.bbclass | 11 +++++--
meta/classes/kernel-yocto.bbclass | 8 +++++
meta/classes/license.bbclass | 8 ++---
meta/lib/oe/rootfs.py | 4 ++-
meta/lib/oeqa/selftest/cases/oescripts.py | 3 +-
.../openssh/openssh_8.2p1.bb | 7 ++++
.../e2fsprogs/e2fsprogs_1.45.7.bb | 5 ++-
meta/recipes-devtools/gcc/gcc-common.inc | 2 +-
meta/recipes-devtools/gcc/gcc-source.inc | 1 +
meta/recipes-extended/cups/cups.inc | 3 +-
.../cups/cups/CVE-2022-26691.patch | 33 +++++++++++++++++++
.../alsa/alsa-plugins_1.2.1.bb | 2 +-
meta/recipes-support/vim/vim.inc | 4 +--
13 files changed, 76 insertions(+), 15 deletions(-)
create mode 100644 meta/recipes-extended/cups/cups/CVE-2022-26691.patch
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2021-08-19 19:07 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2021-08-19 19:07 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2469
The following changes since commit ce78c16409363741d59a2f787aca66077bec93cd:
sstate.bbclass: fix error handling when sstate mirrors is ro (2021-08-16 04:41:07 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexandre Belloni (1):
oeqa/runtime/cases: make date.DateTest.test_date more reliable
Bruce Ashfield (3):
linux-yocto/5.4: update to v5.4.137
linux-yocto/5.4: update to v5.4.139
linux-yocto/5.4: update to v5.4.141
Dmitry Baryshkov (1):
linux-firmware: add more Qualcomm firmware packages
Dragos-Marian Panait (1):
util-linux: fix CVE-2021-37600
Khem Raj (1):
sdk: Enable do_populate_sdk with multilibs
Purushottam Choudhary (1):
python3: Remove unused python3 recipe
Richard Purdie (1):
oeqa/selftest/glibc: Handle incorrect encoding issuesin glibc test
results
Ross Burton (2):
tar: ignore node-tar CVEs
ovmf: build natively everywhere
hongxu (1):
sdk: fix relocate symlink failed
meta/classes/multilib.bbclass | 1 -
meta/classes/populate_sdk_base.bbclass | 2 +-
meta/files/toolchain-shar-relocate.sh | 2 +-
meta/lib/oeqa/runtime/cases/date.py | 9 +-
meta/lib/oeqa/selftest/cases/glibc.py | 2 +-
meta/recipes-core/ovmf/ovmf_git.bb | 2 +-
.../util-linux/CVE-2021-37600.patch | 33 ++
.../util-linux/util-linux_2.35.1.bb | 1 +
.../recipes-devtools/python/python3_3.8.10.bb | 363 ------------------
meta/recipes-extended/tar/tar_1.32.bb | 3 +
.../linux-firmware/linux-firmware_20210511.bb | 17 +-
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
14 files changed, 79 insertions(+), 392 deletions(-)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2021-37600.patch
delete mode 100644 meta/recipes-devtools/python/python3_3.8.10.bb
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2021-07-12 15:31 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2021-07-12 15:31 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Wednesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2338
The following changes since commit c96bcf97272f243df14598c84a41097746884b65:
oeqa/selftest/archiver: Allow tests to ignore empty directories (2021-07-06 04:37:02 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
bootchart2: update 0.14.8 -> 0.14.9
Chen Qi (1):
busybox: fix CVE-2021-28831
Khem Raj (1):
webkitgtk: Upgrade to 2.28.4
Marek Vasut (1):
update-rc.d: update SRCREV to pull in fix for non-bash shell support
Minjae Kim (1):
dhcp: fix CVE-2021-25217
Richard Purdie (4):
webkitgtk: upgrade 2.28.2 -> 2.28.3
dwarfsrcfiles: Avoid races over debug-link files
oeqa/selftest/multiprocesslauch: Fix test race
report-error: Drop pointless inherit
Steve Sakoman (1):
glibc: update to lastest 2.31 release HEAD
Tim Orling (1):
python3: upgrade 3.8.10 -> 3.8.11
Zoltán Böszörményi (1):
tzdata: Allow controlling zoneinfo binary format
meta/classes/report-error.bbclass | 2 -
meta/lib/oeqa/selftest/cases/oelib/utils.py | 3 +-
.../dhcp/dhcp/CVE-2021-25217.patch | 66 ++++
meta/recipes-connectivity/dhcp/dhcp_4.4.2.bb | 1 +
...ss_gunzip-Fix-DoS-if-gzip-is-corrupt.patch | 51 +++
meta/recipes-core/busybox/busybox_1.31.1.bb | 3 +-
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../update-rc.d/update-rc.d_0.8.bb | 2 +-
...tchart2_0.14.8.bb => bootchart2_0.14.9.bb} | 3 +-
.../dwarfsrcfiles/files/dwarfsrcfiles.c | 13 +-
.../recipes-devtools/python/python3_3.8.11.bb | 362 ++++++++++++++++++
meta/recipes-extended/timezone/tzdata.bb | 10 +-
...build-errors-due-to-WWc-11-narrowing.patch | 66 ++++
.../webkit/webkitgtk/CVE-2020-13753.patch | 15 -
...ebkitgtk_2.28.2.bb => webkitgtk_2.28.4.bb} | 5 +-
15 files changed, 571 insertions(+), 33 deletions(-)
create mode 100644 meta/recipes-connectivity/dhcp/dhcp/CVE-2021-25217.patch
create mode 100644 meta/recipes-core/busybox/busybox/0001-decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
rename meta/recipes-devtools/bootchart2/{bootchart2_0.14.8.bb => bootchart2_0.14.9.bb} (99%)
create mode 100644 meta/recipes-devtools/python/python3_3.8.11.bb
create mode 100644 meta/recipes-sato/webkit/webkitgtk/0001-clang-11-fix-build-errors-due-to-WWc-11-narrowing.patch
delete mode 100644 meta/recipes-sato/webkit/webkitgtk/CVE-2020-13753.patch
rename meta/recipes-sato/webkit/{webkitgtk_2.28.2.bb => webkitgtk_2.28.4.bb} (97%)
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2021-04-30 15:33 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2021-04-30 15:33 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2087
The following changes since commit 2cc9e06807026b86038db88c2175c626feadc0be:
linux-yocto/5.4: fix arm defconfig warnings (2021-04-22 06:23:22 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (2):
oeqa: tear down oeqa decorators if one of them raises an exception in
setup
meta/lib/oeqa/core/tests/cases/timeout.py: add a testcase for the
previous fix
Diego Sueiro (1):
oeqa/selftest/bblayers: Add test case for bitbake-layers
layerindex-show-depends
Khem Raj (1):
go: Use dl.google.com for SRC_URI
Konrad Weihmann (1):
cve-update-db-native: skip on empty cpe23Uri
Marek Vasut (1):
linux-firmware: Package RSI 911x WiFi firmware
Reto Schneider (2):
license_image.bbclass: Detect broken symlinks
license_image.bbclass: Fix symlink to generic license files
Richard Purdie (1):
yocto-check-layer: Avoid bug when iterating and autoadding
dependencies
Vinay Kumar (1):
Binutils: Fix CVE-2021-20197
Zhang Qiang (1):
kernel.bbclass: Configuration for environment with HOSTCXX
wangmy (1):
go: update SRC_URI to use https protocol
meta/classes/kernel.bbclass | 2 +
meta/classes/license_image.bbclass | 20 +-
meta/lib/oeqa/core/case.py | 9 +-
meta/lib/oeqa/core/decorator/oetimeout.py | 5 +-
meta/lib/oeqa/core/tests/cases/timeout.py | 13 +
meta/lib/oeqa/core/tests/test_decorators.py | 6 +
meta/lib/oeqa/selftest/cases/bblayers.py | 5 +
.../recipes-core/meta/cve-update-db-native.bb | 7 +-
.../binutils/binutils-2.34.inc | 1 +
.../binutils/binutils/CVE-2021-20197.patch | 572 ++++++++++++++++++
meta/recipes-devtools/go/go-common.inc | 2 +-
.../linux-firmware/linux-firmware_20210208.bb | 11 +
scripts/yocto-check-layer | 3 +
13 files changed, 646 insertions(+), 10 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2021-20197.patch
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2021-01-11 0:45 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2021-01-11 0:45 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/1739
The following changes since commit af4fbea9a1656bdf95d85831cae13cae3a60d5ee:
patch: fix CVE-2019-20633 (2021-01-04 04:50:23 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (1):
linux-yocto/5.4: update to v5.4.85
Daniel Ammann (1):
wic: fix typo
Mikko Rapeli (3):
glibc: update to 2.31 stable tree head
glib-2.0: add patch for CVE-2020-35457
systemd: update from 244.3 to 244.5 stable release
Milan Shah (1):
oe-pkgdata-util: Added a test to verify oe-pkgdata-util without
parameters
Ovidiu Panait (1):
timezone: upgrade to 2020f
Paul Barker (1):
selftest: Add argument to keep build dir
Richard Purdie (1):
gcc: Fix mangled patch
Ross Burton (2):
diffstat: point the license checksum at the license
ruby: remove tcl DEPENDS
Wang Mingyu (1):
mobile-broadband-provider-info: upgrade 20190618 ->20201225
meta/lib/oeqa/selftest/cases/pkgdata.py | 6 ++
meta/lib/oeqa/selftest/context.py | 17 +++-
.../mobile-broadband-provider-info_git.bb | 4 +-
...econdition-to-avoid-GOptionEntry-lis.patch | 41 ++++++++
meta/recipes-core/glib-2.0/glib-2.0_2.62.6.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
...md-boot_244.3.bb => systemd-boot_244.5.bb} | 0
meta/recipes-core/systemd/systemd.inc | 2 +-
.../systemd/systemd/CVE-2020-13776.patch | 96 -------------------
...temd-udev-seclabel-options-crash-fix.patch | 30 ------
.../{systemd_244.3.bb => systemd_244.5.bb} | 5 +-
.../diffstat/diffstat_1.63.bb | 4 +-
...gcc-Fix-argument-list-too-long-error.patch | 6 +-
meta/recipes-devtools/ruby/ruby.inc | 2 +-
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 ++---
.../wic/plugins/source/bootimg-partition.py | 2 +-
19 files changed, 97 insertions(+), 163 deletions(-)
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/0001-goption-Add-a-precondition-to-avoid-GOptionEntry-lis.patch
rename meta/recipes-core/systemd/{systemd-boot_244.3.bb => systemd-boot_244.5.bb} (100%)
delete mode 100644 meta/recipes-core/systemd/systemd/CVE-2020-13776.patch
delete mode 100644 meta/recipes-core/systemd/systemd/systemd-udev-seclabel-options-crash-fix.patch
rename meta/recipes-core/systemd/{systemd_244.3.bb => systemd_244.5.bb} (99%)
--
2.17.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2020-11-09 2:56 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2020-11-09 2:56 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back
by end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/1560
The following changes since commit 8d54034bb8e522f9827ec6422b32cbd4e5bf1346:
sqlite3: fix CVE-2020-13632 (2020-11-05 04:07:15 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
linux-firmware: upgrade 20200817 -> 20201022
Chee Yang Lee (1):
ruby: fix CVE-2020-25613
Khem Raj (1):
qemuboot.bbclass: Fix a typo
Max Krummenacher (2):
linux-firmware: package marvel sdio 8997 firmware
linux-firmware: package nvidia firmware
Maxime Roussin-Bélanger (1):
meta: fix some unresponsive homepages and bugtracker links
Mingli Yu (1):
update_udev_hwdb: clean hwdb.bin
Neil Armstrong (1):
linux-firmware: add Amlogic VDEC firmware package
Steve Sakoman (2):
netbase: update SRC_URI to reflect new file name
netbase: bump PE to purge bogus hash equivalence from autobuilder
Yongxin Liu (2):
grub: fix several CVEs in grub 2.04
grub: clean up CVE patches
meta/classes/qemuboot.bbclass | 2 +-
...308-calloc-Use-calloc-at-most-places.patch | 1863 +++++++++++++++++
...low-checking-primitives-where-we-do-.patch | 1330 ++++++++++++
...se-after-free-when-redefining-a-func.patch | 117 ++
...er-overflows-in-initrd-size-handling.patch | 177 ++
...-we-always-have-an-overflow-checking.patch | 246 +++
...dd-LVM-cache-logical-volume-handling.patch | 287 +++
...e-arithmetic-primitives-that-check-f.patch | 94 +
...used-fields-from-grub_script_functio.patch | 37 +
meta/recipes-bsp/grub/grub2.inc | 8 +
meta/recipes-bsp/v86d/v86d_0.1.10.bb | 2 +-
.../recipes-connectivity/bind/bind_9.11.22.bb | 2 +-
meta/recipes-connectivity/iw/iw_5.4.bb | 2 +-
meta/recipes-core/netbase/netbase_6.1.bb | 9 +-
meta/recipes-core/readline/readline.inc | 2 +-
meta/recipes-core/util-linux/util-linux.inc | 4 +-
meta/recipes-devtools/chrpath/chrpath_0.16.bb | 3 +-
meta/recipes-devtools/ninja/ninja_1.10.0.bb | 2 +-
.../ruby/ruby/CVE-2020-25613.patch | 40 +
meta/recipes-devtools/ruby/ruby_2.7.1.bb | 1 +
meta/recipes-extended/lsb/lsb-release_1.4.bb | 2 +-
.../recipes-extended/minicom/minicom_2.7.1.bb | 2 +-
meta/recipes-extended/pbzip2/pbzip2_1.1.13.bb | 2 +-
meta/recipes-extended/which/which_2.21.bb | 2 +-
meta/recipes-gnome/gnome/gconf_3.2.6.bb | 2 +-
meta/recipes-gnome/gtk-doc/gtk-doc_1.32.bb | 3 +-
meta/recipes-kernel/kmod/kmod.inc | 2 +-
...20200817.bb => linux-firmware_20201022.bb} | 51 +-
.../wireless-regdb_2020.04.29.bb | 2 +-
.../libvorbis/libvorbis_1.3.6.bb | 4 +-
.../settings-daemon/settings-daemon_0.0.2.bb | 2 +-
meta/recipes-support/atk/atk_2.34.1.bb | 5 +-
.../bash-completion/bash-completion_2.10.bb | 4 +-
meta/recipes-support/npth/npth_1.6.bb | 4 +-
scripts/postinst-intercepts/update_udev_hwdb | 1 +
35 files changed, 4279 insertions(+), 37 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14308-calloc-Use-calloc-at-most-places.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14309-CVE-2020-14310-CVE-2020-14311-malloc-Use-overflow-checking-primitives-where-we-do-.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch
create mode 100644 meta/recipes-bsp/grub/files/calloc-Make-sure-we-always-have-an-overflow-checking.patch
create mode 100644 meta/recipes-bsp/grub/files/lvm-Add-LVM-cache-logical-volume-handling.patch
create mode 100644 meta/recipes-bsp/grub/files/safemath-Add-some-arithmetic-primitives-that-check-f.patch
create mode 100644 meta/recipes-bsp/grub/files/script-Remove-unused-fields-from-grub_script_functio.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20200817.bb => linux-firmware_20201022.bb} (95%)
--
2.17.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2020-08-24 15:14 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2020-08-24 15:14 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back
by end of day Wednesday.
The following changes since commit 553a96644957ca6ad0f13b75a6e3a596357d1d52:
linux-yocto/5.4: update to v5.4.57 (2020-08-13 04:47:52 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Adrian Bunk (1):
librsvg: Upgrade 2.40.20 -> 2.40.21
Bruce Ashfield (2):
linux-yocto/5.4: update to v5.4.58
linux-yocto/5.4: perf cs-etm: Move definition of 'traceid_list' global
variable from header file
Changqing Li (1):
libffi: fix multilib header conflict
Chen Qi (1):
fribidi: extend CVE_PRODUCT to include fribidi
Lee Chee Yang (2):
ghostscript: update to 9.52
perl: fix CVE-2020-12723
Mikko Rapeli (2):
alsa-topology-conf: use ${datadir} in do_install()
alsa-ucm-conf: use ${datadir} in do_install()
Richard Purdie (1):
selftest/tinfoil: Increase wait event timeout
Vasyl Vavrychuk (1):
runqemu: Check gtk or sdl option is passed together with gl or gl-es
options.
Wang Mingyu (1):
xserver-xorg: upgrade 1.20.7 -> 1.20.8
meta/lib/oeqa/selftest/cases/tinfoil.py | 5 +-
.../perl/files/CVE-2020-12723.patch | 302 ++++++++++++++++++
meta/recipes-devtools/perl/perl_5.30.1.bb | 1 +
.../do-not-check-local-libpng-source.patch | 37 +--
.../ghostscript/CVE-2019-14869-0001.patch | 70 ----
.../ghostscript/ghostscript/aarch64/objarch.h | 40 ---
.../ghostscript/ghostscript/arm/objarch.h | 40 ---
.../ghostscript/ghostscript/armeb/objarch.h | 40 ---
.../ghostscript-9.02-genarch.patch | 38 ---
.../ghostscript/ghostscript/i586/objarch.h | 41 ---
.../ghostscript/ghostscript/i686 | 1 -
.../ghostscript/microblaze/objarch.h | 40 ---
.../ghostscript/microblazeel/objarch.h | 40 ---
.../ghostscript/mipsarchn32eb/objarch.h | 40 ---
.../ghostscript/mipsarchn32el/objarch.h | 40 ---
.../ghostscript/mipsarchn64eb/objarch.h | 40 ---
.../ghostscript/mipsarchn64el/objarch.h | 40 ---
.../ghostscript/mipsarcho32eb/objarch.h | 40 ---
.../ghostscript/mipsarcho32el/objarch.h | 40 ---
.../ghostscript/ghostscript/nios2/objarch.h | 40 ---
.../ghostscript/ghostscript/powerpc/objarch.h | 40 ---
.../ghostscript/powerpc64/objarch.h | 40 ---
.../ghostscript/powerpc64le/objarch.h | 40 ---
.../ghostscript/ghostscript/x86-64/objarch.h | 40 ---
...hostscript_9.50.bb => ghostscript_9.52.bb} | 27 +-
...{librsvg_2.40.20.bb => librsvg_2.40.21.bb} | 3 +-
...-xorg_1.20.7.bb => xserver-xorg_1.20.8.bb} | 4 +-
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
.../alsa/alsa-topology-conf_1.2.1.bb | 4 +-
.../alsa/alsa-ucm-conf_1.2.1.2.bb | 6 +-
meta/recipes-support/fribidi/fribidi_1.0.9.bb | 2 +-
meta/recipes-support/libffi/libffi_3.3.bb | 2 +-
scripts/runqemu | 3 +-
35 files changed, 361 insertions(+), 861 deletions(-)
create mode 100644 meta/recipes-devtools/perl/files/CVE-2020-12723.patch
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14869-0001.patch
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/aarch64/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/arm/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/armeb/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/ghostscript-9.02-genarch.patch
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/i586/objarch.h
delete mode 120000 meta/recipes-extended/ghostscript/ghostscript/i686
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/microblaze/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/microblazeel/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarchn32eb/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarchn32el/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarchn64eb/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarchn64el/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarcho32eb/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/mipsarcho32el/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/nios2/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/powerpc/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/powerpc64/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/powerpc64le/objarch.h
delete mode 100644 meta/recipes-extended/ghostscript/ghostscript/x86-64/objarch.h
rename meta/recipes-extended/ghostscript/{ghostscript_9.50.bb => ghostscript_9.52.bb} (87%)
rename meta/recipes-gnome/librsvg/{librsvg_2.40.20.bb => librsvg_2.40.21.bb} (92%)
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_1.20.7.bb => xserver-xorg_1.20.8.bb} (89%)
--
2.17.1
^ permalink raw reply [flat|nested] 24+ messages in thread* [OE-core][dunfell 00/12] Patch review
@ 2020-08-03 14:26 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2020-08-03 14:26 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back
by end of day Wednesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/1224
The following changes since commit 7ce425fa1295a9dca48f8474be58db3ac8aa540d:
glibc: Secruity fix for CVE-2020-6096 (2020-07-27 12:15:56 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
gnutls: upgrade 3.6.13 -> 3.6.14
Andrei Gherzan (2):
initscripts: Fix various shellcheck warnings in populate-volatile.sh
initscripts: Fix populate-volatile.sh bug when file/dir exists
Changqing Li (2):
layer.conf: fix adwaita-icon-theme signature change problem
gtk-icon-cache.bbclass: add features_check
Konrad Weihmann (1):
cve-update: handle baseMetricV2 as optional
Lee Chee Yang (1):
checklayer: check layer in BBLAYERS before test
Matt Madison (1):
cogl-1.0: correct X11 dependencies
Steve Sakoman (1):
glib-networking: upgrade 2.62.3 to 2.62.4
Viktor Rosendahl (1):
boost: backport fix to make async_pipes work with asio
Yi Zhao (1):
bind: upgrade 9.11.19 -> 9.11.21
zhengruoqin (1):
gnutls: Fix krb5 code license to GPLv2.1+ to match the LICENSE file.
meta/classes/gtk-icon-cache.bbclass | 5 ++
meta/conf/layer.conf | 2 +
.../bind/{bind_9.11.19.bb => bind_9.11.21.bb} | 2 +-
...ng_2.62.3.bb => glib-networking_2.62.4.bb} | 4 +-
.../initscripts-1.0/populate-volatile.sh | 80 ++++++++---------
.../recipes-core/meta/cve-update-db-native.bb | 13 ++-
meta/recipes-graphics/cogl/cogl-1.0.inc | 2 +-
.../0001-added-typedef-executor_type.patch | 54 +++++++++++
meta/recipes-support/boost/boost_1.72.0.bb | 1 +
...se-to-GPLv2.1-to-keep-with-LICENSE-f.patch | 90 +++++++++++++++++++
.../{gnutls_3.6.13.bb => gnutls_3.6.14.bb} | 4 +-
scripts/lib/checklayer/__init__.py | 14 +++
scripts/yocto-check-layer | 9 +-
13 files changed, 229 insertions(+), 51 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.11.19.bb => bind_9.11.21.bb} (98%)
rename meta/recipes-core/glib-networking/{glib-networking_2.62.3.bb => glib-networking_2.62.4.bb} (88%)
create mode 100644 meta/recipes-support/boost/boost/0001-added-typedef-executor_type.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/0001-Modied-the-license-to-GPLv2.1-to-keep-with-LICENSE-f.patch
rename meta/recipes-support/gnutls/{gnutls_3.6.13.bb => gnutls_3.6.14.bb} (92%)
--
2.17.1
^ permalink raw reply [flat|nested] 24+ messages in threadend of thread, other threads:[~2024-03-20 16:44 UTC | newest] Thread overview: 24+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2022-01-09 22:04 [OE-core][dunfell 00/12] Patch review Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 02/12] linux-firmware: upgrade 20211027 -> 20211216 Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 03/12] libpcre2: update SRC_URI Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 04/12] openssl: Add reproducibility fix Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 05/12] oeqa/selftest/bbtests: Use YP sources mirror instead of GNU Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 06/12] oeqa/selftest/tinfoil: Update to use test command Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 07/12] weston: Backport patches to always activate the top-level surface Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 08/12] scripts/buildhistory-diff: drop use of distutils Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 09/12] selftest: skip virgl test on fedora 35 Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 10/12] scripts: Update to use exec_module() instead of load_module() Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 11/12] lib/oe/reproducible: correctly set .git location when recursively looking for git repos Steve Sakoman 2022-01-09 22:04 ` [OE-core][dunfell 12/12] asciidoc: properly detect and compare Python versions >= 3.10 Steve Sakoman -- strict thread matches above, loose matches on Subject: below -- 2024-03-20 16:43 [OE-core][dunfell 00/12] Patch review Steve Sakoman 2023-02-04 21:48 Steve Sakoman 2022-06-30 16:23 Steve Sakoman 2022-06-19 19:34 Steve Sakoman 2021-08-19 19:07 Steve Sakoman 2021-07-12 15:31 Steve Sakoman 2021-04-30 15:33 Steve Sakoman 2021-01-11 0:45 Steve Sakoman 2020-11-09 2:56 Steve Sakoman 2020-08-24 15:14 Steve Sakoman 2020-08-03 14:26 Steve Sakoman
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox