poky: subtree update:c8075ed8f1..7d0988966c
Adrian (1):
weston-init: Set $HOME variable for SysVinit manager
Alejandro Hernandez Samaniego (6):
bitbake: bitbake: Add Azure Storage fetcher implementation
bitbake: docs: Add Az fetcher documentation
bitbake: docs: Add AZ_SAS definition to glossary
ref-manual: Add Az fetcher documentation
sanity.bbclass: Add az fetcher to accepted URI protocols for mirrors sanity
devtool: Fix do_kernel_configme task
Alexander Kanavin (23):
core-image.bbclass: add a weston IMAGE_FEATURE, similar to x11-base
rootfs-postcommands: correctly set systemd target for weston images
oeqa/weston: correctly run wayland-info when systemd is in use
dnf: upgrade 4.5.2 -> 4.6.0
libdnf: update 0.55.2 -> 0.58.0
libdnf: replace a musl fix with a better one
librepo: update 1.12.1 -> 1.13.0
libical: update 3.0.8 -> 3.0.9
libical: drop the ad hoc native generator build
bmap-tools: upgrade 3.5 -> 3.6
procps: update 3.3.16 -> 3.3.17
libxcrypt: fix sporadic failures in nativesdk-libxcrypt-compat
bind: upgrade 9.16.11 -> 9.16.12
spirv-headers: update to latest revision
spirv-tools: upgrade 2020.6 -> 2020.7
mesa: update 20.3.4 -> 21.0.0
attr: update 2.4.48 -> 2.5.1
asciidoc: update 9.0.4 -> 9.1.0
libhandy: update 1.0.3 -> 1.2.0
strace: update 5.10 -> 5.11
automake: update 1.16.2 - > 1.16.3
xxhash: import from meta-oe
apt: update 1.8.2.2 -> 2.2.2
Alistair Francis (4):
openssl: Enable building for RISC-V 32-bit
linux-yocto: Add qemuriscv32 as a compatible machine
machine: Initial commit of qemuriscv32
u-boot: Add support for building for qemuriscv32
Andrei Gherzan (3):
gcr: Add support for building without x11
epiphany: Add package configuration for building in developer mode
glibc: Backport patch to fix _SC_LEVEL1_ICACHE_LINESIZE
Anton D. Kachalov (1):
run-postinsts: do not remove postinsts directory.
Awais Belal (2):
libsdl2: disable shared memory for native builds
rootfs.py: uninstall the run-postinsts package if not needed
Bartosz Golaszewski (1):
python3: make pydoc rdepend on python3-io
Bruce Ashfield (27):
linux-yocto/5.10: fix x86 32bit boot warnings
linux-yocto/5.10: fix qemumips testimage failures
linux-yocto/5.10: update to v5.10.17 and -rt31
linux-yocto/5.4: update to v5.4.99
linux-yocto/5.10: update to v5.10.19
linux-yocto/5.4: update to v5.4.101
perf: fix reproducibility issues
linux-yocto/5.4: update to v5.4.103
kern-tools: symbol-why fix and README update
linux-yocto/5.10: update to v5.10.21
linux-yocto/qemuarmv5: fix configuration warning
yocto-bsp: update reference platforms to latest 5.10
perf: reproducibility fixes for pmu-events.c
reproducibile: remove perf from exclusions
linux-yocto/5.10: fix SERIAL_OF_PLATFORM warning
linux-yocto/5.4: update to v5.4.105
linux-yocto/5.10: update to v5.10.23
linux-yocto/5.10: cfg: features/numa: Remove NODES_SPAN_OTHER_NODES option
lttng-modules: update devupstream to 2.12.5+
lttng-modules: backport patches to fix build against 5.12+ kernel
kernel-devsrc: fix on-target scripts/prepare for v5.12+
linux-yocto/5.10: cfg: fix ppc64 configuration warnings
linux-yocto-dev: bump to v5.12-rc
linux-yocto/5.10: update qemuriscv32 v5.10.23
linux-yocto/5.10: update to v5.10.25
linux-yocto/5.4: update to v5.4.107
linux-yocto-rt/5.10: update to -rt34
Changqing Li (1):
go-helloworld: disable module-aware mode
Charlie Davies (9):
bitbake-bblayers/create: Fix incorrect priority help message
bitbake-bblayers/create: Add optional layerid argument
bitbake: bitbake: providers: remove unneeded logging call
bitbake: bitbake: providers: consistent single line formatting between functions
bitbake: bitbake: providers: introduce logic for REQUIRED_VERSION variable
bitbake: bitbake: providers: check for REQUIRED_VERSION in _filterProviders
bitbake: bitbake: lib: add Required Version to Bitbake --show-versions command
bitbake: bitbake: cooker: Add REQUIRED_VERSION checks
multilib_global: handle REQUIRED_VERSION
Chen Qi (3):
python3-jinja2: set CVE_PRODUCT
bitbake: event.py: fix regression about INVALIDCONF
populate_sdk_ext: record METADATA_REVISION
Christopher Larson (2):
buildhistory: add missing vardepsexcludes
image,populate_sdk_base: move 'func' flag setting for sdk command vars
Diego Santa Cruz (2):
rpm: split build and extra functionality into separate packages
sstate-diff-machines.sh: support rpm, deb and tar package types in analysis
Dorinda (8):
meta/recipes-rt: Add HOMEPAGE / DESCRIPTION
meta-skeleton: Add HOMEPAGE / DESCRIPTION
meta/recipes-extended: Add HOMEPAGE / DESCRIPTION
meta/recipes-support: Add HOMEPAGE / DESCRIPTION
meta/recipes-kernel: Add HOMEPAGE / DESCRIPTION
meta/recipes-multimedia: Add HOMEPAGE / DESCRIPTION
meta/recipes-graphics: Add HOMEPAGE / DESCRIPTION
dev-manual/common-task.rst: Added documentation for debuginfod support
Dorinda Bassey (4):
meta/recipes-devtools: Add HOMEPAGE / DESCRIPTION
distrodata.py: Test to track recipes without HOMEPAGE or DESCRIPTION
meta-selftest: Add HOMEPAGE / DESCRIPTION
devshell.bbclass: Exceptions displayed within devpyshell
Douglas Royds (2):
cmake: Fully-qualified path to ar
externalsrc: Detect code changes in submodules
Jon Mason (5):
runqemu: use "raw" instead of "bin" for ovmf
runqemu: add QB_GRAPHICS
runqemu: correct forcing of ttyS0
runqemu: modify novga to conform to documentation
tune-cortexa32: Add hard FPU
Jose Quaresma (4):
spirv-tools: python3 is need not only for the tests
spirv-tools: cleanup an old patch that is not used anymore
gstreamer1.0: upgrade 1.18.3 -> 1.18.4
gstreamer1.0-plugins-good: fix rtpjitterbuffer regression
Kai Kang (2):
toolchain-scripts.bbclass: customize prompt string for SDKs
local.conf.sample.extended: sample value for SDK_PS1
Kevin Hao (1):
meta-yocto-bsp: beaglebone: Set a fixed size for boot partition in WIC image
Khairul Rohaizzat Jamaluddin (1):
glibc: Fix CVE-2021-27645
Khem Raj (33):
python3-cython: Check for files before editing
webkitgtk: Use linker options to reduce memory overhead during linking
webkitgtk: Enhance check for atomics to include 1 byte CAS
qemuppc64: Add a QEMU machine definition for ppc64
linux-yocto: Enable powerpc64le QEMU
formfactor: Add machine config for qemuppc64
inittab: Add getty launch on hvc0 for qemuppc64
parselogs: Allow expected kernel messages for qemuppc64
spirv-tools: Replace strncpy with memcpy
python3-setuptools: Upgrade 54.1.0 -> 54.1.1
perf: Remove libunwind for rv32
Enable qemu usermode on ppc64
cmake.bbclass: Create cmake arch mapping for ppc64le
libucontext: Recognize ppc64le architecture
libunwind: Do not assume libdir for ppc64
gcc: Package new module mapper tool
glib-2.0: Drop volatile qualifier
go: Update to 1.16.2
go-dep: Remove
libunwind: Link with libucontext on musl
libedit: upgrade 20191231-3.1 -> 20210216-3.1
webkitgtk: Reduce stack and heap sizes for jsc on musl
webkitgtk: Add packageconfig to chose between size and speed
webkitgtk: enable strlen and stpcpy on musl/linux too
gcc-sanitizers: Package up hwasan files
apt: Support old resolver as fallback
apt: Do not disable NLS
valgrind: Fix ptests on ppc64 LE
documentation-audit.sh: Fix typo in specifying LICENSE_FLAGS_WHITELIST
image-uefi: Set efi_file for rv32/rv64
grub2: Disable for RISCV32
grub-efi: Re-introduce lost cast to long
grub2: Enable on riscv32
Lee Chee Yang (2):
cve-update-db-native: consider version suffix when update CVE db
cve-check: CVE_VERSION_SUFFIX to work with patched release
Li Wang (1):
linux-dummy: add empty dependent packages
Luca Boccassi (2):
util-linux: split uuid in separate recipe to allow bootstrapping
util-linux: backport patch to skip build of unused objects
Manuel Leonhardt (1):
bitbake: tinfoil: Honor quiet when parsing recipes
Mark Hatle (2):
populate_sdk_ext: Avoid copying and producing .pyc files
populate_sdk_ext: Add support for PR service
Martin Jansa (7):
glib-2.0: call os.path.normpath on THISDIR
glib-2.0: show an error about --cross-file only when such file exists
busybox: refresh the defconfig from 1.33.0
busybox-inittab: rename for PV to match with busybox's PV
iso-codes: fix protocol in SRC_URI
packagegroup-core-weston.bb: add pam to REQUIRED_DISTRO_FEATURES
python3: fix PACKAGECONFIG handling
Michael Opdenacker (4):
bitbake: doc: Update links to documentation
Do not assume working from $HOME
Update documentation URL
documentation/README minor improvements
Michael Trensch (1):
linux-firmware: Fix packaging
Mikko Rapeli (1):
openssl: update to 1.1.1k to fix CVE-2021-3450 and CVE-2021-3449
Ming Liu (2):
kernel-fitimage.bbclass: support both KERNEL_DEVICETREE/EXTERNAL_KERNEL_DEVICETREE
initramfs-framework:rootfs: fix some conditional check
Mingli Yu (1):
libtool: make sure autoheader run before autoconf
Minjae Kim (3):
qemu: fix CVE-2021-20203
git: fix CVE-2021-21300
git: upgrade 2.30.1 -> 2.31.1
Naveen Saini (1):
grub: upgrade 2.04 -> 2.06~rc1
Oleksandr Kravchuk (1):
python3-setuptools: update to 54.1.0
Paul Gortmaker (1):
bitbake: gitignore: ignore runqueue-tests/bitbake-cookerdaemon.log
Peter Kjellerstedt (4):
meson: Correctly set uid/gid of installed files
uninative-tarball: Add a dependency on nativesdk-glibc-dbg
metadata_scm.bbclass: Use immediate expansion for the METADATA_* variables
license.bbclass: Improve parsing time when INCOMPATIBLE_LICENSES is big
Petr Vorel (1):
scripts/verify-bashisms: Update checkbashisms.pl URL
Purushottam Choudhary (1):
shadow: whitelist CVE-2013-4235
Randy MacLeod (2):
ffmpeg: upgrade 4.3.1 -> 4.3.2
zstd: upgrade 1.4.8 -> 1.4.9
Richard Purdie (33):
ltp: Fix another determinism issue
build-appliance-image: Drop kernel module handling
ltp: Further extend reproducibility patch
bitbake: runqueue: Fix task execution corruption issue
bitbake: runqueue: Add setscene task overlap sanity check
bitbake: __init__.py: Fix bitbake debug log handling
ltp: Fix determinism issue
ltp: Fix libswapon issue properly
bitbake: event: Fix multiconfig event handler change performance regressions
bitbake: event: Fix another 'if d' test to test for None explictly
bitbake: tests/color: Fix event register to pass the datastore
bitbake: bblayers/query: Update to handle REQUIRED_VERSION
scripts/contrib/list-packageconfig-flags: Upate for tinfoil API changes
layer.conf: Update for hardknott release series
layer.conf: Update for hardknott release series
build-appliance-image: Update to master head revision
layer.conf: Add gatesgarth back for now to allow for transition
build-appliance-image: Update to master head revision
meson: Work around determinism issue
lttng-tools: upgrade 2.12.2 -> 2.12.3
lttng-modules: upgrade 2.12.4 -> 2.12.5
sqlite3: upgrade 3.34.1 -> 3.35.0
sudo: upgrade 1.9.5p2 -> 1.9.6
selftest/reproducible: Drop ovmf exclusion
selftest/wic: Fix dependency issue in rawcopy test
layer.conf: Drop gatesgarth from the layer series names
bitbake: build: Add find_stale_stamps function
bitbake: runqueue/event: Add an event for notifying of stale setscene tasks
sstate: Remove stale objects before the main build
sstate: Add documentation for eventhandlers and tweak naming
site/elfutils/libunistring: Drop patching for iconv and set in site file
build-appliance-image: Update to master head revision
util-linux-libuuid: Simplify recipe and rename from util-linux-uuid
Robert P. J. Day (8):
bitbake-whatchanged: change ending quote to proper period
bitbake: doc: move BBFILES_DYNAMIC for alphabetical order
ref-manual: remove erroneous '\*' from variables list
bitbake: doc: mention that addtask handles multiple dependencies
bitbake: doc: fix glossary link for BB_INVALIDCONF variable
bitbake: doc: fix syntax error in layer.conf example
bitbake.conf: correct description of HOSTTOOLS_DIR
packagegroups: delete useless "PROVIDES" lines
Robert Yang (1):
image.bbclass: deltask do_packagedata
Ross Burton (13):
libinput: less parallism to increase chances the test suite works
ptest-packagelists: remove libinput-ptest
insane: don't check for a warning string that is never output
gcc: add an option for --enable-poison-system-directories to be fatal
gcc-cross: make use of the system include directories fatal
oeqa/selftest: add test to verify that poisoned sysroots are detected
ovmf: make output binaries reproducible
base: respect downloadfilename when sniffing the SRC_URI for dependencies
lib/oe/utils: add directory size function
classes/image: use oe.utils.directory_size() instead of du
bitbake.conf: ensure BUILD_* tools match target tools
meson: fix native/host confusion in gobject-introspection
meson: use native-file instead of environment variables
Sakib Sajal (2):
buildstats.bbclass: improve timeout handling
scripts: add oe-time-dd-test.sh
Scott Murray (1):
u-boot: Fix CVE-2021-27097, CVE-2021-27138
Stefan Ghinea (1):
wpa-supplicant: fix CVE-2021-27803
Stefan Schmidt (1):
systemd-conf: do not ask for DHCP if configured on kernel command line
Tomasz Dziendzielski (2):
bitbake: runqueue: Print pseudo.log if fakeroot task failed
bitbake: codeparser: Fix TypeError in bitbake debug mode
Ulrich ?lmann (1):
gstreamer1.0: add support for coretracers
Ulrich Ölmann (3):
common-tasks.rst: fix 'wic cp' command
common-tasks.rst: fix typo
local.conf.sample: fix typo
Vivien Didelot (6):
systemd-container: sort RRECOMMENDS alphabetically
systemd-container: recommend tar
systemd-container: recommends StartExecPre modules
poky: fix typos
poky: don't use space with +=
beaglebone-yocto: allow other virtual/bootloader
Wang Mingyu (20):
shaderc: upgrade 2020.4 -> 2020.5
stress-ng: upgrade 0.12.03 -> 0.12.04
taglib: upgrade 1.11.1 -> 1.12
vala: upgrade 0.50.3 -> 0.50.4
python3-pygments: upgrade 2.8.0 -> 2.8.1
python3-zipp: upgrade 3.4.0 -> 3.4.1
sysklogd: upgrade 2.2.1 -> 2.2.2
help2man: upgrade 1.48.1 -> 1.48.2
iso-codes: upgrade 4.5.0 -> 4.6.0
jquery: upgrade 3.5.1 -> 3.6.0
ovmf: upgrade 202011 -> 202102
msmtp: upgrade 1.8.14 -> 1.8.15
gptfdisk: upgrade 1.0.6 -> 1.0.7
vulkan-headers: upgrade 1.2.162.0 -> 1.2.170.0
vulkan-loader: upgrade 1.2.162.0 -> 1.2.170.0
vulkan-tools: upgrade 1.2.162.1 -> 1.2.170.0
gcc: Update patch to only patch files once
openssh: upgrade 8.4p1 -> 8.5p1
openssh: Improve LICENSE to show BSD license variants.
gnutls: upgrade 3.7.0 -> 3.7.1
Yanfei Xu (1):
glibc: fix pthread_cond_destroy hangs with process-shared mutex
Yann Dirson (1):
ffmpeg: disable GPL features by default
Yi Fan Yu (1):
valgrind: Fix nlcontrolc.vgtest
jan (1):
cve-update-db-native: Allow to overrule the URL in a bbappend.
wangmy@fujitsu.com (1):
systemd: upgrade 247.3 -> 247.4
zhengruoqin (3):
sudo: upgrade 1.9.6 -> 1.9.6p1
liburi-perl: upgrade 1.74 -> 5.08
stress-ng: upgrade 0.12.04 -> 0.12.05
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I04195d4c610ca1674dd736eceeb6442d974cb711
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch
new file mode 100644
index 0000000..946196c
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch
@@ -0,0 +1,109 @@
+From 3f04db891a353f4b127ed57279279f851c6b4917 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:12 -0700
+Subject: [PATCH] image: Check for unit addresses in FITs
+
+Using unit addresses in a FIT is a security risk. Add a check for this
+and disallow it.
+
+CVE-2021-27138
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27138
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/3f04db891a353f4b127ed57279279f851c6b4917]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/image-fit.c | 56 +++++++++++++++++++++++++++++++++++++++++----
+ test/py/tests/test_vboot.py | 9 ++++----
+ 2 files changed, 57 insertions(+), 8 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index bcf395f6a1..28b3d2b191 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1568,6 +1568,34 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp)
+ return (comp == image_comp);
+ }
+
++/**
++ * fdt_check_no_at() - Check for nodes whose names contain '@'
++ *
++ * This checks the parent node and all subnodes recursively
++ *
++ * @fit: FIT to check
++ * @parent: Parent node to check
++ * @return 0 if OK, -EADDRNOTAVAIL is a node has a name containing '@'
++ */
++static int fdt_check_no_at(const void *fit, int parent)
++{
++ const char *name;
++ int node;
++ int ret;
++
++ name = fdt_get_name(fit, parent, NULL);
++ if (!name || strchr(name, '@'))
++ return -EADDRNOTAVAIL;
++
++ fdt_for_each_subnode(node, fit, parent) {
++ ret = fdt_check_no_at(fit, node);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
+ int fit_check_format(const void *fit, ulong size)
+ {
+ int ret;
+@@ -1589,10 +1617,27 @@ int fit_check_format(const void *fit, ulong size)
+ if (size == IMAGE_SIZE_INVAL)
+ size = fdt_totalsize(fit);
+ ret = fdt_check_full(fit, size);
++ if (ret)
++ ret = -EINVAL;
++
++ /*
++ * U-Boot stopped using unit addressed in 2017. Since libfdt
++ * can match nodes ignoring any unit address, signature
++ * verification can see the wrong node if one is inserted with
++ * the same name as a valid node but with a unit address
++ * attached. Protect against this by disallowing unit addresses.
++ */
++ if (!ret && CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
++ ret = fdt_check_no_at(fit, 0);
+
++ if (ret) {
++ log_debug("FIT check error %d\n", ret);
++ return ret;
++ }
++ }
+ if (ret) {
+ log_debug("FIT check error %d\n", ret);
+- return -EINVAL;
++ return ret;
+ }
+ }
+
+@@ -1955,10 +2000,13 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
+ printf("## Loading %s from FIT Image at %08lx ...\n", prop_name, addr);
+
+ bootstage_mark(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+- if (fit_check_format(fit, IMAGE_SIZE_INVAL)) {
+- printf("Bad FIT %s image format!\n", prop_name);
++ ret = fit_check_format(fit, IMAGE_SIZE_INVAL);
++ if (ret) {
++ printf("Bad FIT %s image format! (err=%d)\n", prop_name, ret);
++ if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && ret == -EADDRNOTAVAIL)
++ printf("Signature checking prevents use of unit addresses (@) in nodes\n");
+ bootstage_error(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+- return -ENOEXEC;
++ return ret;
+ }
+ bootstage_mark(bootstage_id + BOOTSTAGE_SUB_FORMAT_OK);
+ if (fit_uname) {