summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r--meta/recipes-devtools/qemu/qemu-native.inc1
-rw-r--r--meta/recipes-devtools/qemu/qemu-native_5.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu-native_4.2.0.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu-system-native_5.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb)0
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc23
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-Add-enable-disable-udev.patch13
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-qemu-Add-missing-wacom-HID-descriptor.patch7
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-qemu-Do-not-include-file-if-not-exists.patch15
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-Add-subpackage-ptest-which-runs-all-unit-test-cases-.patch15
-rw-r--r--meta/recipes-devtools/qemu/qemu/0005-qemu-native-set-ld.bfd-fix-cflags-and-set-some-envir.patch15
-rw-r--r--meta/recipes-devtools/qemu/qemu/0009-Fix-webkitgtk-builds.patch41
-rw-r--r--meta/recipes-devtools/qemu/qemu/0011-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch54
-rw-r--r--meta/recipes-devtools/qemu/qemu/0012-fix-libcap-header-issue-on-some-distro.patch86
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2019-15890.patch48
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch148
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch97
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-1711.patch64
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-7039-1.patch44
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-7039-2.patch59
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-7039-3.patch64
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2020-7211.patch46
-rw-r--r--meta/recipes-devtools/qemu/qemu/find_datadir.patch37
-rw-r--r--meta/recipes-devtools/qemu/qemu_5.0.0.bb (renamed from meta/recipes-devtools/qemu/qemu_4.2.0.bb)0
22 files changed, 113 insertions, 764 deletions
diff --git a/meta/recipes-devtools/qemu/qemu-native.inc b/meta/recipes-devtools/qemu/qemu-native.inc
index 28cfd2cca3..dcf140ea1b 100644
--- a/meta/recipes-devtools/qemu/qemu-native.inc
+++ b/meta/recipes-devtools/qemu/qemu-native.inc
@@ -3,7 +3,6 @@ inherit native
3require qemu.inc 3require qemu.inc
4 4
5SRC_URI_append = " \ 5SRC_URI_append = " \
6 file://0012-fix-libcap-header-issue-on-some-distro.patch \
7 file://0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch \ 6 file://0013-cpus.c-Add-error-messages-when-qemi_cpu_kick_thread-.patch \
8 " 7 "
9 8
diff --git a/meta/recipes-devtools/qemu/qemu-native_4.2.0.bb b/meta/recipes-devtools/qemu/qemu-native_5.0.0.bb
index c8acff8e19..c8acff8e19 100644
--- a/meta/recipes-devtools/qemu/qemu-native_4.2.0.bb
+++ b/meta/recipes-devtools/qemu/qemu-native_5.0.0.bb
diff --git a/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb b/meta/recipes-devtools/qemu/qemu-system-native_5.0.0.bb
index 7394385d30..7394385d30 100644
--- a/meta/recipes-devtools/qemu/qemu-system-native_4.2.0.bb
+++ b/meta/recipes-devtools/qemu/qemu-system-native_5.0.0.bb
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index 3e5006937b..8b6157e69d 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -27,23 +27,15 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
27 file://0008-linux-user-Fix-webkitgtk-hangs-on-32-bit-x86-target.patch \ 27 file://0008-linux-user-Fix-webkitgtk-hangs-on-32-bit-x86-target.patch \
28 file://0009-Fix-webkitgtk-builds.patch \ 28 file://0009-Fix-webkitgtk-builds.patch \
29 file://0010-configure-Add-pkg-config-handling-for-libgcrypt.patch \ 29 file://0010-configure-Add-pkg-config-handling-for-libgcrypt.patch \
30 file://0011-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch \
31 file://CVE-2019-15890.patch \
32 file://CVE-2020-1711.patch \
33 file://CVE-2020-7039-1.patch \
34 file://CVE-2020-7039-2.patch \
35 file://CVE-2020-7039-3.patch \
36 file://0001-Add-enable-disable-udev.patch \ 30 file://0001-Add-enable-disable-udev.patch \
37 file://CVE-2020-7211.patch \
38 file://0001-qemu-Do-not-include-file-if-not-exists.patch \ 31 file://0001-qemu-Do-not-include-file-if-not-exists.patch \
39 file://CVE-2020-11102.patch \
40 file://CVE-2020-11869.patch \
41 file://CVE-2020-13361.patch \ 32 file://CVE-2020-13361.patch \
33 file://find_datadir.patch \
42 " 34 "
43UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar" 35UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"
44 36
45SRC_URI[md5sum] = "278eeb294e4b497e79af7a57e660cb9a" 37SRC_URI[md5sum] = "ede6005d7143fe994dd089d31dc2cf6c"
46SRC_URI[sha256sum] = "d3481d4108ce211a053ef15be69af1bdd9dde1510fda80d92be0f6c3e98768f0" 38SRC_URI[sha256sum] = "2f13a92a0fa5c8b69ff0796b59b86b080bbb92ebad5d301a7724dd06b5e78cb6"
47 39
48COMPATIBLE_HOST_mipsarchn32 = "null" 40COMPATIBLE_HOST_mipsarchn32 = "null"
49COMPATIBLE_HOST_mipsarchn64 = "null" 41COMPATIBLE_HOST_mipsarchn64 = "null"
@@ -87,6 +79,7 @@ EXTRA_OECONF = " \
87 --disable-strip \ 79 --disable-strip \
88 --disable-werror \ 80 --disable-werror \
89 --extra-cflags='${CFLAGS}' \ 81 --extra-cflags='${CFLAGS}' \
82 --extra-ldflags='${LDFLAGS}' \
90 --with-git=/bin/false \ 83 --with-git=/bin/false \
91 --disable-git-update \ 84 --disable-git-update \
92 ${PACKAGECONFIG_CONFARGS} \ 85 ${PACKAGECONFIG_CONFARGS} \
@@ -170,7 +163,6 @@ PACKAGECONFIG[lzo] = "--enable-lzo,--disable-lzo,lzo"
170PACKAGECONFIG[numa] = "--enable-numa,--disable-numa,numactl" 163PACKAGECONFIG[numa] = "--enable-numa,--disable-numa,numactl"
171PACKAGECONFIG[gnutls] = "--enable-gnutls,--disable-gnutls,gnutls" 164PACKAGECONFIG[gnutls] = "--enable-gnutls,--disable-gnutls,gnutls"
172PACKAGECONFIG[bzip2] = "--enable-bzip2,--disable-bzip2,bzip2" 165PACKAGECONFIG[bzip2] = "--enable-bzip2,--disable-bzip2,bzip2"
173PACKAGECONFIG[bluez] = "--enable-bluez,--disable-bluez,bluez5"
174PACKAGECONFIG[libiscsi] = "--enable-libiscsi,--disable-libiscsi" 166PACKAGECONFIG[libiscsi] = "--enable-libiscsi,--disable-libiscsi"
175PACKAGECONFIG[kvm] = "--enable-kvm,--disable-kvm" 167PACKAGECONFIG[kvm] = "--enable-kvm,--disable-kvm"
176PACKAGECONFIG[virglrenderer] = "--enable-virglrenderer,--disable-virglrenderer,virglrenderer" 168PACKAGECONFIG[virglrenderer] = "--enable-virglrenderer,--disable-virglrenderer,virglrenderer"
@@ -179,10 +171,15 @@ PACKAGECONFIG[spice] = "--enable-spice,--disable-spice,spice"
179# usbredir will be in meta-networking layer 171# usbredir will be in meta-networking layer
180PACKAGECONFIG[usb-redir] = "--enable-usb-redir,--disable-usb-redir,usbredir" 172PACKAGECONFIG[usb-redir] = "--enable-usb-redir,--disable-usb-redir,usbredir"
181PACKAGECONFIG[snappy] = "--enable-snappy,--disable-snappy,snappy" 173PACKAGECONFIG[snappy] = "--enable-snappy,--disable-snappy,snappy"
182PACKAGECONFIG[glusterfs] = "--enable-glusterfs,--disable-glusterfs" 174PACKAGECONFIG[glusterfs] = "--enable-glusterfs,--disable-glusterfs,glusterfs"
183PACKAGECONFIG[xkbcommon] = "--enable-xkbcommon,--disable-xkbcommon,libxkbcommon" 175PACKAGECONFIG[xkbcommon] = "--enable-xkbcommon,--disable-xkbcommon,libxkbcommon"
184PACKAGECONFIG[libudev] = "--enable-libudev,--disable-libudev,eudev" 176PACKAGECONFIG[libudev] = "--enable-libudev,--disable-libudev,eudev"
185PACKAGECONFIG[libxml2] = "--enable-libxml2,--disable-libxml2,libxml2" 177PACKAGECONFIG[libxml2] = "--enable-libxml2,--disable-libxml2,libxml2"
178PACKAGECONFIG[attr] = "--enable-attr,--disable-attr,attr,"
179PACKAGECONFIG[rbd] = "--enable-rbd,--disable-rbd,ceph,ceph"
180PACKAGECONFIG[vhost] = "--enable-vhost-net,--disable-vhost-net,,"
181PACKAGECONFIG[ust] = "--enable-trace-backend=ust,--enable-trace-backend=nop,lttng-ust,"
182PACKAGECONFIG[pie] = "--enable-pie,--disable-pie,,"
186 183
187INSANE_SKIP_${PN} = "arch" 184INSANE_SKIP_${PN} = "arch"
188 185
diff --git a/meta/recipes-devtools/qemu/qemu/0001-Add-enable-disable-udev.patch b/meta/recipes-devtools/qemu/qemu/0001-Add-enable-disable-udev.patch
index c2c5849d65..40d83fcfa3 100644
--- a/meta/recipes-devtools/qemu/qemu/0001-Add-enable-disable-udev.patch
+++ b/meta/recipes-devtools/qemu/qemu/0001-Add-enable-disable-udev.patch
@@ -1,21 +1,24 @@
1From a471cf4e4c73350e090eb2cd87ec959d138012e5 Mon Sep 17 00:00:00 2001 1From b921e5204030845dc7c9d16d5f66d965e8d05367 Mon Sep 17 00:00:00 2001
2From: Jeremy Puhlman <jpuhlman@mvista.com> 2From: Jeremy Puhlman <jpuhlman@mvista.com>
3Date: Thu, 19 Mar 2020 11:54:26 -0700 3Date: Thu, 19 Mar 2020 11:54:26 -0700
4Subject: [PATCH] Add enable/disable libudev 4Subject: [PATCH] Add enable/disable libudev
5 5
6Upstream-Status: Pending 6Upstream-Status: Pending
7Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com> 7Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
8
9[update patch context]
10Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
8--- 11---
9 configure | 4 ++++ 12 configure | 4 ++++
10 1 file changed, 4 insertions(+) 13 1 file changed, 4 insertions(+)
11 14
12diff --git a/configure b/configure 15diff --git a/configure b/configure
13index cac271c..bd116eb 100755 16index 36646e7b..48912a94 100755
14--- a/configure 17--- a/configure
15+++ b/configure 18+++ b/configure
16@@ -1539,6 +1539,10 @@ for opt do 19@@ -1601,6 +1601,10 @@ for opt do
17 ;; 20 ;;
18 --disable-plugins) plugins="no" 21 --gdb=*) gdb_bin="$optarg"
19 ;; 22 ;;
20+ --enable-libudev) libudev="yes" 23+ --enable-libudev) libudev="yes"
21+ ;; 24+ ;;
@@ -25,5 +28,5 @@ index cac271c..bd116eb 100755
25 echo "ERROR: unknown option $opt" 28 echo "ERROR: unknown option $opt"
26 echo "Try '$0 --help' for more information" 29 echo "Try '$0 --help' for more information"
27-- 30--
281.8.3.1 312.24.0
29 32
diff --git a/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-missing-wacom-HID-descriptor.patch b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-missing-wacom-HID-descriptor.patch
index 66ff996508..ae89ae09dd 100644
--- a/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-missing-wacom-HID-descriptor.patch
+++ b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-missing-wacom-HID-descriptor.patch
@@ -1,4 +1,4 @@
1From 526cb7e26f6dd96c9ee2ffa05ce0a358d3bfbfb3 Mon Sep 17 00:00:00 2001 1From 883feb43129dc39b491e492c7ccfe89aefe53c44 Mon Sep 17 00:00:00 2001
2From: Richard Purdie <richard.purdie@linuxfoundation.org> 2From: Richard Purdie <richard.purdie@linuxfoundation.org>
3Date: Thu, 27 Nov 2014 14:04:29 +0000 3Date: Thu, 27 Nov 2014 14:04:29 +0000
4Subject: [PATCH] qemu: Add missing wacom HID descriptor 4Subject: [PATCH] qemu: Add missing wacom HID descriptor
@@ -14,6 +14,8 @@ Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
14Upstream-Status: Submitted 14Upstream-Status: Submitted
152014/11/27 152014/11/27
16 16
17[update patch context]
18Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
17--- 19---
18 hw/usb/dev-wacom.c | 94 +++++++++++++++++++++++++++++++++++++++++++++- 20 hw/usb/dev-wacom.c | 94 +++++++++++++++++++++++++++++++++++++++++++++-
19 1 file changed, 93 insertions(+), 1 deletion(-) 21 1 file changed, 93 insertions(+), 1 deletion(-)
@@ -137,3 +139,6 @@ index 8ed57b3b..1502928b 100644
137 case WACOM_SET_REPORT: 139 case WACOM_SET_REPORT:
138 if (s->mouse_grabbed) { 140 if (s->mouse_grabbed) {
139 qemu_remove_mouse_event_handler(s->eh_entry); 141 qemu_remove_mouse_event_handler(s->eh_entry);
142--
1432.24.0
144
diff --git a/meta/recipes-devtools/qemu/qemu/0001-qemu-Do-not-include-file-if-not-exists.patch b/meta/recipes-devtools/qemu/qemu/0001-qemu-Do-not-include-file-if-not-exists.patch
index eccac0509c..6e38d814cd 100644
--- a/meta/recipes-devtools/qemu/qemu/0001-qemu-Do-not-include-file-if-not-exists.patch
+++ b/meta/recipes-devtools/qemu/qemu/0001-qemu-Do-not-include-file-if-not-exists.patch
@@ -1,4 +1,4 @@
1From 98c2da129db19ee63d7e21b77a0ef70822c95069 Mon Sep 17 00:00:00 2001 1From 34247f83095f8cdcdc1f9d7f0c6ffbd46b25d979 Mon Sep 17 00:00:00 2001
2From: Oleksiy Obitotskyy <oobitots@cisco.com> 2From: Oleksiy Obitotskyy <oobitots@cisco.com>
3Date: Wed, 25 Mar 2020 21:21:35 +0200 3Date: Wed, 25 Mar 2020 21:21:35 +0200
4Subject: [PATCH] qemu: Do not include file if not exists 4Subject: [PATCH] qemu: Do not include file if not exists
@@ -8,24 +8,27 @@ if_alg.h still included.
8 8
9Upstream-status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg07188.html] 9Upstream-status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg07188.html]
10Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com> 10Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com>
11
12[update patch context]
13Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
11--- 14---
12 linux-user/syscall.c | 2 ++ 15 linux-user/syscall.c | 2 ++
13 1 file changed, 2 insertions(+) 16 1 file changed, 2 insertions(+)
14 17
15diff --git a/linux-user/syscall.c b/linux-user/syscall.c 18diff --git a/linux-user/syscall.c b/linux-user/syscall.c
16index fc18f244..68d62666 100644 19index d6f8cc97..a61420e7 100644
17--- a/linux-user/syscall.c 20--- a/linux-user/syscall.c
18+++ b/linux-user/syscall.c 21+++ b/linux-user/syscall.c
19@@ -106,7 +106,9 @@ 22@@ -109,7 +109,9 @@
20 #include <linux/blkpg.h> 23 #include <linux/blkpg.h>
21 #include <netpacket/packet.h> 24 #include <netpacket/packet.h>
22 #include <linux/netlink.h> 25 #include <linux/netlink.h>
23+#if defined(CONFIG_AF_ALG) 26+#if defined(CONFIG_AF_ALG)
24 #include <linux/if_alg.h> 27 #include <linux/if_alg.h>
25+#endif 28+#endif
29 #include <linux/rtc.h>
30 #include <sound/asound.h>
26 #include "linux_loop.h" 31 #include "linux_loop.h"
27 #include "uname.h"
28
29-- 32--
302.20.1 332.24.0
31 34
diff --git a/meta/recipes-devtools/qemu/qemu/0002-Add-subpackage-ptest-which-runs-all-unit-test-cases-.patch b/meta/recipes-devtools/qemu/qemu/0002-Add-subpackage-ptest-which-runs-all-unit-test-cases-.patch
index 7f7da51006..3d268870fc 100644
--- a/meta/recipes-devtools/qemu/qemu/0002-Add-subpackage-ptest-which-runs-all-unit-test-cases-.patch
+++ b/meta/recipes-devtools/qemu/qemu/0002-Add-subpackage-ptest-which-runs-all-unit-test-cases-.patch
@@ -1,4 +1,4 @@
1From 8ee6281516bd9210e75e91d705da8916bab3bf51 Mon Sep 17 00:00:00 2001 1From 5da6cef7761157a003e7ebde74fb3cf90ab396d9 Mon Sep 17 00:00:00 2001
2From: Juro Bystricky <juro.bystricky@intel.com> 2From: Juro Bystricky <juro.bystricky@intel.com>
3Date: Thu, 31 Aug 2017 11:06:56 -0700 3Date: Thu, 31 Aug 2017 11:06:56 -0700
4Subject: [PATCH] Add subpackage -ptest which runs all unit test cases for 4Subject: [PATCH] Add subpackage -ptest which runs all unit test cases for
@@ -10,17 +10,19 @@ Signed-off-by: Kai Kang <kai.kang@windriver.com>
10 10
11Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> 11Signed-off-by: Juro Bystricky <juro.bystricky@intel.com>
12 12
13[update patch context]
14Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
13--- 15---
14 tests/Makefile.include | 8 ++++++++ 16 tests/Makefile.include | 8 ++++++++
15 1 file changed, 8 insertions(+) 17 1 file changed, 8 insertions(+)
16 18
17diff --git a/tests/Makefile.include b/tests/Makefile.include 19diff --git a/tests/Makefile.include b/tests/Makefile.include
18index 8566f5f1..52d0320b 100644 20index 51de6762..1ea4d322 100644
19--- a/tests/Makefile.include 21--- a/tests/Makefile.include
20+++ b/tests/Makefile.include 22+++ b/tests/Makefile.include
21@@ -1210,4 +1210,12 @@ all: $(QEMU_IOTESTS_HELPERS-y) 23@@ -941,4 +941,12 @@ all: $(QEMU_IOTESTS_HELPERS-y)
22 -include $(wildcard tests/*.d) 24 -include $(wildcard tests/qtest/*.d)
23 -include $(wildcard tests/libqos/*.d) 25 -include $(wildcard tests/qtest/libqos/*.d)
24 26
25+buildtest-TESTS: $(check-unit-y) 27+buildtest-TESTS: $(check-unit-y)
26+ 28+
@@ -31,3 +33,6 @@ index 8566f5f1..52d0320b 100644
31+ done 33+ done
32+ 34+
33 endif 35 endif
36--
372.24.0
38
diff --git a/meta/recipes-devtools/qemu/qemu/0005-qemu-native-set-ld.bfd-fix-cflags-and-set-some-envir.patch b/meta/recipes-devtools/qemu/qemu/0005-qemu-native-set-ld.bfd-fix-cflags-and-set-some-envir.patch
index ec303371b0..2c5b241e41 100644
--- a/meta/recipes-devtools/qemu/qemu/0005-qemu-native-set-ld.bfd-fix-cflags-and-set-some-envir.patch
+++ b/meta/recipes-devtools/qemu/qemu/0005-qemu-native-set-ld.bfd-fix-cflags-and-set-some-envir.patch
@@ -1,22 +1,24 @@
1From 6cdf82af2eba312b9b8da86dda28b98d3d51f4d4 Mon Sep 17 00:00:00 2001 1From 230fe5804099bdca0c9e4cae7280c9fc513cb7f5 Mon Sep 17 00:00:00 2001
2From: Stephen Arnold <sarnold@vctlabs.com> 2From: Stephen Arnold <sarnold@vctlabs.com>
3Date: Sun, 12 Jun 2016 18:09:56 -0700 3Date: Sun, 12 Jun 2016 18:09:56 -0700
4Subject: [PATCH] qemu-native: set ld.bfd, fix cflags, and set some environment 4Subject: [PATCH] qemu-native: set ld.bfd, fix cflags, and set some environment
5 5
6Upstream-Status: Pending 6Upstream-Status: Pending
7 7
8[update patch context]
9Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
8--- 10---
9 configure | 4 ---- 11 configure | 4 ----
10 1 file changed, 4 deletions(-) 12 1 file changed, 4 deletions(-)
11 13
12diff --git a/configure b/configure 14diff --git a/configure b/configure
13index a766017b..72f11aca 100755 15index 83c65439..6bdf488c 100755
14--- a/configure 16--- a/configure
15+++ b/configure 17+++ b/configure
16@@ -6085,10 +6085,6 @@ write_c_skeleton 18@@ -6251,10 +6251,6 @@ write_c_skeleton
17 if test "$gcov" = "yes" ; then 19 if test "$gcov" = "yes" ; then
18 CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS" 20 QEMU_CFLAGS="-fprofile-arcs -ftest-coverage -g $QEMU_CFLAGS"
19 LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS" 21 QEMU_LDFLAGS="-fprofile-arcs -ftest-coverage $QEMU_LDFLAGS"
20-elif test "$fortify_source" = "yes" ; then 22-elif test "$fortify_source" = "yes" ; then
21- CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS" 23- CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
22-elif test "$debug" = "no"; then 24-elif test "$debug" = "no"; then
@@ -24,3 +26,6 @@ index a766017b..72f11aca 100755
24 fi 26 fi
25 27
26 if test "$have_asan" = "yes"; then 28 if test "$have_asan" = "yes"; then
29--
302.24.0
31
diff --git a/meta/recipes-devtools/qemu/qemu/0009-Fix-webkitgtk-builds.patch b/meta/recipes-devtools/qemu/qemu/0009-Fix-webkitgtk-builds.patch
index 7e273eeced..eef3f3f97f 100644
--- a/meta/recipes-devtools/qemu/qemu/0009-Fix-webkitgtk-builds.patch
+++ b/meta/recipes-devtools/qemu/qemu/0009-Fix-webkitgtk-builds.patch
@@ -1,4 +1,4 @@
1From 613166007e3b852c99caf2cd34a972e2c8460737 Mon Sep 17 00:00:00 2001 1From 815c97ba0de02da9dace3fcfcbdf9b20e029f0d7 Mon Sep 17 00:00:00 2001
2From: Martin Jansa <martin.jansa@lge.com> 2From: Martin Jansa <martin.jansa@lge.com>
3Date: Fri, 1 Jun 2018 08:41:07 +0000 3Date: Fri, 1 Jun 2018 08:41:07 +0000
4Subject: [PATCH] Fix webkitgtk builds 4Subject: [PATCH] Fix webkitgtk builds
@@ -19,6 +19,8 @@ This reverts commit ebf9a3630c911d0cfc9c20f7cafe9ba4f88cf583.
19Upstream-Status: Pending 19Upstream-Status: Pending
20Signed-off-by: Alistair Francis <alistair.francis@wdc.com> 20Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
21 21
22[update patch context]
23Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
22--- 24---
23 include/exec/cpu-all.h | 6 +----- 25 include/exec/cpu-all.h | 6 +-----
24 include/exec/cpu_ldst.h | 5 ++++- 26 include/exec/cpu_ldst.h | 5 ++++-
@@ -27,7 +29,7 @@ Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
27 4 files changed, 10 insertions(+), 23 deletions(-) 29 4 files changed, 10 insertions(+), 23 deletions(-)
28 30
29diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h 31diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
30index e96781a4..a369f81a 100644 32index 49384bb6..93b12519 100644
31--- a/include/exec/cpu-all.h 33--- a/include/exec/cpu-all.h
32+++ b/include/exec/cpu-all.h 34+++ b/include/exec/cpu-all.h
33@@ -162,12 +162,8 @@ extern unsigned long guest_base; 35@@ -162,12 +162,8 @@ extern unsigned long guest_base;
@@ -45,10 +47,10 @@ index e96781a4..a369f81a 100644
45 47
46 #include "exec/hwaddr.h" 48 #include "exec/hwaddr.h"
47diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h 49diff --git a/include/exec/cpu_ldst.h b/include/exec/cpu_ldst.h
48index fd499f7e..30575f60 100644 50index 53de1975..cf19ed2e 100644
49--- a/include/exec/cpu_ldst.h 51--- a/include/exec/cpu_ldst.h
50+++ b/include/exec/cpu_ldst.h 52+++ b/include/exec/cpu_ldst.h
51@@ -65,7 +65,10 @@ typedef uint64_t abi_ptr; 53@@ -70,7 +70,10 @@ typedef uint64_t abi_ptr;
52 #if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS 54 #if HOST_LONG_BITS <= TARGET_VIRT_ADDR_SPACE_BITS
53 #define guest_addr_valid(x) (1) 55 #define guest_addr_valid(x) (1)
54 #else 56 #else
@@ -61,10 +63,10 @@ index fd499f7e..30575f60 100644
61 #define h2g_valid(x) guest_addr_valid((unsigned long)(x) - guest_base) 63 #define h2g_valid(x) guest_addr_valid((unsigned long)(x) - guest_base)
62 64
63diff --git a/linux-user/mmap.c b/linux-user/mmap.c 65diff --git a/linux-user/mmap.c b/linux-user/mmap.c
64index 46a6e3a7..77354654 100644 66index e3780337..1d4aba95 100644
65--- a/linux-user/mmap.c 67--- a/linux-user/mmap.c
66+++ b/linux-user/mmap.c 68+++ b/linux-user/mmap.c
67@@ -78,7 +78,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot) 69@@ -71,7 +71,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
68 return -TARGET_EINVAL; 70 return -TARGET_EINVAL;
69 len = TARGET_PAGE_ALIGN(len); 71 len = TARGET_PAGE_ALIGN(len);
70 end = start + len; 72 end = start + len;
@@ -73,7 +75,7 @@ index 46a6e3a7..77354654 100644
73 return -TARGET_ENOMEM; 75 return -TARGET_ENOMEM;
74 } 76 }
75 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 77 prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
76@@ -495,8 +495,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, 78@@ -467,8 +467,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
77 * It can fail only on 64-bit host with 32-bit target. 79 * It can fail only on 64-bit host with 32-bit target.
78 * On any other target/host host mmap() handles this error correctly. 80 * On any other target/host host mmap() handles this error correctly.
79 */ 81 */
@@ -84,7 +86,7 @@ index 46a6e3a7..77354654 100644
84 goto fail; 86 goto fail;
85 } 87 }
86 88
87@@ -636,10 +636,8 @@ int target_munmap(abi_ulong start, abi_ulong len) 89@@ -604,10 +604,8 @@ int target_munmap(abi_ulong start, abi_ulong len)
88 if (start & ~TARGET_PAGE_MASK) 90 if (start & ~TARGET_PAGE_MASK)
89 return -TARGET_EINVAL; 91 return -TARGET_EINVAL;
90 len = TARGET_PAGE_ALIGN(len); 92 len = TARGET_PAGE_ALIGN(len);
@@ -96,7 +98,7 @@ index 46a6e3a7..77354654 100644
96 mmap_lock(); 98 mmap_lock();
97 end = start + len; 99 end = start + len;
98 real_start = start & qemu_host_page_mask; 100 real_start = start & qemu_host_page_mask;
99@@ -694,13 +692,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size, 101@@ -662,13 +660,6 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
100 int prot; 102 int prot;
101 void *host_addr; 103 void *host_addr;
102 104
@@ -111,10 +113,10 @@ index 46a6e3a7..77354654 100644
111 113
112 if (flags & MREMAP_FIXED) { 114 if (flags & MREMAP_FIXED) {
113diff --git a/linux-user/syscall.c b/linux-user/syscall.c 115diff --git a/linux-user/syscall.c b/linux-user/syscall.c
114index 171c0cae..fc18f244 100644 116index 05f03919..d6f8cc97 100644
115--- a/linux-user/syscall.c 117--- a/linux-user/syscall.c
116+++ b/linux-user/syscall.c 118+++ b/linux-user/syscall.c
117@@ -4138,9 +4138,6 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env, 119@@ -4287,9 +4287,6 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
118 return -TARGET_EINVAL; 120 return -TARGET_EINVAL;
119 } 121 }
120 } 122 }
@@ -124,12 +126,15 @@ index 171c0cae..fc18f244 100644
124 126
125 mmap_lock(); 127 mmap_lock();
126 128
127@@ -6990,7 +6987,7 @@ static int open_self_maps(void *cpu_env, int fd) 129@@ -7247,7 +7244,7 @@ static int open_self_maps(void *cpu_env, int fd)
128 } 130 const char *path;
129 if (h2g_valid(min)) { 131
130 int flags = page_get_flags(h2g(min)); 132 max = h2g_valid(max - 1) ?
131- max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1; 133- max : (uintptr_t) g2h(GUEST_ADDR_MAX) + 1;
132+ max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX); 134+ max : (uintptr_t) g2h(GUEST_ADDR_MAX);
135
133 if (page_check_range(h2g(min), max - min, flags) == -1) { 136 if (page_check_range(h2g(min), max - min, flags) == -1) {
134 continue; 137 continue;
135 } 138--
1392.24.0
140
diff --git a/meta/recipes-devtools/qemu/qemu/0011-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch b/meta/recipes-devtools/qemu/qemu/0011-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
deleted file mode 100644
index 2fe0850a33..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0011-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
+++ /dev/null
@@ -1,54 +0,0 @@
1From a88c40f02ace88f09b2a85a64831b277b2ebc88c Mon Sep 17 00:00:00 2001
2From: Peter Wu <peter@lekensteyn.nl>
3Date: Sat, 21 Dec 2019 17:21:24 +0100
4Subject: [PATCH] hw/i386/pc: fix regression in parsing vga cmdline parameter
5
6When the 'vga=' parameter is succeeded by another parameter, QEMU 4.2.0
7would refuse to start with a rather cryptic message:
8
9 $ qemu-system-x86_64 -kernel /boot/vmlinuz-linux -append 'vga=792 quiet'
10 qemu: can't parse 'vga' parameter: Invalid argument
11
12It was not clear whether this applied to the '-vga std' parameter or the
13'-append' one. Fix the parsing regression and clarify the error.
14
15Fixes: 133ef074bd ("hw/i386/pc: replace use of strtol with qemu_strtoui in x86_load_linux()")
16Cc: Sergio Lopez <slp@redhat.com>
17Signed-off-by: Peter Wu <peter@lekensteyn.nl>
18Message-Id: <20191221162124.1159291-1-peter@lekensteyn.nl>
19Cc: qemu-stable@nongnu.org
20Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
21Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commitdiff;h=a88c40f02ace88f09b2a85a64831b277b2ebc88c]
22---
23 hw/i386/x86.c | 8 ++++----
24 1 file changed, 4 insertions(+), 4 deletions(-)
25
26diff --git a/hw/i386/x86.c b/hw/i386/x86.c
27index d8bb5c2a96..9b9a4d5837 100644
28--- a/hw/i386/x86.c
29+++ b/hw/i386/x86.c
30@@ -612,6 +612,7 @@ void x86_load_linux(X86MachineState *x86ms,
31 vmode = strstr(kernel_cmdline, "vga=");
32 if (vmode) {
33 unsigned int video_mode;
34+ const char *end;
35 int ret;
36 /* skip "vga=" */
37 vmode += 4;
38@@ -622,10 +623,9 @@ void x86_load_linux(X86MachineState *x86ms,
39 } else if (!strncmp(vmode, "ask", 3)) {
40 video_mode = 0xfffd;
41 } else {
42- ret = qemu_strtoui(vmode, NULL, 0, &video_mode);
43- if (ret != 0) {
44- fprintf(stderr, "qemu: can't parse 'vga' parameter: %s\n",
45- strerror(-ret));
46+ ret = qemu_strtoui(vmode, &end, 0, &video_mode);
47+ if (ret != 0 || (*end && *end != ' ')) {
48+ fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
49 exit(1);
50 }
51 }
52--
532.25.0
54
diff --git a/meta/recipes-devtools/qemu/qemu/0012-fix-libcap-header-issue-on-some-distro.patch b/meta/recipes-devtools/qemu/qemu/0012-fix-libcap-header-issue-on-some-distro.patch
deleted file mode 100644
index 3a7d7bbd33..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0012-fix-libcap-header-issue-on-some-distro.patch
+++ /dev/null
@@ -1,86 +0,0 @@
1From 9125afb733d8c96416bb83c5adad39bb8d0803a1 Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Tue, 12 Mar 2013 09:54:06 +0800
4Subject: [PATCH] fix libcap header issue on some distro
5
61, When build qemu-native on SLED 11.2, there is an error:
7...
8| In file included from /usr/include/bits/sigcontext.h:28,
9| from /usr/include/signal.h:339,
10| from /buildarea2/tmp/work/i686-linux/qemu-native/1.4.0-r0/
11qemu-1.4.0/include/qemu-common.h:42,
12| from fsdev/virtfs-proxy-helper.c:23:
13| /usr/include/asm/sigcontext.h:28: error: expected specifier-
14qualifier-list before '__u64'
15| /usr/include/asm/sigcontext.h:191: error: expected specifier-
16qualifier-list before '__u64'
17...
18
192, The virtfs-proxy-helper.c includes <sys/capability.h> and
20qemu-common.h in sequence. The header include map is:
21(`-->' presents `include')
22...
23"virtfs-proxy-helper.c" --> <sys/capability.h>
24...
25"virtfs-proxy-helper.c" --> "qemu-common.h" --> <signal.h> -->
26<bits/sigcontext.h> --> <asm/sigcontext.h> --> <linux/types.h> -->
27<asm/types.h> --> <asm-generic/types.h> --> <asm-generic/int-ll64.h>
28...
29
303, The bug is found on SLED 11.2 x86. In libcap header file
31/usr/include/sys/capability.h, it does evil stuff like this:
32...
33 25 /*
34 26 * Make sure we can be included from userland by preventing
35 27 * capability.h from including other kernel headers
36 28 */
37 29 #define _LINUX_TYPES_H
38 30 #define _LINUX_FS_H
39 31 #define __LINUX_COMPILER_H
40 32 #define __user
41 33
42 34 typedef unsigned int __u32;
43 35 typedef __u32 __le32;
44...
45This completely prevents including /usr/include/linux/types.h.
46The above `<asm/sigcontext.h> --> <linux/types.h>' is prevented,
47and '__u64' is defined in <asm-generic/int-ll64.h>.
48
494, Modify virtfs-proxy-helper.c to include <sys/capability.h>
50last to workaround the issue.
51
52http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
53http://patchwork.linuxtv.org/patch/12748/
54
55Upstream-Status: Pending
56Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
57
58---
59 fsdev/virtfs-proxy-helper.c | 7 +++++--
60 1 file changed, 5 insertions(+), 2 deletions(-)
61
62diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
63index 6f132c5f..8329950c 100644
64--- a/fsdev/virtfs-proxy-helper.c
65+++ b/fsdev/virtfs-proxy-helper.c
66@@ -13,7 +13,6 @@
67 #include <sys/resource.h>
68 #include <getopt.h>
69 #include <syslog.h>
70-#include <sys/capability.h>
71 #include <sys/fsuid.h>
72 #include <sys/vfs.h>
73 #include <sys/ioctl.h>
74@@ -27,7 +26,11 @@
75 #include "9p-iov-marshal.h"
76 #include "hw/9pfs/9p-proxy.h"
77 #include "fsdev/9p-iov-marshal.h"
78-
79+/*
80+ * Include this one last due to some versions of it being buggy:
81+ * http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
82+ */
83+#include <sys/capability.h>
84 #define PROGNAME "virtfs-proxy-helper"
85
86 #ifndef XFS_SUPER_MAGIC
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2019-15890.patch b/meta/recipes-devtools/qemu/qemu/CVE-2019-15890.patch
deleted file mode 100644
index 1d89431be6..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2019-15890.patch
+++ /dev/null
@@ -1,48 +0,0 @@
1From 4fc0d23e8f6d795c679623d2ed2cbe6a7a17b9c7 Mon Sep 17 00:00:00 2001
2From: Li Zhou <li.zhou@windriver.com>
3Date: Tue, 10 Sep 2019 20:02:15 -0700
4Subject: [PATCH] ip_reass: Fix use after free
5
6Using ip_deq after m_free might read pointers from an allocation reuse.
7
8This would be difficult to exploit, but that is still related with
9CVE-2019-14378 which generates fragmented IP packets that would trigger this
10issue and at least produce a DoS.
11
12Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
13
14Upstream-Status: Backport
15CVE: CVE-2019-15890
16Signed-off-by: Li Zhou <li.zhou@windriver.com>
17---
18 slirp/src/ip_input.c | 6 ++++--
19 1 file changed, 4 insertions(+), 2 deletions(-)
20
21diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
22index 8c75d914..c07d7d40 100644
23--- a/slirp/src/ip_input.c
24+++ b/slirp/src/ip_input.c
25@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
26 */
27 while (q != (struct ipasfrag *)&fp->frag_link &&
28 ip->ip_off + ip->ip_len > q->ipf_off) {
29+ struct ipasfrag *prev;
30 i = (ip->ip_off + ip->ip_len) - q->ipf_off;
31 if (i < q->ipf_len) {
32 q->ipf_len -= i;
33@@ -299,9 +300,10 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
34 m_adj(dtom(slirp, q), i);
35 break;
36 }
37+ prev = q;
38 q = q->ipf_next;
39- m_free(dtom(slirp, q->ipf_prev));
40- ip_deq(q->ipf_prev);
41+ ip_deq(prev);
42+ m_free(dtom(slirp, prev));
43 }
44
45 insert:
46--
472.23.0
48
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch
deleted file mode 100644
index e8f3e1dbdb..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-11102.patch
+++ /dev/null
@@ -1,148 +0,0 @@
1From 8ffb7265af64ec81748335ec8f20e7ab542c3850 Mon Sep 17 00:00:00 2001
2From: Prasad J Pandit <pjp@fedoraproject.org>
3Date: Tue, 24 Mar 2020 22:57:22 +0530
4Subject: [PATCH] net: tulip: check frame size and r/w data length
5
6Tulip network driver while copying tx/rx buffers does not check
7frame size against r/w data length. This may lead to OOB buffer
8access. Add check to avoid it.
9
10Limit iterations over descriptors to avoid potential infinite
11loop issue in tulip_xmit_list_update.
12
13Reported-by: Li Qiang <pangpei.lq@antfin.com>
14Reported-by: Ziming Zhang <ezrakiez@gmail.com>
15Reported-by: Jason Wang <jasowang@redhat.com>
16Tested-by: Li Qiang <liq3ea@gmail.com>
17Reviewed-by: Li Qiang <liq3ea@gmail.com>
18Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
19Signed-off-by: Jason Wang <jasowang@redhat.com>
20
21Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=8ffb7265af64ec81748335ec8f20e7ab542c3850]
22CVE: CVE-2020-11102
23Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
24---
25 hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------
26 1 file changed, 27 insertions(+), 9 deletions(-)
27
28diff --git a/hw/net/tulip.c b/hw/net/tulip.c
29index cfac271..1295f51 100644
30--- a/hw/net/tulip.c
31+++ b/hw/net/tulip.c
32@@ -170,6 +170,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
33 } else {
34 len = s->rx_frame_len;
35 }
36+
37+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
38+ return;
39+ }
40 pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
41 (s->rx_frame_size - s->rx_frame_len), len);
42 s->rx_frame_len -= len;
43@@ -181,6 +185,10 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
44 } else {
45 len = s->rx_frame_len;
46 }
47+
48+ if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
49+ return;
50+ }
51 pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
52 (s->rx_frame_size - s->rx_frame_len), len);
53 s->rx_frame_len -= len;
54@@ -227,7 +235,8 @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
55
56 trace_tulip_receive(buf, size);
57
58- if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
59+ if (size < 14 || size > sizeof(s->rx_frame) - 4
60+ || s->rx_frame_len || tulip_rx_stopped(s)) {
61 return 0;
62 }
63
64@@ -275,7 +284,6 @@ static ssize_t tulip_receive_nc(NetClientState *nc,
65 return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
66 }
67
68-
69 static NetClientInfo net_tulip_info = {
70 .type = NET_CLIENT_DRIVER_NIC,
71 .size = sizeof(NICState),
72@@ -558,7 +566,7 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
73 if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
74 /* Internal or external Loopback */
75 tulip_receive(s, s->tx_frame, s->tx_frame_len);
76- } else {
77+ } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {
78 qemu_send_packet(qemu_get_queue(s->nic),
79 s->tx_frame, s->tx_frame_len);
80 }
81@@ -570,23 +578,31 @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
82 }
83 }
84
85-static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
86+static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
87 {
88 int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
89 int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
90
91+ if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
92+ return -1;
93+ }
94 if (len1) {
95 pci_dma_read(&s->dev, desc->buf_addr1,
96 s->tx_frame + s->tx_frame_len, len1);
97 s->tx_frame_len += len1;
98 }
99
100+ if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
101+ return -1;
102+ }
103 if (len2) {
104 pci_dma_read(&s->dev, desc->buf_addr2,
105 s->tx_frame + s->tx_frame_len, len2);
106 s->tx_frame_len += len2;
107 }
108 desc->status = (len1 + len2) ? 0 : 0x7fffffff;
109+
110+ return 0;
111 }
112
113 static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
114@@ -651,13 +667,15 @@ static uint32_t tulip_ts(TULIPState *s)
115
116 static void tulip_xmit_list_update(TULIPState *s)
117 {
118+#define TULIP_DESC_MAX 128
119+ uint8_t i = 0;
120 struct tulip_descriptor desc;
121
122 if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
123 return;
124 }
125
126- for (;;) {
127+ for (i = 0; i < TULIP_DESC_MAX; i++) {
128 tulip_desc_read(s, s->current_tx_desc, &desc);
129 tulip_dump_tx_descriptor(s, &desc);
130
131@@ -675,10 +693,10 @@ static void tulip_xmit_list_update(TULIPState *s)
132 s->tx_frame_len = 0;
133 }
134
135- tulip_copy_tx_buffers(s, &desc);
136-
137- if (desc.control & TDES1_LS) {
138- tulip_tx(s, &desc);
139+ if (!tulip_copy_tx_buffers(s, &desc)) {
140+ if (desc.control & TDES1_LS) {
141+ tulip_tx(s, &desc);
142+ }
143 }
144 }
145 tulip_desc_write(s, s->current_tx_desc, &desc);
146--
1471.8.3.1
148
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch
deleted file mode 100644
index ca7ffed934..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-11869.patch
+++ /dev/null
@@ -1,97 +0,0 @@
1From ac2071c3791b67fc7af78b8ceb320c01ca1b5df7 Mon Sep 17 00:00:00 2001
2From: BALATON Zoltan <balaton@eik.bme.hu>
3Date: Mon, 6 Apr 2020 22:34:26 +0200
4Subject: [PATCH] ati-vga: Fix checks in ati_2d_blt() to avoid crash
5
6In some corner cases (that never happen during normal operation but a
7malicious guest could program wrong values) pixman functions were
8called with parameters that result in a crash. Fix this and add more
9checks to disallow such cases.
10
11Reported-by: Ziming Zhang <ezrakiez@gmail.com>
12Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
13Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu
14Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
15
16Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=commit;h=ac2071c3791b67fc7af78b8ceb320c01ca1b5df7]
17CVE: CVE-2020-11869
18Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
19---
20 hw/display/ati_2d.c | 37 ++++++++++++++++++++++++++-----------
21 1 file changed, 26 insertions(+), 11 deletions(-)
22
23diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
24index 42e8231..23a8ae0 100644
25--- a/hw/display/ati_2d.c
26+++ b/hw/display/ati_2d.c
27@@ -53,12 +53,20 @@ void ati_2d_blt(ATIVGAState *s)
28 s->vga.vbe_start_addr, surface_data(ds), surface_stride(ds),
29 surface_bits_per_pixel(ds),
30 (s->regs.dp_mix & GMC_ROP3_MASK) >> 16);
31- int dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
32- s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width);
33- int dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
34- s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height);
35+ unsigned dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
36+ s->regs.dst_x : s->regs.dst_x + 1 - s->regs.dst_width);
37+ unsigned dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
38+ s->regs.dst_y : s->regs.dst_y + 1 - s->regs.dst_height);
39 int bpp = ati_bpp_from_datatype(s);
40+ if (!bpp) {
41+ qemu_log_mask(LOG_GUEST_ERROR, "Invalid bpp\n");
42+ return;
43+ }
44 int dst_stride = DEFAULT_CNTL ? s->regs.dst_pitch : s->regs.default_pitch;
45+ if (!dst_stride) {
46+ qemu_log_mask(LOG_GUEST_ERROR, "Zero dest pitch\n");
47+ return;
48+ }
49 uint8_t *dst_bits = s->vga.vram_ptr + (DEFAULT_CNTL ?
50 s->regs.dst_offset : s->regs.default_offset);
51
52@@ -82,12 +90,16 @@ void ati_2d_blt(ATIVGAState *s)
53 switch (s->regs.dp_mix & GMC_ROP3_MASK) {
54 case ROP3_SRCCOPY:
55 {
56- int src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
57- s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width);
58- int src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
59- s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height);
60+ unsigned src_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
61+ s->regs.src_x : s->regs.src_x + 1 - s->regs.dst_width);
62+ unsigned src_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
63+ s->regs.src_y : s->regs.src_y + 1 - s->regs.dst_height);
64 int src_stride = DEFAULT_CNTL ?
65 s->regs.src_pitch : s->regs.default_pitch;
66+ if (!src_stride) {
67+ qemu_log_mask(LOG_GUEST_ERROR, "Zero source pitch\n");
68+ return;
69+ }
70 uint8_t *src_bits = s->vga.vram_ptr + (DEFAULT_CNTL ?
71 s->regs.src_offset : s->regs.default_offset);
72
73@@ -137,8 +149,10 @@ void ati_2d_blt(ATIVGAState *s)
74 dst_y * surface_stride(ds),
75 s->regs.dst_height * surface_stride(ds));
76 }
77- s->regs.dst_x += s->regs.dst_width;
78- s->regs.dst_y += s->regs.dst_height;
79+ s->regs.dst_x = (s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT ?
80+ dst_x + s->regs.dst_width : dst_x);
81+ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
82+ dst_y + s->regs.dst_height : dst_y);
83 break;
84 }
85 case ROP3_PATCOPY:
86@@ -179,7 +193,8 @@ void ati_2d_blt(ATIVGAState *s)
87 dst_y * surface_stride(ds),
88 s->regs.dst_height * surface_stride(ds));
89 }
90- s->regs.dst_y += s->regs.dst_height;
91+ s->regs.dst_y = (s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM ?
92+ dst_y + s->regs.dst_height : dst_y);
93 break;
94 }
95 default:
96--
971.8.3.1
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-1711.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-1711.patch
deleted file mode 100644
index aa7bc82329..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-1711.patch
+++ /dev/null
@@ -1,64 +0,0 @@
1From 693fd2acdf14dd86c0bf852610f1c2cca80a74dc Mon Sep 17 00:00:00 2001
2From: Felipe Franciosi <felipe@nutanix.com>
3Date: Thu, 23 Jan 2020 12:44:59 +0000
4Subject: [PATCH] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
5
6When querying an iSCSI server for the provisioning status of blocks (via
7GET LBA STATUS), Qemu only validates that the response descriptor zero's
8LBA matches the one requested. Given the SCSI spec allows servers to
9respond with the status of blocks beyond the end of the LUN, Qemu may
10have its heap corrupted by clearing/setting too many bits at the end of
11its allocmap for the LUN.
12
13A malicious guest in control of the iSCSI server could carefully program
14Qemu's heap (by selectively setting the bitmap) and then smash it.
15
16This limits the number of bits that iscsi_co_block_status() will try to
17update in the allocmap so it can't overflow the bitmap.
18
19Upstream-Status: Backport [https://git.qemu.org/?p=qemu.git;a=patch;h=693fd2acdf14dd86c0bf852610f1c2cca80a74dc]
20CVE: CVE-2020-1711
21
22Fixes: CVE-2020-1711
23Cc: qemu-stable@nongnu.org
24Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
25Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com>
26Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
27Signed-off-by: Kevin Wolf <kwolf@redhat.com>
28Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
29---
30 block/iscsi.c | 5 +++--
31 1 file changed, 3 insertions(+), 2 deletions(-)
32
33diff --git a/block/iscsi.c b/block/iscsi.c
34index 2aea7e3..cbd5729 100644
35--- a/block/iscsi.c
36+++ b/block/iscsi.c
37@@ -701,7 +701,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
38 struct scsi_get_lba_status *lbas = NULL;
39 struct scsi_lba_status_descriptor *lbasd = NULL;
40 struct IscsiTask iTask;
41- uint64_t lba;
42+ uint64_t lba, max_bytes;
43 int ret;
44
45 iscsi_co_init_iscsitask(iscsilun, &iTask);
46@@ -721,6 +721,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
47 }
48
49 lba = offset / iscsilun->block_size;
50+ max_bytes = (iscsilun->num_blocks - lba) * iscsilun->block_size;
51
52 qemu_mutex_lock(&iscsilun->mutex);
53 retry:
54@@ -764,7 +765,7 @@ retry:
55 goto out_unlock;
56 }
57
58- *pnum = (int64_t) lbasd->num_blocks * iscsilun->block_size;
59+ *pnum = MIN((int64_t) lbasd->num_blocks * iscsilun->block_size, max_bytes);
60
61 if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED ||
62 lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
63--
641.8.3.1
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-1.patch
deleted file mode 100644
index df6bca6db6..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-1.patch
+++ /dev/null
@@ -1,44 +0,0 @@
1From b2663d527a1992ba98c0266458b21ada3b9d0d2e Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 27 Feb 2020 12:07:35 +0800
4Subject: [PATCH] tcp_emu: Fix oob access
5
6The main loop only checks for one available byte, while we sometimes
7need two bytes.
8
9CVE: CVE-2020-7039
10Upstream-Status: Backport
11[https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289]
12
13Signed-off-by: Changqing Li <changqing.li@windriver.com>
14---
15 slirp/src/tcp_subr.c | 6 ++++++
16 1 file changed, 6 insertions(+)
17
18diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
19index d6dd133..4bea2d4 100644
20--- a/slirp/src/tcp_subr.c
21+++ b/slirp/src/tcp_subr.c
22@@ -886,6 +886,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
23 break;
24
25 case 5:
26+ if (bptr == m->m_data + m->m_len - 1)
27+ return 1; /* We need two bytes */
28 /*
29 * The difference between versions 1.0 and
30 * 2.0 is here. For future versions of
31@@ -901,6 +903,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
32 /* This is the field containing the port
33 * number that RA-player is listening to.
34 */
35+
36+ if (bptr == m->m_data + m->m_len - 1)
37+ return 1; /* We need two bytes */
38+
39 lport = (((uint8_t *)bptr)[0] << 8) + ((uint8_t *)bptr)[1];
40 if (lport < 6970)
41 lport += 256; /* don't know why */
42--
432.7.4
44
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-2.patch
deleted file mode 100644
index 4a00fa2afd..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-2.patch
+++ /dev/null
@@ -1,59 +0,0 @@
1From 8f67e76e4148e37f3d8d2bcbdee7417fdedb7669 Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 27 Feb 2020 12:10:34 +0800
4Subject: [PATCH] slirp: use correct size while emulating commands
5
6While emulating services in tcp_emu(), it uses 'mbuf' size
7'm->m_size' to write commands via snprintf(3). Use M_FREEROOM(m)
8size to avoid possible OOB access.
9Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
10Signed-off-by: Samuel Thibault's avatarSamuel Thibault
11<samuel.thibault@ens-lyon.org>
12Message-Id: <20200109094228.79764-3-ppandit@redhat.com>
13
14CVE: CVE-2020-7039
15Upstream-Status: Backport
16[https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80]
17
18Signed-off-by: Changqing Li <changqing.li@windriver.com>
19---
20 slirp/src/tcp_subr.c | 9 ++++-----
21 1 file changed, 4 insertions(+), 5 deletions(-)
22
23diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
24index 4bea2d4..e8ed4ef 100644
25--- a/slirp/src/tcp_subr.c
26+++ b/slirp/src/tcp_subr.c
27@@ -696,7 +696,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
28 n4 = (laddr & 0xff);
29
30 m->m_len = bptr - m->m_data; /* Adjust length */
31- m->m_len += snprintf(bptr, m->m_size - m->m_len,
32+ m->m_len += snprintf(bptr, M_FREEROOM(m),
33 "ORT %d,%d,%d,%d,%d,%d\r\n%s", n1, n2, n3, n4,
34 n5, n6, x == 7 ? buff : "");
35 return 1;
36@@ -731,8 +731,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
37 n4 = (laddr & 0xff);
38
39 m->m_len = bptr - m->m_data; /* Adjust length */
40- m->m_len +=
41- snprintf(bptr, m->m_size - m->m_len,
42+ m->m_len += snprintf(bptr, M_FREEROOM(m),
43 "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
44 n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
45
46@@ -758,8 +757,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
47 if (m->m_data[m->m_len - 1] == '\0' && lport != 0 &&
48 (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
49 htons(lport), SS_FACCEPTONCE)) != NULL)
50- m->m_len =
51- snprintf(m->m_data, m->m_size, "%d", ntohs(so->so_fport)) + 1;
52+ m->m_len = snprintf(m->m_data, M_ROOM(m),
53+ "%d", ntohs(so->so_fport)) + 1;
54 return 1;
55
56 case EMU_IRC:
57--
582.7.4
59
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-3.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-3.patch
deleted file mode 100644
index 70ce480d80..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-7039-3.patch
+++ /dev/null
@@ -1,64 +0,0 @@
1From 0b03959b72036afce151783720d9e54988cf76ef Mon Sep 17 00:00:00 2001
2From: Changqing Li <changqing.li@windriver.com>
3Date: Thu, 27 Feb 2020 12:15:04 +0800
4Subject: [PATCH] slirp: use correct size while emulating IRC commands
5
6While emulating IRC DCC commands, tcp_emu() uses 'mbuf' size
7'm->m_size' to write DCC commands via snprintf(3). This may
8lead to OOB write access, because 'bptr' points somewhere in
9the middle of 'mbuf' buffer, not at the start. Use M_FREEROOM(m)
10size to avoid OOB access.
11Reported-by: default avatarVishnu Dev TJ <vishnudevtj@gmail.com>
12Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
13Reviewed-by: Samuel Thibault's avatarSamuel Thibault
14<samuel.thibault@ens-lyon.org>
15Message-Id: <20200109094228.79764-2-ppandit@redhat.com>
16
17CVE: CVE-2020-7039
18Upstream-Status: Backport
19[https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9]
20
21Signed-off-by: Changqing Li <changqing.li@windriver.com>
22---
23 slirp/src/tcp_subr.c | 11 ++++++-----
24 1 file changed, 6 insertions(+), 5 deletions(-)
25
26diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
27index e8ed4ef..3a4a8ee 100644
28--- a/slirp/src/tcp_subr.c
29+++ b/slirp/src/tcp_subr.c
30@@ -777,7 +777,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
31 return 1;
32 }
33 m->m_len = bptr - m->m_data; /* Adjust length */
34- m->m_len += snprintf(bptr, m->m_size, "DCC CHAT chat %lu %u%c\n",
35+ m->m_len += snprintf(bptr, M_FREEROOM(m),
36+ "DCC CHAT chat %lu %u%c\n",
37 (unsigned long)ntohl(so->so_faddr.s_addr),
38 ntohs(so->so_fport), 1);
39 } else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport,
40@@ -787,8 +788,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
41 return 1;
42 }
43 m->m_len = bptr - m->m_data; /* Adjust length */
44- m->m_len +=
45- snprintf(bptr, m->m_size, "DCC SEND %s %lu %u %u%c\n", buff,
46+ m->m_len += snprintf(bptr, M_FREEROOM(m),
47+ "DCC SEND %s %lu %u %u%c\n", buff,
48 (unsigned long)ntohl(so->so_faddr.s_addr),
49 ntohs(so->so_fport), n1, 1);
50 } else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport,
51@@ -798,8 +799,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
52 return 1;
53 }
54 m->m_len = bptr - m->m_data; /* Adjust length */
55- m->m_len +=
56- snprintf(bptr, m->m_size, "DCC MOVE %s %lu %u %u%c\n", buff,
57+ m->m_len += snprintf(bptr, M_FREEROOM(m),
58+ "DCC MOVE %s %lu %u %u%c\n", buff,
59 (unsigned long)ntohl(so->so_faddr.s_addr),
60 ntohs(so->so_fport), n1, 1);
61 }
62--
632.7.4
64
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2020-7211.patch b/meta/recipes-devtools/qemu/qemu/CVE-2020-7211.patch
deleted file mode 100644
index 11be4c92e7..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2020-7211.patch
+++ /dev/null
@@ -1,46 +0,0 @@
1From 14ec36e107a8c9af7d0a80c3571fe39b291ff1d4 Mon Sep 17 00:00:00 2001
2From: Prasad J Pandit <pjp@fedoraproject.org>
3Date: Mon, 13 Jan 2020 17:44:31 +0530
4Subject: [PATCH] slirp: tftp: restrict relative path access
5
6tftp restricts relative or directory path access on Linux systems.
7Apply same restrictions on Windows systems too. It helps to avoid
8directory traversal issue.
9
10Fixes: https://bugs.launchpad.net/qemu/+bug/1812451
11Reported-by: Peter Maydell <peter.maydell@linaro.org>
12Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
13Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
14Message-Id: <20200113121431.156708-1-ppandit@redhat.com>
15
16Upstream-Status: Backport [https://gitlab.freedesktop.org/slirp/libslirp/-/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4.patch]
17CVE: CVE-2020-7211
18Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
19
20---
21 slirp/src/tftp.c | 9 +++++++--
22 1 file changed, 7 insertions(+), 2 deletions(-)
23
24diff --git a/slirp/src/tftp.c b/slirp/src/tftp.c
25index 093c2e0..e52e71b 100644
26--- a/slirp/src/tftp.c
27+++ b/slirp/src/tftp.c
28@@ -344,8 +344,13 @@ static void tftp_handle_rrq(Slirp *slirp, struct sockaddr_storage *srcsas,
29 k += 6; /* skipping octet */
30
31 /* do sanity checks on the filename */
32- if (!strncmp(req_fname, "../", 3) ||
33- req_fname[strlen(req_fname) - 1] == '/' || strstr(req_fname, "/../")) {
34+ if (
35+#ifdef G_OS_WIN32
36+ strstr(req_fname, "..\\") ||
37+ req_fname[strlen(req_fname) - 1] == '\\' ||
38+#endif
39+ strstr(req_fname, "../") ||
40+ req_fname[strlen(req_fname) - 1] == '/') {
41 tftp_send_error(spt, 2, "Access violation", tp);
42 return;
43 }
44--
452.24.1
46
diff --git a/meta/recipes-devtools/qemu/qemu/find_datadir.patch b/meta/recipes-devtools/qemu/qemu/find_datadir.patch
new file mode 100644
index 0000000000..74e9ba56ce
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/find_datadir.patch
@@ -0,0 +1,37 @@
1qemu: search for datadir as in version 4.2
2
3os_find_datadir() was changed after the 4.2 release. We need to check for
4../share/qemu relative to the executable because that is where the runqemu
5configuration assumes it will be.
6
7Upstream-Status: Submitted [qemu-devel@nongnu.org]
8
9Signed-off-by: Joe Slater <joe.slater@windriver.com>
10
11
12--- a/os-posix.c
13+++ b/os-posix.c
14@@ -82,8 +82,9 @@ void os_setup_signal_handling(void)
15
16 /*
17 * Find a likely location for support files using the location of the binary.
18+ * Typically, this would be "$bindir/../share/qemu".
19 * When running from the build tree this will be "$bindir/../pc-bios".
20- * Otherwise, this is CONFIG_QEMU_DATADIR.
21+ * Otherwise, this is CONFIG_QEMU_DATADIR as constructed by configure.
22 */
23 char *os_find_datadir(void)
24 {
25@@ -93,6 +94,12 @@ char *os_find_datadir(void)
26 exec_dir = qemu_get_exec_dir();
27 g_return_val_if_fail(exec_dir != NULL, NULL);
28
29+ dir = g_build_filename(exec_dir, "..", "share", "qemu", NULL);
30+ if (g_file_test(dir, G_FILE_TEST_IS_DIR)) {
31+ return g_steal_pointer(&dir);
32+ }
33+ g_free(dir); /* no autofree this time */
34+
35 dir = g_build_filename(exec_dir, "..", "pc-bios", NULL);
36 if (g_file_test(dir, G_FILE_TEST_IS_DIR)) {
37 return g_steal_pointer(&dir);
diff --git a/meta/recipes-devtools/qemu/qemu_4.2.0.bb b/meta/recipes-devtools/qemu/qemu_5.0.0.bb
index 9b09490269..9b09490269 100644
--- a/meta/recipes-devtools/qemu/qemu_4.2.0.bb
+++ b/meta/recipes-devtools/qemu/qemu_5.0.0.bb
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-18 22:25:42 +0000