From 941c3ac5a80509c0b7d6cca4f402fd12d8d5806c Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Mon, 27 Oct 2025 20:13:25 +0100 Subject: qemu: upgrade 10.0.2 -> 10.0.6 Handles CVE-2024-8354. Drop patch included in (backported to) this release. Reference: * https://security-tracker.debian.org/tracker/CVE-2024-8354 (From OE-Core rev: f9d2e0155df2fe799e5edd0b52097ee284930ba5) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie --- meta/recipes-devtools/qemu/qemu-native_10.0.2.bb | 10 --- meta/recipes-devtools/qemu/qemu-native_10.0.6.bb | 10 +++ .../qemu/qemu-system-native_10.0.2.bb | 32 -------- .../qemu/qemu-system-native_10.0.6.bb | 32 ++++++++ meta/recipes-devtools/qemu/qemu.inc | 4 +- ...12-Remove-deprecated-get_event_loop-calls.patch | 85 ---------------------- meta/recipes-devtools/qemu/qemu_10.0.2.bb | 28 ------- meta/recipes-devtools/qemu/qemu_10.0.6.bb | 28 +++++++ 8 files changed, 72 insertions(+), 157 deletions(-) delete mode 100644 meta/recipes-devtools/qemu/qemu-native_10.0.2.bb create mode 100644 meta/recipes-devtools/qemu/qemu-native_10.0.6.bb delete mode 100644 meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb create mode 100644 meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb delete mode 100644 meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch delete mode 100644 meta/recipes-devtools/qemu/qemu_10.0.2.bb create mode 100644 meta/recipes-devtools/qemu/qemu_10.0.6.bb (limited to 'meta/recipes-devtools') diff --git a/meta/recipes-devtools/qemu/qemu-native_10.0.2.bb b/meta/recipes-devtools/qemu/qemu-native_10.0.2.bb deleted file mode 100644 index 26fa84c180..0000000000 --- a/meta/recipes-devtools/qemu/qemu-native_10.0.2.bb +++ /dev/null @@ -1,10 +0,0 @@ -BPN = "qemu" - -DEPENDS += "glib-2.0-native zlib-native" - -require qemu-native.inc - -EXTRA_OECONF:append = " --target-list=${@get_qemu_usermode_target_list(d)} --disable-tools --disable-install-blobs --disable-guest-agent" - -PACKAGECONFIG ??= "pie" - diff --git a/meta/recipes-devtools/qemu/qemu-native_10.0.6.bb b/meta/recipes-devtools/qemu/qemu-native_10.0.6.bb new file mode 100644 index 0000000000..26fa84c180 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu-native_10.0.6.bb @@ -0,0 +1,10 @@ +BPN = "qemu" + +DEPENDS += "glib-2.0-native zlib-native" + +require qemu-native.inc + +EXTRA_OECONF:append = " --target-list=${@get_qemu_usermode_target_list(d)} --disable-tools --disable-install-blobs --disable-guest-agent" + +PACKAGECONFIG ??= "pie" + diff --git a/meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb b/meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb deleted file mode 100644 index 22462e2499..0000000000 --- a/meta/recipes-devtools/qemu/qemu-system-native_10.0.2.bb +++ /dev/null @@ -1,32 +0,0 @@ -BPN = "qemu" - -require qemu-native.inc - -# As some of the files installed by qemu-native and qemu-system-native -# are the same, we depend on qemu-native to get the full installation set -# and avoid file clashes -DEPENDS += "glib-2.0-native zlib-native pixman-native qemu-native" - -EXTRA_OECONF:append = " --target-list=${@get_qemu_system_target_list(d)}" - -PACKAGECONFIG ??= "fdt alsa kvm pie slirp png pixman sdl \ - ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ -" - -# Handle distros such as CentOS 5 32-bit that do not have kvm support -PACKAGECONFIG:remove = "${@'kvm' if not os.path.exists('/usr/include/linux/kvm.h') else ''}" - -do_install:append() { - install -Dm 0755 ${UNPACKDIR}/powerpc_rom.bin ${D}${datadir}/qemu - - # The following is also installed by qemu-native - rm -f ${D}${datadir}/qemu/trace-events-all - rm -rf ${D}${datadir}/qemu/keymaps - rm -rf ${D}${datadir}/icons/ - rm -rf ${D}${includedir}/qemu-plugin.h - - # Install qmp.py to be used with testimage - install -d ${D}${libdir}/qemu-python/qmp/ - install -D ${S}/python/qemu/qmp/* ${D}${libdir}/qemu-python/qmp/ -} - diff --git a/meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb b/meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb new file mode 100644 index 0000000000..22462e2499 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu-system-native_10.0.6.bb @@ -0,0 +1,32 @@ +BPN = "qemu" + +require qemu-native.inc + +# As some of the files installed by qemu-native and qemu-system-native +# are the same, we depend on qemu-native to get the full installation set +# and avoid file clashes +DEPENDS += "glib-2.0-native zlib-native pixman-native qemu-native" + +EXTRA_OECONF:append = " --target-list=${@get_qemu_system_target_list(d)}" + +PACKAGECONFIG ??= "fdt alsa kvm pie slirp png pixman sdl \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ +" + +# Handle distros such as CentOS 5 32-bit that do not have kvm support +PACKAGECONFIG:remove = "${@'kvm' if not os.path.exists('/usr/include/linux/kvm.h') else ''}" + +do_install:append() { + install -Dm 0755 ${UNPACKDIR}/powerpc_rom.bin ${D}${datadir}/qemu + + # The following is also installed by qemu-native + rm -f ${D}${datadir}/qemu/trace-events-all + rm -rf ${D}${datadir}/qemu/keymaps + rm -rf ${D}${datadir}/icons/ + rm -rf ${D}${includedir}/qemu-plugin.h + + # Install qmp.py to be used with testimage + install -d ${D}${libdir}/qemu-python/qmp/ + install -D ${S}/python/qemu/qmp/* ${D}${libdir}/qemu-python/qmp/ +} + diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 2ee76e9a7c..3ed5dcc671 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc @@ -31,7 +31,6 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://0008-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ file://0010-configure-lookup-meson-exutable-from-PATH.patch \ file://0011-qemu-Ensure-pip-and-the-python-venv-aren-t-used-for-.patch \ - file://0012-Remove-deprecated-get_event_loop-calls.patch \ file://qemu-guest-agent.init \ file://qemu-guest-agent.udev \ " @@ -39,7 +38,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ UPSTREAM_CHECK_URI = "https://www.qemu.org" UPSTREAM_CHECK_REGEX = "qemu-(?P\d+(\.\d+)+)\.tar" -SRC_URI[sha256sum] = "ef786f2398cb5184600f69aef4d5d691efd44576a3cff4126d38d4c6fec87759" +SRC_URI[sha256sum] = "c7c40c4b166871e775804e97fce4da65665d1cc93a5c6c9e2ede9d9ee992e7a0" CVE_STATUS[CVE-2007-0998] = "not-applicable-config: The VNC server can expose host files uder some circumstances. We don't enable it by default." @@ -51,6 +50,7 @@ CVE_STATUS[CVE-2023-2680] = "not-applicable-platform: RHEL specific issue." # NVD DB has this CVE as version-less (with "-") CVE_STATUS[CVE-2024-6505] = "fixed-version: this CVE is fixed since 9.1.0" +CVE_STATUS[CVE-2024-8354] = "fixed-version: this CVE is fixed since 10.0.5" CVE_STATUS[CVE-2023-1386] = "disputed: not an issue as per https://bugzilla.redhat.com/show_bug.cgi?id=2223985" diff --git a/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch b/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch deleted file mode 100644 index 64816fe7d9..0000000000 --- a/meta/recipes-devtools/qemu/qemu/0012-Remove-deprecated-get_event_loop-calls.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 5240406747fd43886618ae8194153e6fc957a82a Mon Sep 17 00:00:00 2001 -From: John Snow -Date: Tue, 13 Aug 2024 09:35:30 -0400 -Subject: [PATCH] Remove deprecated get_event_loop calls - -This method was deprecated in 3.12 because it ordinarily should not be -used from coroutines; if there is not a currently running event loop, -this automatically creates a new event loop - which is usually not what -you want from code that would ever run in the bottom half. - -In our case, we do want this behavior in two places: - -(1) The synchronous shim, for convenience: this allows fully sync -programs to use QEMUMonitorProtocol() without needing to set up an event -loop beforehand. This is intentional to fully box in the async -complexities into the legacy sync shim. - -(2) The qmp_tui shell; instead of relying on asyncio.run to create and -run an asyncio program, we need to be able to pass the current asyncio -loop to urwid setup functions. For convenience, again, we create one if -one is not present to simplify the creation of the TUI appliance. - -The remaining user of get_event_loop() was in fact one of the erroneous -users that should not have been using this function: if there's no -running event loop inside of a coroutine, you're in big trouble :) - -Upstream-Status: Backport [https://gitlab.com/qemu-project/python-qemu-qmp/-/merge_requests/33] -Signed-off-by: John Snow ---- - python/qemu/qmp/legacy.py | 9 ++++++++- - python/qemu/qmp/qmp_tui.py | 7 ++++++- - python/tests/protocol.py | 2 +- - 3 files changed, 15 insertions(+), 3 deletions(-) - -diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py -index 22a2b56..ea9b803 100644 ---- a/python/qemu/qmp/legacy.py -+++ b/python/qemu/qmp/legacy.py -@@ -86,7 +86,14 @@ def __init__(self, - "server argument should be False when passing a socket") - - self._qmp = QMPClient(nickname) -- self._aloop = asyncio.get_event_loop() -+ -+ try: -+ self._aloop = asyncio.get_running_loop() -+ except RuntimeError: -+ # No running loop; since this is a sync shim likely to be -+ # used in fully sync programs, create one if neccessary. -+ self._aloop = asyncio.get_event_loop_policy().get_event_loop() -+ - self._address = address - self._timeout: Optional[float] = None - -diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py -index 2d9ebbd..d11b9fc 100644 ---- a/python/qemu/qmp/qmp_tui.py -+++ b/python/qemu/qmp/qmp_tui.py -@@ -377,7 +377,12 @@ def run(self, debug: bool = False) -> None: - screen = urwid.raw_display.Screen() - screen.set_terminal_properties(256) - -- self.aloop = asyncio.get_event_loop() -+ try: -+ self.aloop = asyncio.get_running_loop() -+ except RuntimeError: -+ # No running asyncio event loop. Create one if necessary. -+ self.aloop = asyncio.get_event_loop_policy().get_event_loop() -+ - self.aloop.set_debug(debug) - - # Gracefully handle SIGTERM and SIGINT signals -diff --git a/python/tests/protocol.py b/python/tests/protocol.py -index 56c4d44..8dcef57 100644 ---- a/python/tests/protocol.py -+++ b/python/tests/protocol.py -@@ -228,7 +228,7 @@ def async_test(async_test_method): - Decorator; adds SetUp and TearDown to async tests. - """ - async def _wrapper(self, *args, **kwargs): -- loop = asyncio.get_event_loop() -+ loop = asyncio.get_running_loop() - loop.set_debug(True) - - await self._asyncSetUp() diff --git a/meta/recipes-devtools/qemu/qemu_10.0.2.bb b/meta/recipes-devtools/qemu/qemu_10.0.2.bb deleted file mode 100644 index 5d544d8d13..0000000000 --- a/meta/recipes-devtools/qemu/qemu_10.0.2.bb +++ /dev/null @@ -1,28 +0,0 @@ -BBCLASSEXTEND = "nativesdk" - -require qemu.inc - -DEPENDS += "glib-2.0 zlib pixman" - -DEPENDS:append:libc-musl = " libucontext" - -CFLAGS += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', '-DEGL_NO_X11=1', d)}" -LDFLAGS:append:toolchain-clang:x86 = " -latomic" - -RDEPENDS:${PN}-common:class-target += "bash" - -EXTRA_OECONF:append:class-target = " --target-list=${@get_qemu_target_list(d)}" -EXTRA_OECONF:append:class-target:mipsarcho32 = "${@bb.utils.contains('BBEXTENDCURR', 'multilib', ' --disable-capstone', '', d)}" -EXTRA_OECONF:append:class-nativesdk = " --target-list=${@get_qemu_target_list(d)}" - -PACKAGECONFIG ??= " \ - fdt sdl kvm pie slirp \ - ${@bb.utils.filter('DISTRO_FEATURES', 'alsa pulseaudio xen', d)} \ - ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ - ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)} \ -" -PACKAGECONFIG:class-nativesdk ??= "fdt sdl kvm pie slirp \ - ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ -" -# ppc32 hosts are no longer supported in qemu -COMPATIBLE_HOST:powerpc = "null" diff --git a/meta/recipes-devtools/qemu/qemu_10.0.6.bb b/meta/recipes-devtools/qemu/qemu_10.0.6.bb new file mode 100644 index 0000000000..5d544d8d13 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu_10.0.6.bb @@ -0,0 +1,28 @@ +BBCLASSEXTEND = "nativesdk" + +require qemu.inc + +DEPENDS += "glib-2.0 zlib pixman" + +DEPENDS:append:libc-musl = " libucontext" + +CFLAGS += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', '-DEGL_NO_X11=1', d)}" +LDFLAGS:append:toolchain-clang:x86 = " -latomic" + +RDEPENDS:${PN}-common:class-target += "bash" + +EXTRA_OECONF:append:class-target = " --target-list=${@get_qemu_target_list(d)}" +EXTRA_OECONF:append:class-target:mipsarcho32 = "${@bb.utils.contains('BBEXTENDCURR', 'multilib', ' --disable-capstone', '', d)}" +EXTRA_OECONF:append:class-nativesdk = " --target-list=${@get_qemu_target_list(d)}" + +PACKAGECONFIG ??= " \ + fdt sdl kvm pie slirp \ + ${@bb.utils.filter('DISTRO_FEATURES', 'alsa pulseaudio xen', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ + ${@bb.utils.filter('DISTRO_FEATURES', 'seccomp', d)} \ +" +PACKAGECONFIG:class-nativesdk ??= "fdt sdl kvm pie slirp \ + ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'virglrenderer epoxy', '', d)} \ +" +# ppc32 hosts are no longer supported in qemu +COMPATIBLE_HOST:powerpc = "null" -- cgit v1.2.3-54-g00ecf