From patchwork Sun Jan 9 22:04:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 14155 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org From: "Steve Sakoman" Subject: [OE-core][dunfell 01/12] grub: fix CVE-2020-14372 and CVE-2020-27779 Date: Sun, 9 Jan 2022 12:04:05 -1000 Message-Id: In-Reply-To: References: MIME-Version: 1.0 List-id: To: openembedded-core@lists.openembedded.org From: Marta Rybczynska Fix issues with grub in secure boot mode where an attacker could circumvent secure boot by using acpi and cutmem commands. Also include patches fixing similar issues. Most patches are backported directly from grub. One patch (no-insmod-on-sb.patch) comes from Debian, as the upstream implementation is too complicated to backport. CVE-2020-14372 description (from NVD [1]): A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability. CVE-2020-27779 description (from NVD [2]): A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent SecureBoot protections after proper triage about grub's memory layout. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. [1] https://nvd.nist.gov/vuln/detail/CVE-2020-14372 [2] https://nvd.nist.gov/vuln/detail/CVE-2020-27779 Signed-off-by: Marta Rybczynska Signed-off-by: Steve Sakoman --- .../grub/files/CVE-2020-14372.patch | 76 +++ .../grub/files/CVE-2020-14372_1.patch | 130 ++++++ .../grub/files/CVE-2020-14372_2.patch | 431 ++++++++++++++++++ .../grub/files/CVE-2020-14372_3.patch | 57 +++ .../grub/files/CVE-2020-14372_4.patch | 52 +++ .../grub/files/CVE-2020-14372_5.patch | 158 +++++++ .../grub/files/CVE-2020-27779.patch | 70 +++ .../grub/files/CVE-2020-27779_2.patch | 105 +++++ .../grub/files/CVE-2020-27779_3.patch | 37 ++ .../grub/files/CVE-2020-27779_4.patch | 35 ++ .../grub/files/CVE-2020-27779_5.patch | 62 +++ .../grub/files/CVE-2020-27779_6.patch | 61 +++ .../grub/files/CVE-2020-27779_7.patch | 65 +++ .../grub/files/no-insmod-on-sb.patch | 107 +++++ meta/recipes-bsp/grub/grub2.inc | 14 + 15 files changed, 1460 insertions(+) create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch create mode 100644 meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch create mode 100644 meta/recipes-bsp/grub/files/no-insmod-on-sb.patch diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372.patch new file mode 100644 index 0000000000..08e7666cde --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372.patch @@ -0,0 +1,76 @@ +From 0d237c0b90f0c6d4a3662c569b2371ae3ed69574 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 28 Sep 2020 20:08:41 +0200 +Subject: [PATCH] acpi: Don't register the acpi command when locked down +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The command is not allowed when lockdown is enforced. Otherwise an +attacker can instruct the GRUB to load an SSDT table to overwrite +the kernel lockdown configuration and later load and execute +unsigned code. + +Fixes: CVE-2020-14372 + +Reported-by: Máté Kukri +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=3e8e4c0549240fa209acffceb473e1e509b50c95] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 5 +++++ + grub-core/commands/acpi.c | 15 ++++++++------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 0786427..47ac7ff 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3986,6 +3986,11 @@ Normally, this command will replace the Root System Description Pointer + (RSDP) in the Extended BIOS Data Area to point to the new tables. If the + @option{--no-ebda} option is used, the new tables will be known only to + GRUB, but may be used by GRUB's EFI emulation. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ Otherwise an attacker can instruct the GRUB to load an SSDT table to ++ overwrite the kernel lockdown configuration and later load and execute ++ unsigned code. + @end deffn + + +diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c +index 5a1499a..1215f2a 100644 +--- a/grub-core/commands/acpi.c ++++ b/grub-core/commands/acpi.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_MACHINE_EFI + #include +@@ -775,13 +776,13 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(acpi) + { +- cmd = grub_register_extcmd ("acpi", grub_cmd_acpi, 0, +- N_("[-1|-2] [--exclude=TABLE1,TABLE2|" +- "--load-only=TABLE1,TABLE2] FILE1" +- " [FILE2] [...]"), +- N_("Load host ACPI tables and tables " +- "specified by arguments."), +- options); ++ cmd = grub_register_extcmd_lockdown ("acpi", grub_cmd_acpi, 0, ++ N_("[-1|-2] [--exclude=TABLE1,TABLE2|" ++ "--load-only=TABLE1,TABLE2] FILE1" ++ " [FILE2] [...]"), ++ N_("Load host ACPI tables and tables " ++ "specified by arguments."), ++ options); + } + + GRUB_MOD_FINI(acpi) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch new file mode 100644 index 0000000000..745f335501 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_1.patch @@ -0,0 +1,130 @@ +From fe7a13df6200bda934fcc0246458df249f1ef4f2 Mon Sep 17 00:00:00 2001 +From: Marco A Benatto +Date: Wed, 23 Sep 2020 11:33:33 -0400 +Subject: [PATCH] verifiers: Move verifiers API to kernel image + +Move verifiers API from a module to the kernel image, so it can be +used there as well. There are no functional changes in this patch. + +Signed-off-by: Marco A Benatto +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9e95f45ceeef36fcf93cbfffcf004276883dbc99] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + grub-core/Makefile.am | 1 + + grub-core/Makefile.core.def | 6 +----- + grub-core/kern/main.c | 4 ++++ + grub-core/{commands => kern}/verifiers.c | 8 ++------ + include/grub/verify.h | 9 ++++++--- + 5 files changed, 14 insertions(+), 14 deletions(-) + rename grub-core/{commands => kern}/verifiers.c (97%) + +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 3ea8e7f..375c30d 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -90,6 +90,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/parser.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/partition.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/term.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/time.h ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/verify.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/mm_private.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/net.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/memory.h +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index 474a63e..cff02f2 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -140,6 +140,7 @@ kernel = { + common = kern/rescue_parser.c; + common = kern/rescue_reader.c; + common = kern/term.c; ++ common = kern/verifiers.c; + + noemu = kern/compiler-rt.c; + noemu = kern/mm.c; +@@ -942,11 +943,6 @@ module = { + cppflags = '-I$(srcdir)/lib/posix_wrap'; + }; + +-module = { +- name = verifiers; +- common = commands/verifiers.c; +-}; +- + module = { + name = shim_lock; + common = commands/efi/shim_lock.c; +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 9cad0c4..73967e2 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_MACHINE_PCBIOS + #include +@@ -274,6 +275,9 @@ grub_main (void) + grub_printf ("Welcome to GRUB!\n\n"); + grub_setcolorstate (GRUB_TERM_COLOR_STANDARD); + ++ /* Init verifiers API. */ ++ grub_verifiers_init (); ++ + grub_load_config (); + + grub_boot_time ("Before loading embedded modules."); +diff --git a/grub-core/commands/verifiers.c b/grub-core/kern/verifiers.c +similarity index 97% +rename from grub-core/commands/verifiers.c +rename to grub-core/kern/verifiers.c +index 0dde481..aa3dc7c 100644 +--- a/grub-core/commands/verifiers.c ++++ b/grub-core/kern/verifiers.c +@@ -217,12 +217,8 @@ grub_verify_string (char *str, enum grub_verify_string_type type) + return GRUB_ERR_NONE; + } + +-GRUB_MOD_INIT(verifiers) ++void ++grub_verifiers_init (void) + { + grub_file_filter_register (GRUB_FILE_FILTER_VERIFY, grub_verifiers_open); + } +- +-GRUB_MOD_FINI(verifiers) +-{ +- grub_file_filter_unregister (GRUB_FILE_FILTER_VERIFY); +-} +diff --git a/include/grub/verify.h b/include/grub/verify.h +index ea04914..cd129c3 100644 +--- a/include/grub/verify.h ++++ b/include/grub/verify.h +@@ -64,7 +64,10 @@ struct grub_file_verifier + grub_err_t (*verify_string) (char *str, enum grub_verify_string_type type); + }; + +-extern struct grub_file_verifier *grub_file_verifiers; ++extern struct grub_file_verifier *EXPORT_VAR (grub_file_verifiers); ++ ++extern void ++grub_verifiers_init (void); + + static inline void + grub_verifier_register (struct grub_file_verifier *ver) +@@ -78,7 +81,7 @@ grub_verifier_unregister (struct grub_file_verifier *ver) + grub_list_remove (GRUB_AS_LIST (ver)); + } + +-grub_err_t +-grub_verify_string (char *str, enum grub_verify_string_type type); ++extern grub_err_t ++EXPORT_FUNC (grub_verify_string) (char *str, enum grub_verify_string_type type); + + #endif /* ! GRUB_VERIFY_HEADER */ diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch new file mode 100644 index 0000000000..a98b5d0455 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_2.patch @@ -0,0 +1,431 @@ +From d8aac4517fef0f0188a60a2a8ff9cafdd9c7ca42 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 28 Sep 2020 20:08:02 +0200 +Subject: [PATCH] kern: Add lockdown support + +When the GRUB starts on a secure boot platform, some commands can be +used to subvert the protections provided by the verification mechanism and +could lead to booting untrusted system. + +To prevent that situation, allow GRUB to be locked down. That way the code +may check if GRUB has been locked down and further restrict the commands +that are registered or what subset of their functionality could be used. + +The lockdown support adds the following components: + +* The grub_lockdown() function which can be used to lockdown GRUB if, + e.g., UEFI Secure Boot is enabled. + +* The grub_is_lockdown() function which can be used to check if the GRUB + was locked down. + +* A verifier that flags OS kernels, the GRUB modules, Device Trees and ACPI + tables as GRUB_VERIFY_FLAGS_DEFER_AUTH to defer verification to other + verifiers. These files are only successfully verified if another registered + verifier returns success. Otherwise, the whole verification process fails. + + For example, PE/COFF binaries verification can be done by the shim_lock + verifier which validates the signatures using the shim_lock protocol. + However, the verification is not deferred directly to the shim_lock verifier. + The shim_lock verifier is hooked into the verification process instead. + +* A set of grub_{command,extcmd}_lockdown functions that can be used by + code registering command handlers, to only register unsafe commands if + the GRUB has not been locked down. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=578c95298bcc46e0296f4c786db64c2ff26ce2cc] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + conf/Makefile.common | 2 + + docs/grub-dev.texi | 27 +++++++++++++ + docs/grub.texi | 8 ++++ + grub-core/Makefile.am | 5 ++- + grub-core/Makefile.core.def | 1 + + grub-core/commands/extcmd.c | 23 +++++++++++ + grub-core/kern/command.c | 24 +++++++++++ + grub-core/kern/lockdown.c | 80 +++++++++++++++++++++++++++++++++++++ + include/grub/command.h | 5 +++ + include/grub/extcmd.h | 7 ++++ + include/grub/lockdown.h | 44 ++++++++++++++++++++ + 11 files changed, 225 insertions(+), 1 deletion(-) + create mode 100644 grub-core/kern/lockdown.c + create mode 100644 include/grub/lockdown.h + +diff --git a/conf/Makefile.common b/conf/Makefile.common +index 6cd71cb..2a1a886 100644 +--- a/conf/Makefile.common ++++ b/conf/Makefile.common +@@ -84,7 +84,9 @@ CPPFLAGS_PARTTOOL_LIST = -Dgrub_parttool_register=PARTTOOL_LIST_MARKER + CPPFLAGS_TERMINAL_LIST = '-Dgrub_term_register_input(...)=INPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_TERMINAL_LIST += '-Dgrub_term_register_output(...)=OUTPUT_TERMINAL_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST = '-Dgrub_register_command(...)=COMMAND_LIST_MARKER(__VA_ARGS__)' ++CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_lockdown(...)=COMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd(...)=EXTCOMMAND_LIST_MARKER(__VA_ARGS__)' ++CPPFLAGS_COMMAND_LIST += '-Dgrub_register_extcmd_lockdown(...)=EXTCOMMAND_LOCKDOWN_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_COMMAND_LIST += '-Dgrub_register_command_p1(...)=P1COMMAND_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_FDT_LIST := '-Dgrub_fdtbus_register(...)=FDT_DRIVER_LIST_MARKER(__VA_ARGS__)' + CPPFLAGS_MARKER = $(CPPFLAGS_FS_LIST) $(CPPFLAGS_VIDEO_LIST) \ +diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi +index ee389fd..635ec72 100644 +--- a/docs/grub-dev.texi ++++ b/docs/grub-dev.texi +@@ -86,6 +86,7 @@ This edition documents version @value{VERSION}. + * PFF2 Font File Format:: + * Graphical Menu Software Design:: + * Verifiers framework:: ++* Lockdown framework:: + * Copying This Manual:: Copying This Manual + * Index:: + @end menu +@@ -2086,6 +2087,32 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just + the context. If you return no error during any of @samp{init}, @samp{write} and + @samp{fini} then the file is considered as having succeded verification. + ++@node Lockdown framework ++@chapter Lockdown framework ++ ++The GRUB can be locked down, which is a restricted mode where some operations ++are not allowed. For instance, some commands cannot be used when the GRUB is ++locked down. ++ ++The function ++@code{grub_lockdown()} is used to lockdown GRUB and the function ++@code{grub_is_lockdown()} function can be used to check whether lockdown is ++enabled or not. When enabled, the function returns @samp{GRUB_LOCKDOWN_ENABLED} ++and @samp{GRUB_LOCKDOWN_DISABLED} when is not enabled. ++ ++The following functions can be used to register the commands that can only be ++used when lockdown is disabled: ++ ++@itemize ++ ++@item @code{grub_cmd_lockdown()} registers command which should not run when the ++GRUB is in lockdown mode. ++ ++@item @code{grub_cmd_lockdown()} registers extended command which should not run ++when the GRUB is in lockdown mode. ++ ++@end itemize ++ + @node Copying This Manual + @appendix Copying This Manual + +diff --git a/docs/grub.texi b/docs/grub.texi +index 8779507..d778bfb 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5581,6 +5581,7 @@ environment variables and commands are listed in the same order. + * Using digital signatures:: Booting digitally signed code + * UEFI secure boot and shim:: Booting digitally signed PE files + * Measured Boot:: Measuring boot components ++* Lockdown:: Lockdown when booting on a secure setup + @end menu + + @node Authentication and authorisation +@@ -5794,6 +5795,13 @@ into @file{core.img} in order to avoid a potential gap in measurement between + + Measured boot is currently only supported on EFI platforms. + ++@node Lockdown ++@section Lockdown when booting on a secure setup ++ ++The GRUB can be locked down when booted on a secure boot environment, for example ++if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will ++be restricted and some operations/commands cannot be executed. ++ + @node Platform limitations + @chapter Platform limitations + +diff --git a/grub-core/Makefile.am b/grub-core/Makefile.am +index 375c30d..3096241 100644 +--- a/grub-core/Makefile.am ++++ b/grub-core/Makefile.am +@@ -79,6 +79,7 @@ KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/fs.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/i18n.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/kernel.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/list.h ++KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/lockdown.h + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/misc.h + if COND_emu + KERNEL_HEADER_FILES += $(top_srcdir)/include/grub/compiler-rt-emu.h +@@ -376,8 +377,10 @@ command.lst: $(MARKER_FILES) + b=`basename $$pp .marker`; \ + sed -n \ + -e "/EXTCOMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ ++ -e "/EXTCOMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ + -e "/P1COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/*\1: $$b/;p;}" \ +- -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \ ++ -e "/COMMAND_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" \ ++ -e "/COMMAND_LOCKDOWN_LIST_MARKER *( *\"/{s/.*( *\"\([^\"]*\)\".*/\1: $$b/;p;}" $$pp; \ + done) | sort -u > $@ + platform_DATA += command.lst + CLEANFILES += command.lst +diff --git a/grub-core/Makefile.core.def b/grub-core/Makefile.core.def +index cff02f2..651ea2a 100644 +--- a/grub-core/Makefile.core.def ++++ b/grub-core/Makefile.core.def +@@ -204,6 +204,7 @@ kernel = { + efi = term/efi/console.c; + efi = kern/acpi.c; + efi = kern/efi/acpi.c; ++ efi = kern/lockdown.c; + i386_coreboot = kern/i386/pc/acpi.c; + i386_multiboot = kern/i386/pc/acpi.c; + i386_coreboot = kern/acpi.c; +diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c +index 69574e2..90a5ca2 100644 +--- a/grub-core/commands/extcmd.c ++++ b/grub-core/commands/extcmd.c +@@ -19,6 +19,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -110,6 +111,28 @@ grub_register_extcmd (const char *name, grub_extcmd_func_t func, + summary, description, parser, 1); + } + ++static grub_err_t ++grub_extcmd_lockdown (grub_extcmd_context_t ctxt __attribute__ ((unused)), ++ int argc __attribute__ ((unused)), ++ char **argv __attribute__ ((unused))) ++{ ++ return grub_error (GRUB_ERR_ACCESS_DENIED, ++ N_("%s: the command is not allowed when lockdown is enforced"), ++ ctxt->extcmd->cmd->name); ++} ++ ++grub_extcmd_t ++grub_register_extcmd_lockdown (const char *name, grub_extcmd_func_t func, ++ grub_command_flags_t flags, const char *summary, ++ const char *description, ++ const struct grub_arg_option *parser) ++{ ++ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED) ++ func = grub_extcmd_lockdown; ++ ++ return grub_register_extcmd (name, func, flags, summary, description, parser); ++} ++ + void + grub_unregister_extcmd (grub_extcmd_t ext) + { +diff --git a/grub-core/kern/command.c b/grub-core/kern/command.c +index acd7218..4aabcd4 100644 +--- a/grub-core/kern/command.c ++++ b/grub-core/kern/command.c +@@ -17,6 +17,7 @@ + * along with GRUB. If not, see . + */ + ++#include + #include + #include + +@@ -77,6 +78,29 @@ grub_register_command_prio (const char *name, + return cmd; + } + ++static grub_err_t ++grub_cmd_lockdown (grub_command_t cmd __attribute__ ((unused)), ++ int argc __attribute__ ((unused)), ++ char **argv __attribute__ ((unused))) ++ ++{ ++ return grub_error (GRUB_ERR_ACCESS_DENIED, ++ N_("%s: the command is not allowed when lockdown is enforced"), ++ cmd->name); ++} ++ ++grub_command_t ++grub_register_command_lockdown (const char *name, ++ grub_command_func_t func, ++ const char *summary, ++ const char *description) ++{ ++ if (grub_is_lockdown () == GRUB_LOCKDOWN_ENABLED) ++ func = grub_cmd_lockdown; ++ ++ return grub_register_command_prio (name, func, summary, description, 0); ++} ++ + void + grub_unregister_command (grub_command_t cmd) + { +diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c +new file mode 100644 +index 0000000..1e56c0b +--- /dev/null ++++ b/grub-core/kern/lockdown.c +@@ -0,0 +1,80 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ * ++ */ ++ ++#include ++#include ++#include ++#include ++ ++static int lockdown = GRUB_LOCKDOWN_DISABLED; ++ ++static grub_err_t ++lockdown_verifier_init (grub_file_t io __attribute__ ((unused)), ++ enum grub_file_type type, ++ void **context __attribute__ ((unused)), ++ enum grub_verify_flags *flags) ++{ ++ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION; ++ ++ switch (type & GRUB_FILE_TYPE_MASK) ++ { ++ case GRUB_FILE_TYPE_GRUB_MODULE: ++ case GRUB_FILE_TYPE_LINUX_KERNEL: ++ case GRUB_FILE_TYPE_MULTIBOOT_KERNEL: ++ case GRUB_FILE_TYPE_XEN_HYPERVISOR: ++ case GRUB_FILE_TYPE_BSD_KERNEL: ++ case GRUB_FILE_TYPE_XNU_KERNEL: ++ case GRUB_FILE_TYPE_PLAN9_KERNEL: ++ case GRUB_FILE_TYPE_NTLDR: ++ case GRUB_FILE_TYPE_TRUECRYPT: ++ case GRUB_FILE_TYPE_FREEDOS: ++ case GRUB_FILE_TYPE_PXECHAINLOADER: ++ case GRUB_FILE_TYPE_PCCHAINLOADER: ++ case GRUB_FILE_TYPE_COREBOOT_CHAINLOADER: ++ case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE: ++ case GRUB_FILE_TYPE_ACPI_TABLE: ++ case GRUB_FILE_TYPE_DEVICE_TREE_IMAGE: ++ *flags = GRUB_VERIFY_FLAGS_DEFER_AUTH; ++ ++ /* Fall through. */ ++ ++ default: ++ return GRUB_ERR_NONE; ++ } ++} ++ ++struct grub_file_verifier lockdown_verifier = ++ { ++ .name = "lockdown_verifier", ++ .init = lockdown_verifier_init, ++ }; ++ ++void ++grub_lockdown (void) ++{ ++ lockdown = GRUB_LOCKDOWN_ENABLED; ++ ++ grub_verifier_register (&lockdown_verifier); ++} ++ ++int ++grub_is_lockdown (void) ++{ ++ return lockdown; ++} +diff --git a/include/grub/command.h b/include/grub/command.h +index eee4e84..2a6f7f8 100644 +--- a/include/grub/command.h ++++ b/include/grub/command.h +@@ -86,6 +86,11 @@ EXPORT_FUNC(grub_register_command_prio) (const char *name, + const char *summary, + const char *description, + int prio); ++grub_command_t ++EXPORT_FUNC(grub_register_command_lockdown) (const char *name, ++ grub_command_func_t func, ++ const char *summary, ++ const char *description); + void EXPORT_FUNC(grub_unregister_command) (grub_command_t cmd); + + static inline grub_command_t +diff --git a/include/grub/extcmd.h b/include/grub/extcmd.h +index 19fe592..fe9248b 100644 +--- a/include/grub/extcmd.h ++++ b/include/grub/extcmd.h +@@ -62,6 +62,13 @@ grub_extcmd_t EXPORT_FUNC(grub_register_extcmd) (const char *name, + const char *description, + const struct grub_arg_option *parser); + ++grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_lockdown) (const char *name, ++ grub_extcmd_func_t func, ++ grub_command_flags_t flags, ++ const char *summary, ++ const char *description, ++ const struct grub_arg_option *parser); ++ + grub_extcmd_t EXPORT_FUNC(grub_register_extcmd_prio) (const char *name, + grub_extcmd_func_t func, + grub_command_flags_t flags, +diff --git a/include/grub/lockdown.h b/include/grub/lockdown.h +new file mode 100644 +index 0000000..40531fa +--- /dev/null ++++ b/include/grub/lockdown.h +@@ -0,0 +1,44 @@ ++/* ++ * GRUB -- GRand Unified Bootloader ++ * Copyright (C) 2020 Free Software Foundation, Inc. ++ * ++ * GRUB is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * GRUB is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with GRUB. If not, see . ++ */ ++ ++#ifndef GRUB_LOCKDOWN_H ++#define GRUB_LOCKDOWN_H 1 ++ ++#include ++ ++#define GRUB_LOCKDOWN_DISABLED 0 ++#define GRUB_LOCKDOWN_ENABLED 1 ++ ++#ifdef GRUB_MACHINE_EFI ++extern void ++EXPORT_FUNC (grub_lockdown) (void); ++extern int ++EXPORT_FUNC (grub_is_lockdown) (void); ++#else ++static inline void ++grub_lockdown (void) ++{ ++} ++ ++static inline int ++grub_is_lockdown (void) ++{ ++ return GRUB_LOCKDOWN_DISABLED; ++} ++#endif ++#endif /* ! GRUB_LOCKDOWN_H */ diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch new file mode 100644 index 0000000000..93fdd2cb1a --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_3.patch @@ -0,0 +1,57 @@ +From bfb9c44298aa202c176fef8dc5ea48f9b0e76e5e Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Tue, 2 Feb 2021 19:59:48 +0100 +Subject: [PATCH] kern/lockdown: Set a variable if the GRUB is locked down + +It may be useful for scripts to determine whether the GRUB is locked +down or not. Add the lockdown variable which is set to "y" when the GRUB +is locked down. + +Suggested-by: Dimitri John Ledkov +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d90367471779c240e002e62edfb6b31fc85b4908] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 3 +++ + grub-core/kern/lockdown.c | 4 ++++ + 2 files changed, 7 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index d778bfb..5e6cace 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5802,6 +5802,9 @@ The GRUB can be locked down when booted on a secure boot environment, for exampl + if the UEFI secure boot is enabled. On a locked down configuration, the GRUB will + be restricted and some operations/commands cannot be executed. + ++The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down. ++Otherwise it does not exit. ++ + @node Platform limitations + @chapter Platform limitations + +diff --git a/grub-core/kern/lockdown.c b/grub-core/kern/lockdown.c +index 1e56c0b..0bc70fd 100644 +--- a/grub-core/kern/lockdown.c ++++ b/grub-core/kern/lockdown.c +@@ -18,6 +18,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -71,6 +72,9 @@ grub_lockdown (void) + lockdown = GRUB_LOCKDOWN_ENABLED; + + grub_verifier_register (&lockdown_verifier); ++ ++ grub_env_set ("lockdown", "y"); ++ grub_env_export ("lockdown"); + } + + int diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch new file mode 100644 index 0000000000..ac509b63c7 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_4.patch @@ -0,0 +1,52 @@ +From 0d809c0979ced9db4d0e500b3e812bba95e52972 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 28 Sep 2020 20:08:29 +0200 +Subject: [PATCH] efi: Lockdown the GRUB when the UEFI Secure Boot is enabled + +If the UEFI Secure Boot is enabled then the GRUB must be locked down +to prevent executing code that can potentially be used to subvert its +verification mechanisms. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=98b00a403cbf2ba6833d1ac0499871b27a08eb77] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/efi/init.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c +index 3dfdf2d..db84d82 100644 +--- a/grub-core/kern/efi/init.c ++++ b/grub-core/kern/efi/init.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -39,6 +40,20 @@ grub_efi_init (void) + /* Initialize the memory management system. */ + grub_efi_mm_init (); + ++ /* ++ * Lockdown the GRUB and register the shim_lock verifier ++ * if the UEFI Secure Boot is enabled. ++ */ ++ if (grub_efi_secure_boot ()) ++ { ++ grub_lockdown (); ++ /* NOTE: Our version does not have the shim_lock_verifier, ++ * need to update below if added */ ++#if 0 ++ grub_shim_lock_verifier_setup (); ++#endif ++ } ++ + efi_call_4 (grub_efi_system_table->boot_services->set_watchdog_timer, + 0, 0, 0, NULL); + diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch b/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch new file mode 100644 index 0000000000..12ec4e1c17 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-14372_5.patch @@ -0,0 +1,158 @@ +From 1ad728b08ba2a21573e5f81a565114f74ca33988 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 28 Sep 2020 20:08:33 +0200 +Subject: [PATCH] efi: Use grub_is_lockdown() instead of hardcoding a disabled + modules list + +Now the GRUB can check if it has been locked down and this can be used to +prevent executing commands that can be utilized to circumvent the UEFI +Secure Boot mechanisms. So, instead of hardcoding a list of modules that +have to be disabled, prevent the usage of commands that can be dangerous. + +This not only allows the commands to be disabled on other platforms, but +also properly separate the concerns. Since the shim_lock verifier logic +should be only about preventing to run untrusted binaries and not about +defining these kind of policies. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=8f73052885892bc0dbc01e297f79d7cf4925e491] +CVE: CVE-2020-14372 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 10 ++++++++++ + grub-core/commands/i386/wrmsr.c | 5 +++-- + grub-core/commands/iorw.c | 19 ++++++++++--------- + grub-core/commands/memrw.c | 19 ++++++++++--------- + 4 files changed, 33 insertions(+), 20 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 5e6cace..0786427 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -5256,6 +5256,9 @@ only applies to the particular cpu/core/thread that runs the command. + Also, if you specify a reserved or unimplemented MSR address, it will + cause a general protection exception (which is not currently being handled) + and the system will reboot. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This is done to prevent subverting various security mechanisms. + @end deffn + + @node xen_hypervisor +@@ -5758,6 +5761,13 @@ security reasons. All above mentioned requirements are enforced by the + shim_lock module. And itself it is a persistent module which means that + it cannot be unloaded if it was loaded into the memory. + ++All GRUB modules not stored in the @file{core.img}, OS kernels, ACPI tables, ++Device Trees, etc. have to be signed, e.g, using PGP. Additionally, the commands ++that can be used to subvert the UEFI secure boot mechanism, such as @command{iorw} ++and @command{memrw} will not be available when the UEFI secure boot is enabled. ++This is done for security reasons and are enforced by the GRUB Lockdown mechanism ++(@pxref{Lockdown}). ++ + @node Measured Boot + @section Measuring boot components + +diff --git a/grub-core/commands/i386/wrmsr.c b/grub-core/commands/i386/wrmsr.c +index 9c5e510..56a29c2 100644 +--- a/grub-core/commands/i386/wrmsr.c ++++ b/grub-core/commands/i386/wrmsr.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -83,8 +84,8 @@ grub_cmd_msr_write (grub_command_t cmd __attribute__ ((unused)), int argc, char + + GRUB_MOD_INIT(wrmsr) + { +- cmd_write = grub_register_command ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"), +- N_("Write a value to a CPU model specific register.")); ++ cmd_write = grub_register_command_lockdown ("wrmsr", grub_cmd_msr_write, N_("ADDR VALUE"), ++ N_("Write a value to a CPU model specific register.")); + } + + GRUB_MOD_FINI(wrmsr) +diff --git a/grub-core/commands/iorw.c b/grub-core/commands/iorw.c +index a0c164e..584baec 100644 +--- a/grub-core/commands/iorw.c ++++ b/grub-core/commands/iorw.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -131,17 +132,17 @@ GRUB_MOD_INIT(memrw) + N_("PORT"), N_("Read 32-bit value from PORT."), + options); + cmd_write_byte = +- grub_register_command ("outb", grub_cmd_write, +- N_("PORT VALUE [MASK]"), +- N_("Write 8-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outb", grub_cmd_write, ++ N_("PORT VALUE [MASK]"), ++ N_("Write 8-bit VALUE to PORT.")); + cmd_write_word = +- grub_register_command ("outw", grub_cmd_write, +- N_("PORT VALUE [MASK]"), +- N_("Write 16-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outw", grub_cmd_write, ++ N_("PORT VALUE [MASK]"), ++ N_("Write 16-bit VALUE to PORT.")); + cmd_write_dword = +- grub_register_command ("outl", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 32-bit VALUE to PORT.")); ++ grub_register_command_lockdown ("outl", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 32-bit VALUE to PORT.")); + } + + GRUB_MOD_FINI(memrw) +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index 98769ea..d401a6d 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -133,17 +134,17 @@ GRUB_MOD_INIT(memrw) + N_("ADDR"), N_("Read 32-bit value from ADDR."), + options); + cmd_write_byte = +- grub_register_command ("write_byte", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 8-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_byte", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 8-bit VALUE to ADDR.")); + cmd_write_word = +- grub_register_command ("write_word", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 16-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_word", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 16-bit VALUE to ADDR.")); + cmd_write_dword = +- grub_register_command ("write_dword", grub_cmd_write, +- N_("ADDR VALUE [MASK]"), +- N_("Write 32-bit VALUE to ADDR.")); ++ grub_register_command_lockdown ("write_dword", grub_cmd_write, ++ N_("ADDR VALUE [MASK]"), ++ N_("Write 32-bit VALUE to ADDR.")); + } + + GRUB_MOD_FINI(memrw) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779.patch new file mode 100644 index 0000000000..c82423b8af --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779.patch @@ -0,0 +1,70 @@ +From 584263eca1546e5cab69ba6fe7b4b07df2630a21 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 14 Oct 2020 16:33:42 +0200 +Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown + is enforced + +The cutmem and badram commands can be used to remove EFI memory regions +and potentially disable the UEFI Secure Boot. Prevent the commands to be +registered if the GRUB is locked down. + +Fixes: CVE-2020-27779 + +Reported-by: Teddy Reed +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 4 ++++ + grub-core/mmap/mmap.c | 13 +++++++------ + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 47ac7ff..a1aaee6 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4051,6 +4051,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns + that are often result of memory damage, due to physical distribution of memory + cells. + ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This prevents removing EFI memory regions to potentially subvert the ++ security mechanisms provided by the UEFI secure boot. ++ + @node blocklist + @subsection blocklist + +diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c +index 57b4e9a..7ebf32e 100644 +--- a/grub-core/mmap/mmap.c ++++ b/grub-core/mmap/mmap.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut; + + GRUB_MOD_INIT(mmap) + { +- cmd = grub_register_command ("badram", grub_cmd_badram, +- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), +- N_("Declare memory regions as faulty (badram).")); +- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem, +- N_("FROM[K|M|G] TO[K|M|G]"), +- N_("Remove any memory regions in specified range.")); ++ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram, ++ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), ++ N_("Declare memory regions as faulty (badram).")); ++ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem, ++ N_("FROM[K|M|G] TO[K|M|G]"), ++ N_("Remove any memory regions in specified range.")); + + } + diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch new file mode 100644 index 0000000000..e33c96a05b --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_2.patch @@ -0,0 +1,105 @@ +From 4ff1dfdf8c4c71bf4b0dd0488d9fa40ff2617f41 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 24 Feb 2021 09:00:05 +0100 +Subject: [PATCH] commands: Restrict commands that can load BIOS or DT blobs + when locked down + +There are some more commands that should be restricted when the GRUB is +locked down. Following is the list of commands and reasons to restrict: + + * fakebios: creates BIOS-like structures for backward compatibility with + existing OSes. This should not be allowed when locked down. + + * loadbios: reads a BIOS dump from storage and loads it. This action + should not be allowed when locked down. + + * devicetree: loads a Device Tree blob and passes it to the OS. It replaces + any Device Tree provided by the firmware. This also should + not be allowed when locked down. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=468a5699b249fe6816b4e7e86c5dc9d325c9b09e] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 3 +++ + grub-core/commands/efi/loadbios.c | 16 ++++++++-------- + grub-core/loader/arm/linux.c | 6 +++--- + grub-core/loader/efi/fdt.c | 4 ++-- + 4 files changed, 16 insertions(+), 13 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index a1aaee6..ccf1908 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -4236,6 +4236,9 @@ Load a device tree blob (.dtb) from a filesystem, for later use by a Linux + kernel. Does not perform merging with any device tree supplied by firmware, + but rather replaces it completely. + @ref{GNU/Linux}. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This is done to prevent subverting various security mechanisms. + @end deffn + + @node distrust +diff --git a/grub-core/commands/efi/loadbios.c b/grub-core/commands/efi/loadbios.c +index d41d521..5c7725f 100644 +--- a/grub-core/commands/efi/loadbios.c ++++ b/grub-core/commands/efi/loadbios.c +@@ -205,14 +205,14 @@ static grub_command_t cmd_fakebios, cmd_loadbios; + + GRUB_MOD_INIT(loadbios) + { +- cmd_fakebios = grub_register_command ("fakebios", grub_cmd_fakebios, +- 0, N_("Create BIOS-like structures for" +- " backward compatibility with" +- " existing OS.")); +- +- cmd_loadbios = grub_register_command ("loadbios", grub_cmd_loadbios, +- N_("BIOS_DUMP [INT10_DUMP]"), +- N_("Load BIOS dump.")); ++ cmd_fakebios = grub_register_command_lockdown ("fakebios", grub_cmd_fakebios, ++ 0, N_("Create BIOS-like structures for" ++ " backward compatibility with" ++ " existing OS.")); ++ ++ cmd_loadbios = grub_register_command_lockdown ("loadbios", grub_cmd_loadbios, ++ N_("BIOS_DUMP [INT10_DUMP]"), ++ N_("Load BIOS dump.")); + } + + GRUB_MOD_FINI(loadbios) +diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c +index d70c174..ed23dc7 100644 +--- a/grub-core/loader/arm/linux.c ++++ b/grub-core/loader/arm/linux.c +@@ -493,9 +493,9 @@ GRUB_MOD_INIT (linux) + 0, N_("Load Linux.")); + cmd_initrd = grub_register_command ("initrd", grub_cmd_initrd, + 0, N_("Load initrd.")); +- cmd_devicetree = grub_register_command ("devicetree", grub_cmd_devicetree, +- /* TRANSLATORS: DTB stands for device tree blob. */ +- 0, N_("Load DTB file.")); ++ cmd_devicetree = grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, ++ /* TRANSLATORS: DTB stands for device tree blob. */ ++ 0, N_("Load DTB file.")); + my_mod = mod; + current_fdt = (const void *) grub_arm_firmware_get_boot_data (); + machine_type = grub_arm_firmware_get_machine_type (); +diff --git a/grub-core/loader/efi/fdt.c b/grub-core/loader/efi/fdt.c +index ee9c559..003d07c 100644 +--- a/grub-core/loader/efi/fdt.c ++++ b/grub-core/loader/efi/fdt.c +@@ -165,8 +165,8 @@ static grub_command_t cmd_devicetree; + GRUB_MOD_INIT (fdt) + { + cmd_devicetree = +- grub_register_command ("devicetree", grub_cmd_devicetree, 0, +- N_("Load DTB file.")); ++ grub_register_command_lockdown ("devicetree", grub_cmd_devicetree, 0, ++ N_("Load DTB file.")); + } + + GRUB_MOD_FINI (fdt) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch new file mode 100644 index 0000000000..f9a6a73ebc --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_3.patch @@ -0,0 +1,37 @@ +From e4f5c16f76e137b3beb6b61a6d2435e54fcb495c Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 24 Feb 2021 22:59:59 +0100 +Subject: [PATCH] commands/setpci: Restrict setpci command when locked down + +This command can set PCI devices register values, which makes it dangerous +in a locked down configuration. Restrict it so can't be used on this setup. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=58b77d4069823b44c5fa916fa8ddfc9c4cd51e02] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + grub-core/commands/setpci.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/setpci.c b/grub-core/commands/setpci.c +index d5bc97d..fa2ba7d 100644 +--- a/grub-core/commands/setpci.c ++++ b/grub-core/commands/setpci.c +@@ -329,10 +329,10 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(setpci) + { +- cmd = grub_register_extcmd ("setpci", grub_cmd_setpci, 0, +- N_("[-s POSITION] [-d DEVICE] [-v VAR] " +- "REGISTER[=VALUE[:MASK]]"), +- N_("Manipulate PCI devices."), options); ++ cmd = grub_register_extcmd_lockdown ("setpci", grub_cmd_setpci, 0, ++ N_("[-s POSITION] [-d DEVICE] [-v VAR] " ++ "REGISTER[=VALUE[:MASK]]"), ++ N_("Manipulate PCI devices."), options); + } + + GRUB_MOD_FINI(setpci) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch new file mode 100644 index 0000000000..a756f8d1cf --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_4.patch @@ -0,0 +1,35 @@ +From 7949671de268ba3116d113778e5d770574e9f9e3 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 24 Feb 2021 12:59:29 +0100 +Subject: [PATCH] commands/hdparm: Restrict hdparm command when locked down + +The command can be used to get/set ATA disk parameters. Some of these can +be dangerous since change the disk behavior. Restrict it when locked down. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5c97492a29c6063567b65ed1a069f5e6f4e211f0] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + grub-core/commands/hdparm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/hdparm.c b/grub-core/commands/hdparm.c +index d3fa966..2e2319e 100644 +--- a/grub-core/commands/hdparm.c ++++ b/grub-core/commands/hdparm.c +@@ -436,9 +436,9 @@ static grub_extcmd_t cmd; + + GRUB_MOD_INIT(hdparm) + { +- cmd = grub_register_extcmd ("hdparm", grub_cmd_hdparm, 0, +- N_("[OPTIONS] DISK"), +- N_("Get/set ATA disk parameters."), options); ++ cmd = grub_register_extcmd_lockdown ("hdparm", grub_cmd_hdparm, 0, ++ N_("[OPTIONS] DISK"), ++ N_("Get/set ATA disk parameters."), options); + } + + GRUB_MOD_FINI(hdparm) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch new file mode 100644 index 0000000000..b52273ff50 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_5.patch @@ -0,0 +1,62 @@ +From 6993cce7c3a9d15e6573845f455d2f0de424a717 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 24 Feb 2021 15:03:26 +0100 +Subject: [PATCH] gdb: Restrict GDB access when locked down + +The gdbstub* commands allow to start and control a GDB stub running on +local host that can be used to connect from a remote debugger. Restrict +this functionality when the GRUB is locked down. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=508270838998f151a82e9c13e7cb8a470a2dc23d] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + grub-core/gdb/gdb.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/grub-core/gdb/gdb.c b/grub-core/gdb/gdb.c +index 847a1e1..1818cb6 100644 +--- a/grub-core/gdb/gdb.c ++++ b/grub-core/gdb/gdb.c +@@ -75,20 +75,24 @@ static grub_command_t cmd, cmd_stop, cmd_break; + GRUB_MOD_INIT (gdb) + { + grub_gdb_idtinit (); +- cmd = grub_register_command ("gdbstub", grub_cmd_gdbstub, +- N_("PORT"), +- /* TRANSLATORS: GDB stub is a small part of +- GDB functionality running on local host +- which allows remote debugger to +- connect to it. */ +- N_("Start GDB stub on given port")); +- cmd_break = grub_register_command ("gdbstub_break", grub_cmd_gdb_break, +- /* TRANSLATORS: this refers to triggering +- a breakpoint so that the user will land +- into GDB. */ +- 0, N_("Break into GDB")); +- cmd_stop = grub_register_command ("gdbstub_stop", grub_cmd_gdbstop, +- 0, N_("Stop GDB stub")); ++ cmd = grub_register_command_lockdown ("gdbstub", grub_cmd_gdbstub, ++ N_("PORT"), ++ /* ++ * TRANSLATORS: GDB stub is a small part of ++ * GDB functionality running on local host ++ * which allows remote debugger to ++ * connect to it. ++ */ ++ N_("Start GDB stub on given port")); ++ cmd_break = grub_register_command_lockdown ("gdbstub_break", grub_cmd_gdb_break, ++ /* ++ * TRANSLATORS: this refers to triggering ++ * a breakpoint so that the user will land ++ * into GDB. ++ */ ++ 0, N_("Break into GDB")); ++ cmd_stop = grub_register_command_lockdown ("gdbstub_stop", grub_cmd_gdbstop, ++ 0, N_("Stop GDB stub")); + } + + GRUB_MOD_FINI (gdb) diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch new file mode 100644 index 0000000000..474826ade5 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_6.patch @@ -0,0 +1,61 @@ +From 73f214761cff76a18a2a867976bdd3a9adb00b67 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Wed, 24 Feb 2021 14:44:38 +0100 +Subject: [PATCH] loader/xnu: Don't allow loading extension and packages when + locked down + +The shim_lock verifier validates the XNU kernels but no its extensions +and packages. Prevent these to be loaded when the GRUB is locked down. + +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Daniel Kiper + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c5565135f12400a925ee901b25984e7af4442f5] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + grub-core/loader/xnu.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c +index 77d7060..07232d2 100644 +--- a/grub-core/loader/xnu.c ++++ b/grub-core/loader/xnu.c +@@ -1482,20 +1482,23 @@ GRUB_MOD_INIT(xnu) + N_("Load XNU image.")); + cmd_kernel64 = grub_register_command ("xnu_kernel64", grub_cmd_xnu_kernel64, + 0, N_("Load 64-bit XNU image.")); +- cmd_mkext = grub_register_command ("xnu_mkext", grub_cmd_xnu_mkext, 0, +- N_("Load XNU extension package.")); +- cmd_kext = grub_register_command ("xnu_kext", grub_cmd_xnu_kext, 0, +- N_("Load XNU extension.")); +- cmd_kextdir = grub_register_command ("xnu_kextdir", grub_cmd_xnu_kextdir, +- /* TRANSLATORS: OSBundleRequired is a +- variable name in xnu extensions +- manifests. It behaves mostly like +- GNU/Linux runlevels. +- */ +- N_("DIRECTORY [OSBundleRequired]"), +- /* TRANSLATORS: There are many extensions +- in extension directory. */ +- N_("Load XNU extension directory.")); ++ cmd_mkext = grub_register_command_lockdown ("xnu_mkext", grub_cmd_xnu_mkext, 0, ++ N_("Load XNU extension package.")); ++ cmd_kext = grub_register_command_lockdown ("xnu_kext", grub_cmd_xnu_kext, 0, ++ N_("Load XNU extension.")); ++ cmd_kextdir = grub_register_command_lockdown ("xnu_kextdir", grub_cmd_xnu_kextdir, ++ /* ++ * TRANSLATORS: OSBundleRequired is ++ * a variable name in xnu extensions ++ * manifests. It behaves mostly like ++ * GNU/Linux runlevels. ++ */ ++ N_("DIRECTORY [OSBundleRequired]"), ++ /* ++ * TRANSLATORS: There are many extensions ++ * in extension directory. ++ */ ++ N_("Load XNU extension directory.")); + cmd_ramdisk = grub_register_command ("xnu_ramdisk", grub_cmd_xnu_ramdisk, 0, + /* TRANSLATORS: ramdisk here isn't identifier. It can be translated. */ + N_("Load XNU ramdisk. " diff --git a/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch b/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch new file mode 100644 index 0000000000..e5d372a2b1 --- /dev/null +++ b/meta/recipes-bsp/grub/files/CVE-2020-27779_7.patch @@ -0,0 +1,65 @@ +From dcc5a434e59f721b03cc809db0375a24aa2ac6d0 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Sat, 7 Nov 2020 01:03:18 +0100 +Subject: [PATCH] docs: Document the cutmem command + +The command is not present in the docs/grub.texi user documentation. + +Reported-by: Daniel Kiper +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Daniel Kiper +Reviewed-by: Javier Martinez Canillas + +Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f05e79a0143beb2d9a482a3ebf4fe0ce76778122] +CVE: CVE-2020-27779 +Signed-off-by: Marta Rybczynska +--- + docs/grub.texi | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/docs/grub.texi b/docs/grub.texi +index ccf1908..ae85f55 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -3892,6 +3892,7 @@ you forget a command, you can run the command @command{help} + * cpuid:: Check for CPU features + * crc:: Compute or check CRC32 checksums + * cryptomount:: Mount a crypto device ++* cutmem:: Remove memory regions + * date:: Display or set current date and time + * devicetree:: Load a device tree blob + * distrust:: Remove a pubkey from trusted keys +@@ -4051,6 +4052,8 @@ this page is to be filtered. This syntax makes it easy to represent patterns + that are often result of memory damage, due to physical distribution of memory + cells. + ++The command is similar to @command{cutmem} command. ++ + Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). + This prevents removing EFI memory regions to potentially subvert the + security mechanisms provided by the UEFI secure boot. +@@ -4214,6 +4217,24 @@ GRUB suports devices encrypted using LUKS and geli. Note that necessary modules + be used. + @end deffn + ++@node cutmem ++@subsection cutmem ++ ++@deffn Command cutmem from[K|M|G] to[K|M|G] ++Remove any memory regions in specified range. ++@end deffn ++ ++This command notifies the memory manager that specified regions of RAM ought to ++be filtered out. This remains in effect after a payload kernel has been loaded ++by GRUB, as long as the loaded kernel obtains its memory map from GRUB. Kernels ++that support this include Linux, GNU Mach, the kernel of FreeBSD and Multiboot ++kernels in general. ++ ++The command is similar to @command{badram} command. ++ ++Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). ++ This prevents removing EFI memory regions to potentially subvert the ++ security mechanisms provided by the UEFI secure boot. + + @node date + @subsection date diff --git a/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch b/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch new file mode 100644 index 0000000000..504352b4e3 --- /dev/null +++ b/meta/recipes-bsp/grub/files/no-insmod-on-sb.patch @@ -0,0 +1,107 @@ +From b5a6aa7d77439bfeb75f200abffe15c6f685c907 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett +Date: Mon, 13 Jan 2014 12:13:09 +0000 +Subject: Don't permit loading modules on UEFI secure boot + +Author: Colin Watson +Origin: vendor, http://pkgs.fedoraproject.org/cgit/grub2.git/tree/grub-2.00-no-insmod-on-sb.patch +Forwarded: no +Last-Update: 2013-12-25 + +Patch-Name: no-insmod-on-sb.patch + +Upstream-Status: Inappropriate [other, https://salsa.debian.org/grub-team/grub/-/blob/debian/2.04-20/debian/patches/no-insmod-on-sb.patch] + +Backport of a Debian (and Fedora) patch implementing a way to get secure boot status +for CVE-2020-14372_4.patch. The upstream solution has too many dependencies to backport. +Source: https://salsa.debian.org/grub-team/grub/-/blob/debian/2.04-20/debian/patches/no-insmod-on-sb.patch + +Signed-off-by: Marta Rybczynska +--- + grub-core/kern/dl.c | 13 +++++++++++++ + grub-core/kern/efi/efi.c | 28 ++++++++++++++++++++++++++++ + include/grub/efi/efi.h | 1 + + 3 files changed, 42 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 48eb5e7b6..074dfc3c6 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -38,6 +38,10 @@ + #define GRUB_MODULES_MACHINE_READONLY + #endif + ++#ifdef GRUB_MACHINE_EFI ++#include ++#endif ++ + + + #pragma GCC diagnostic ignored "-Wcast-align" +@@ -686,6 +690,15 @@ grub_dl_load_file (const char *filename) + void *core = 0; + grub_dl_t mod = 0; + ++#ifdef GRUB_MACHINE_EFI ++ if (grub_efi_secure_boot ()) ++ { ++ grub_error (GRUB_ERR_ACCESS_DENIED, ++ "Secure Boot forbids loading module from %s", filename); ++ return 0; ++ } ++#endif ++ + grub_boot_time ("Loading module %s", filename); + + file = grub_file_open (filename, GRUB_FILE_TYPE_GRUB_MODULE); +diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c +index 6e1ceb905..96204e39b 100644 +--- a/grub-core/kern/efi/efi.c ++++ b/grub-core/kern/efi/efi.c +@@ -273,6 +273,34 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid, + return NULL; + } + ++grub_efi_boolean_t ++grub_efi_secure_boot (void) ++{ ++ grub_efi_guid_t efi_var_guid = GRUB_EFI_GLOBAL_VARIABLE_GUID; ++ grub_size_t datasize; ++ char *secure_boot = NULL; ++ char *setup_mode = NULL; ++ grub_efi_boolean_t ret = 0; ++ ++ secure_boot = grub_efi_get_variable ("SecureBoot", &efi_var_guid, &datasize); ++ ++ if (datasize != 1 || !secure_boot) ++ goto out; ++ ++ setup_mode = grub_efi_get_variable ("SetupMode", &efi_var_guid, &datasize); ++ ++ if (datasize != 1 || !setup_mode) ++ goto out; ++ ++ if (*secure_boot && !*setup_mode) ++ ret = 1; ++ ++ out: ++ grub_free (secure_boot); ++ grub_free (setup_mode); ++ return ret; ++} ++ + #pragma GCC diagnostic ignored "-Wcast-align" + + /* Search the mods section from the PE32/PE32+ image. This code uses +diff --git a/include/grub/efi/efi.h b/include/grub/efi/efi.h +index e90e00dc4..a237952b3 100644 +--- a/include/grub/efi/efi.h ++++ b/include/grub/efi/efi.h +@@ -82,6 +82,7 @@ EXPORT_FUNC (grub_efi_set_variable) (const char *var, + const grub_efi_guid_t *guid, + void *data, + grub_size_t datasize); ++grub_efi_boolean_t EXPORT_FUNC (grub_efi_secure_boot) (void); + int + EXPORT_FUNC (grub_efi_compare_device_paths) (const grub_efi_device_path_t *dp1, + const grub_efi_device_path_t *dp2); diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc index 180e3752f8..db7c23a84a 100644 --- a/meta/recipes-bsp/grub/grub2.inc +++ b/meta/recipes-bsp/grub/grub2.inc @@ -31,6 +31,20 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \ file://CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch \ file://CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch \ file://determinism.patch \ + file://no-insmod-on-sb.patch \ + file://CVE-2020-14372_1.patch \ + file://CVE-2020-14372_2.patch \ + file://CVE-2020-14372_3.patch \ + file://CVE-2020-14372_4.patch \ + file://CVE-2020-14372_5.patch \ + file://CVE-2020-14372.patch \ + file://CVE-2020-27779.patch \ + file://CVE-2020-27779_2.patch \ + file://CVE-2020-27779_3.patch \ + file://CVE-2020-27779_4.patch \ + file://CVE-2020-27779_5.patch \ + file://CVE-2020-27779_6.patch \ + file://CVE-2020-27779_7.patch \ " SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934" SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea" From patchwork Sun Jan 9 22:04:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2158 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F283EC433EF for ; Sun, 9 Jan 2022 22:04:37 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.web12.23594.1641765877001648699 for ; Sun, 09 Jan 2022 14:04:37 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=YEJWUwVa; spf=softfail (domain: sakoman.com, ip: 209.85.216.41, mailfrom: steve@sakoman.com) Received: by mail-pj1-f41.google.com with SMTP id oa15so10853847pjb.4 for ; Sun, 09 Jan 2022 14:04:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=7MRIhQv2IMVyCq1Su2FcE5XZU2KDnUD9nYQRvFLVrr8=; b=YEJWUwVaYfIx4sAOa5+xPPKXWXCtOc7Je7USuEe/2v5joGBvjXUyK3SYZEszUr/sl0 uL4oaeRrp6lpddBzbuHlvI6K06Nyy9Z/suhtXToaqO9g4Jpc442BjJsUsnTMZvQu5bCn mmnuDJnwhB51M/uJ4CLckflps//NefkJf+8fUhqPxfjffCFQACf2GS6yQDvfv1zicNH/ qJKThw68LvVawdvNMuR349Yecc3X6NOAtWCCSm3H1rIE+qNika5mmM+m3bGCjmUzBdM1 CooASRocDjPPQh6D/P9f2FSa77LtAE7bGPNP6asFrv+qOIL2YnifeAULIqFxOnehPtdg VZTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=7MRIhQv2IMVyCq1Su2FcE5XZU2KDnUD9nYQRvFLVrr8=; b=5jSUK4rE9Ldm5KPfn3hHi/vA5yerCsyFN5+vW++4I6amUiebYp9sP803z80REZoAqq uGShELQVBDq37bA3JpZQkAFrtAaMcKUwT5gUJWw0jkPPsCzCs06zktWfXr+U03XSWfgc n3GzvpNCwk0u5hbUz5fQ5+hmwsBDaVhfXiJVk4vE5uyT7bLDDDdnM690MEQUaml8GzEe tSqSkh8MAfu+SpvzKF5fODPU+j7AIzz726y5gC+tBw8WY0nhV+JcwZ8lkAGZ17BaG67k dxQ2UER4i749Q1O8FOvXAxlDlJZA7vbREbjrjbybUStSOVaIsL0BJxSqnG48VMH0dZ2y P3+w== X-Gm-Message-State: AOAM532Ui1Ppvp1wSK+DwZQuQL12Xx3GYRxWaYHPEpT7ZN/cS6+ILKV4 N06Vc/TbMktobdn9SKFWf8QMjXO65D8o1fTokoQ= X-Google-Smtp-Source: ABdhPJyFdOdjLGzsuwi58/+w2IaCWobAYd3NHuyd8Q0HIu3HclUqLPnHTcTPc9fZLFE9NpEwMy7/OQ== X-Received: by 2002:a17:902:bd05:b0:148:a2e8:2c3d with SMTP id p5-20020a170902bd0500b00148a2e82c3dmr71434783pls.140.1641765876056; Sun, 09 Jan 2022 14:04:36 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:35 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 02/12] linux-firmware: upgrade 20211027 -> 20211216 Date: Sun, 9 Jan 2022 12:04:06 -1000 Message-Id: <904eb89c0ff22be32209eb0a8a569911f1969673.1641765639.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160293 From: wangmy License-Update: version of license file updated. Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 07dc668ddc50de14821aff1b6850d8b4999702bd) Signed-off-by: Steve Sakoman --- ...{linux-firmware_20211027.bb => linux-firmware_20211216.bb} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename meta/recipes-kernel/linux-firmware/{linux-firmware_20211027.bb => linux-firmware_20211216.bb} (99%) diff --git a/meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb b/meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb similarity index 99% rename from meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb rename to meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb index 76aed9d443..92b6ff5157 100644 --- a/meta/recipes-kernel/linux-firmware/linux-firmware_20211027.bb +++ b/meta/recipes-kernel/linux-firmware/linux-firmware_20211216.bb @@ -132,7 +132,7 @@ LIC_FILES_CHKSUM = "file://LICENCE.Abilis;md5=b5ee3f410780e56711ad48eadc22b8bc \ file://LICENCE.xc4000;md5=0ff51d2dc49fce04814c9155081092f0 \ file://LICENCE.xc5000;md5=1e170c13175323c32c7f4d0998d53f66 \ file://LICENCE.xc5000c;md5=12b02efa3049db65d524aeb418dd87ca \ - file://WHENCE;md5=d627873bd934d7c52b2c8191304a8eb7 \ + file://WHENCE;md5=79f477f9d53eedee5a65b45193785963 \ " # These are not common licenses, set NO_GENERIC_LICENSE for them @@ -205,7 +205,7 @@ PE = "1" SRC_URI = "${KERNELORG_MIRROR}/linux/kernel/firmware/${BPN}-${PV}.tar.xz" -SRC_URI[sha256sum] = "bc2657dd8eb82386a9a7ec6df9ccf31c32c7e9073c05d37786c1edc273f9440a" +SRC_URI[sha256sum] = "eeddb4e6bef31fd1a3757f12ccc324929bbad97855c0b9ec5ed780f74de1837d" inherit allarch From patchwork Sun Jan 9 22:04:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2159 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFAD3C433EF for ; Sun, 9 Jan 2022 22:04:39 +0000 (UTC) Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by mx.groups.io with SMTP id smtpd.web09.23857.1641765879048738032 for ; Sun, 09 Jan 2022 14:04:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=oewTbcXh; spf=softfail (domain: sakoman.com, ip: 209.85.210.175, mailfrom: steve@sakoman.com) Received: by mail-pf1-f175.google.com with SMTP id p37so9092000pfh.4 for ; Sun, 09 Jan 2022 14:04:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=dteUi2cXMP/v2qus7MfYv2euCEmKSBO87S4LafT/qgQ=; b=oewTbcXhd26QEY2Qxe0+xSljVCbYq4KtwGUpD63FgdeMBdHNXaqiXhvqu/eEtj2bwW Aqz1U1AHs5C9VgdfOvs5zJ7E0fq0kMVtaP0qyj9g3TkdqW5dgThGrwpbiZvVpXmfHcSB 5q6Tv7O6W0b0LLkbOiZmCXY4zK79LgPTw+pzibNmDYwSdyTfp48laUIJuDMULs+6rVlK Qf7fIAT2KNUrUCUsqjvh/MAwwulJuAFq4YZPTn71LmZIYpxHySyJrNo5OUUgZgtW8bVG yhbTkZDD1ePzT8dQmgGBeeVFwMVQjJ8UuNGVPdOhV6EP7qEt5jt3jouxYbFmoYlIFpzr t/wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dteUi2cXMP/v2qus7MfYv2euCEmKSBO87S4LafT/qgQ=; b=iiXL0AsQjUfp3ahNrioWNoqyJWPBLvIy0HyoQCt+yNGdq5BPrHlfUF8A2wrVNj3xqp 6jwJ6tZrwPfxB4WDQWWkfVPG1ICs7kybdo1Tu75xnLqVoaK5IA9YZRzn/rxvYRfaEQvo N84vHbcCdPnIVAMLb63K8J22/sRNwjiAWiajuIOgtHfX/Duaj1NsYJKk/0s5nw1002Sz ipjrIb7rxkwD6YfDKbXwxVyiWISHf65rw2LvqwlA+/uBuT99qlWmjmrqnDydfFmhv1WG n+Ycbjonk44I4P55/XP0Cd19R1DdCFP51f7r+ZsTB9wJ/L5JOSTNW1nbmzIeE5Zgroms takA== X-Gm-Message-State: AOAM530k+J3WRItB/1aQ2VU+4eabVTGAvAIpzp4cgA4mr9HR/kdldqpy vfrx2T9E7ofAmdFEerXWvXpp6oq4OnqXG4r087I= X-Google-Smtp-Source: ABdhPJyAbZ/9NE6p23jjyt5PHBKJQCHMWn5NJlI9SuTkQYDcK6WrdX2OCvJXBWKo5CyzkO9rknT3og== X-Received: by 2002:a63:a1a:: with SMTP id 26mr63857433pgk.212.1641765878194; Sun, 09 Jan 2022 14:04:38 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:37 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 03/12] libpcre2: update SRC_URI Date: Sun, 9 Jan 2022 12:04:07 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160294 Version 10.34 tarball is no longer available at current URL, use downloads.yoctoproject.org mirror instead Signed-off-by: Steve Sakoman --- meta/recipes-support/libpcre/libpcre2_10.34.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-support/libpcre/libpcre2_10.34.bb b/meta/recipes-support/libpcre/libpcre2_10.34.bb index cbbb632f87..f2c36944d8 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.34.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.34.bb @@ -10,7 +10,7 @@ SECTION = "devel" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENCE;md5=b1588d3bb4cb0e1f5a597d908f8c5b37" -SRC_URI = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ +SRC_URI = "http://downloads.yoctoproject.org/mirror/sources/pcre2-${PV}.tar.bz2 \ file://pcre-cross.patch \ " From patchwork Sun Jan 9 22:04:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2160 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECF9AC433F5 for ; Sun, 9 Jan 2022 22:04:41 +0000 (UTC) Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by mx.groups.io with SMTP id smtpd.web08.23486.1641765881234503296 for ; Sun, 09 Jan 2022 14:04:41 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=lzQkpk5P; spf=softfail (domain: sakoman.com, ip: 209.85.210.177, mailfrom: steve@sakoman.com) Received: by mail-pf1-f177.google.com with SMTP id t187so9053618pfb.11 for ; Sun, 09 Jan 2022 14:04:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=LIOMKpTbnR5riDhlsx9nllK6PJvuGII1Mq4yoQufzUc=; b=lzQkpk5PkhyPl/P3qEoxAxiN/ieSEqLXF6G8iFGSElO7Qv41u2Cqaubmx6t2ZF2rqF 6zgSKvRQBCtbeSto4JPWvYGx+gvjnizmd0JdACRRCW1KhZ0HAW9TL3rJVUk2AEkIfrU1 +xT0ri5xl/EUC4fPpBSMsgXyaPiVH/b9GN+M3agpJkvs8g2ybZmY4aeYzXxjIMAghiB0 jgFWLYjb+KrwREQaYZOr76SZ+1Jc6SVDQuoQ95Yn9lnpG6MMQVYDbLUzOXEqYFcOp+ZL zzgPyXfpUoYwM83WQ8CINboVCBU3Fomr6kMOWO1yuVui1RUbARh/7M2ZpPgaKQpRIhsl H/Ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LIOMKpTbnR5riDhlsx9nllK6PJvuGII1Mq4yoQufzUc=; b=y6UTQK7RSXu2tdGADu4/gBozVO5rKMAhasdF7VOIz6QvUpPGVNgVqFgDj9tAPb2F54 RUDiTff9SJaSLeqqR2QW/ePVurMgFlZP52+A5I6JZ0OvmZv11vcnlshl6WHhQ6g3gKCF rffQIf4WJ+BceWZfTJBN/B71jjUhsSlRTqZ0CFjj1EVICBRjulgQ8II+2anbLn4VkZzW IVoYuNmFaFUecW2lMQeYEmvmlHyoI4/qXWC2yVm86QBa9Fl5pGtl1MZDegAl+iaJCm2y Kg44pJEi/tf8iTEurMwVQtTHRxJzd0ut/OCHawJ4jqw3SiBC2H9RUyMRGXn6YN9HzmIF XXpA== X-Gm-Message-State: AOAM531X12nRyc/3eqmwVyR6rQRlCmByaznFw3BLRfxiH/dYPony82Ll NKpd2FiK1oEz3lZpolmPGLNJIOTqkZc4ZgaGue0= X-Google-Smtp-Source: ABdhPJxdmF2CkT7bDukH9ZNDnaw8NU+iwM1v/BC4YTxhPSf7oNPLIvBtHnMdBrqX5UzB+eDk03Ujcg== X-Received: by 2002:a63:6d87:: with SMTP id i129mr2821603pgc.24.1641765880321; Sun, 09 Jan 2022 14:04:40 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:39 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 04/12] openssl: Add reproducibility fix Date: Sun, 9 Jan 2022 12:04:08 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160295 From: Richard Purdie When the date rolled from one year to another, it highlighted a reproducibility issue in openssl. Patch a workaround for this to avoid autobuilder failures. Signed-off-by: Richard Purdie (cherry picked from commit f8281e290737dba16a46d7ae937c66b3266e0fe8) Signed-off-by: Steve Sakoman --- .../openssl/openssl/reproducibility.patch | 22 +++++++++++++++++++ .../openssl/openssl_1.1.1l.bb | 1 + 2 files changed, 23 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/reproducibility.patch diff --git a/meta/recipes-connectivity/openssl/openssl/reproducibility.patch b/meta/recipes-connectivity/openssl/openssl/reproducibility.patch new file mode 100644 index 0000000000..8accbc9df2 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/reproducibility.patch @@ -0,0 +1,22 @@ +Using localtime() means the output can depend on the timezone of the build machine. +Using gmtime() is safer. For complete reproducibility use SOURCE_DATE_EPOCH if set. + +Signed-off-by: Richard Purdie +Upstream-Status: Pending [should be suitable] + +Index: openssl-3.0.1/apps/progs.pl +=================================================================== +--- openssl-3.0.1.orig/apps/progs.pl ++++ openssl-3.0.1/apps/progs.pl +@@ -21,7 +21,10 @@ die "Unrecognised option, must be -C or + my %commands = (); + my $cmdre = qr/^\s*int\s+([a-z_][a-z0-9_]*)_main\(\s*int\s+argc\s*,/; + my $apps_openssl = shift @ARGV; +-my $YEAR = [localtime()]->[5] + 1900; ++my $YEAR = [gmtime()]->[5] + 1900; ++if (defined($ENV{SOURCE_DATE_EPOCH}) && $ENV{SOURCE_DATE_EPOCH} !~ /\D/) { ++ $YEAR = [gmtime($ENV{SOURCE_DATE_EPOCH})]->[5] + 1900; ++} + + # because the program apps/openssl has object files as sources, and + # they then have the corresponding C files as source, we need to chain diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb index 9412b19fa5..bf7cd6527e 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1l.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ file://afalg.patch \ file://reproducible.patch \ + file://reproducibility.patch \ " SRC_URI_append_class-nativesdk = " \ From patchwork Sun Jan 9 22:04:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2161 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E897DC433EF for ; Sun, 9 Jan 2022 22:04:44 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.web08.23487.1641765884020438157 for ; Sun, 09 Jan 2022 14:04:44 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=4/sPYqYW; spf=softfail (domain: sakoman.com, ip: 209.85.215.170, mailfrom: steve@sakoman.com) Received: by mail-pg1-f170.google.com with SMTP id y9so9574040pgr.11 for ; Sun, 09 Jan 2022 14:04:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=AQFtiN3SuBhrpoTyaSkPFe7aNk/2OmyTc+pmciv95JU=; b=4/sPYqYWfm+qfndjqDgY2Cj1ryqJys+O4jT4yDesIyPb/4+b+GloJvRwE0GwdjvWeM O7sIY5p0nHFqdYHcIwAZSrIBfIh65d8HnTrFswsqR8F16547PX6GYbgBBtktqVG5Fwn2 2aUFclPFrs8h+RFVsIjVFseEhw3Cr9pQalQS18sQKXjgdqUcNz+u2vA15h8fBvEIdTwF ng5W0zTN13VssP3CaTKT0GET6kUhD3orucpm8PQDlpxW6vCt5Pz1hR2XGIuEDWyk/apf jZroBASJDeeB4LqOr2xCuegtYMwkJbMuMuz6XX26QtRQDqdovEYja0fM/1zKg7Gmku5g XAoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=AQFtiN3SuBhrpoTyaSkPFe7aNk/2OmyTc+pmciv95JU=; b=lt0GJwLrk/FGFhYBFW3a7+S2szQIQw3V5dCQ8DBTdcksxa3tautDMwGAKPucj7r1yg D2zuxYqKu8xFpTnAXaGWpJW+/JUbdf0yZPjaxpf8m9ZSZAzypwySbEP01mnp+VafUUV1 6w5FpNHElzC/0yItWX9nORiypldeqPn/lf1dzfEFK9CZX15rBHNWUEwLAnWhSckgO2Ax 2XsZrFmRKci4czLKTZ5WYNthhSrRGw6E0OvQIWtSkWGwVUGC38zBQch8DP6W/zA1wTgB 3BjS2+zla++w+PA6kwrd10mJB3FkwT0+QcDnPwcIcygfynh3/6/TU5s3k1AaHBEMN8B+ dw7A== X-Gm-Message-State: AOAM5313qda+vOESHyuzFY20sEH7xRicgG0h87QEUItSS0LIu89T2ren go70P+fi5f0ocWJCUdPglBDOT+L83YIp/PDKqpg= X-Google-Smtp-Source: ABdhPJy+Tt6C+Y/YAOKVkPj167qKYyILhk1lW7hTDxCFQHS3uAi5DRbFREB9CUIeivR6CN6q+jJDsA== X-Received: by 2002:a63:7543:: with SMTP id f3mr9083711pgn.360.1641765883164; Sun, 09 Jan 2022 14:04:43 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:42 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 05/12] oeqa/selftest/bbtests: Use YP sources mirror instead of GNU Date: Sun, 9 Jan 2022 12:04:09 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160296 From: Richard Purdie The gnu sources server has been known to disappear. Use the YP sources mirror instead. If that breaks, the autobuilder is broken anyway. This should reduce test failures from upstream network issues. Signed-off-by: Richard Purdie (cherry picked from commit a5459e42f1a6be9c08f303653cc1f73514eca9ef) Signed-off-by: Steve Sakoman --- meta/lib/oeqa/selftest/cases/bbtests.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oeqa/selftest/cases/bbtests.py b/meta/lib/oeqa/selftest/cases/bbtests.py index d4f6a08991..e659be5341 100644 --- a/meta/lib/oeqa/selftest/cases/bbtests.py +++ b/meta/lib/oeqa/selftest/cases/bbtests.py @@ -157,7 +157,7 @@ SSTATE_DIR = \"${TOPDIR}/download-selftest\" """) self.track_for_cleanup(os.path.join(self.builddir, "download-selftest")) - data = 'SRC_URI = "${GNU_MIRROR}/aspell/aspell-${PV}.tar.gz;downloadfilename=test-aspell.tar.gz"' + data = 'SRC_URI = "https://downloads.yoctoproject.org/mirror/sources/aspell-${PV}.tar.gz;downloadfilename=test-aspell.tar.gz"' self.write_recipeinc('aspell', data) result = bitbake('-f -c fetch aspell', ignore_status=True) self.delete_recipeinc('aspell') From patchwork Sun Jan 9 22:04:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2162 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBAC3C433EF for ; Sun, 9 Jan 2022 22:04:46 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.web11.23925.1641765886414572306 for ; Sun, 09 Jan 2022 14:04:46 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=iG4p+HkR; spf=softfail (domain: sakoman.com, ip: 209.85.210.173, mailfrom: steve@sakoman.com) Received: by mail-pf1-f173.google.com with SMTP id u20so9062562pfi.12 for ; Sun, 09 Jan 2022 14:04:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=gE/7CuB/R8j50duJqRPYuPpCLRbpOvAe+OPXBkWMq5E=; b=iG4p+HkRlmg6TtdooUVf2OPWWiwD0IqbK75cMNcVBm8lCFVVM/2Et5hp+LXywDPGm8 03KWCn3voy7cmu7BF/mxaz/T7nqTlFGkgKaDYWzd4EtIeV/nHDQ7GIbzql+91xtTiMLA S/ashwDTQDNi939GZvptLShJh5LzwGLPkDZZGa/XntUNDVcPJeZnW6ADblNWhqxZm02e HtMcGu+MMdNWMwkHGhhsv+jOHZDzglAidQknMvabwKgoFW7y9nNm+q2jJGWfUD5wrz1u yZLK7Nm6heebSc4CZG2WsfSZOvcPEN6y+DGgfY22y3Qdb2ioUGg0nzgbPdg5MSUaz/wU d+hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=gE/7CuB/R8j50duJqRPYuPpCLRbpOvAe+OPXBkWMq5E=; b=yOC+qUaHbIzCky4w8yj9LNUKgwKyjNaxOEXPQev6RxCUDCIA4fekrs6JJR8puVBzFb MHzn8KBuy6itoVtdvMoqPCsFt9VrG2j1/saM67jGmgutPU1BkT2Ef3z1HnfMQGSAtIB/ ZeBcfPLr872SxhLnAfPX5xg+CJSz4d4CVpBzdCoeamNitkhE8/cdfDj8Yf0Af6yZnT9I vanorp3thVbxw5662bWUXIN4a3IVES08NCPzJOndMWH3sUTVDFTyixSBMm7pwz2gduAv LwC7/5O8zmRkE4PuFUS5mAErgq7Ad4skMAHcFBE28yraNtGonEl0DxebCEOJ4CrI/oJ5 ZreA== X-Gm-Message-State: AOAM531PItr+N8e+EPy7J0rZX2wx1/AQXquKUry1hEI6K1z6kJt3Dt23 zjsmwkEXMj9l/WYuMEcvGGeJtqhUVWXKMOkF2P4= X-Google-Smtp-Source: ABdhPJwNU+LCNdnvrFEeK5Sda7ebhd/Jqu5/gGvRw2xSnckh60VUGSI9uUpfbrOTqCHiSijNVanyMA== X-Received: by 2002:a63:6cc5:: with SMTP id h188mr62738518pgc.401.1641765885486; Sun, 09 Jan 2022 14:04:45 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:44 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 06/12] oeqa/selftest/tinfoil: Update to use test command Date: Sun, 9 Jan 2022 12:04:10 -1000 Message-Id: <351b02feb9cb680aa3dbe4c8ea4162a6456a469f.1641765639.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160297 From: Richard Purdie We've had IO load issues on the autobuilder with this test. Avoid those by using a specilised test command instead. Signed-off-by: Richard Purdie (cherry picked from commit 106445b1eb74fc37e03c72a0c011541b50a16c19) Signed-off-by: Steve Sakoman --- meta/lib/oeqa/selftest/cases/tinfoil.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/lib/oeqa/selftest/cases/tinfoil.py b/meta/lib/oeqa/selftest/cases/tinfoil.py index a51c6048d3..0204537d49 100644 --- a/meta/lib/oeqa/selftest/cases/tinfoil.py +++ b/meta/lib/oeqa/selftest/cases/tinfoil.py @@ -94,14 +94,13 @@ class TinfoilTests(OESelftestTestCase): pass pattern = 'conf' - res = tinfoil.run_command('findFilesMatchingInDir', pattern, 'conf/machine') + res = tinfoil.run_command('testCookerCommandEvent', pattern) self.assertTrue(res) eventreceived = False commandcomplete = False start = time.time() # Wait for maximum 60s in total so we'd detect spurious heartbeat events for example - # The test is IO load sensitive too while (not (eventreceived == True and commandcomplete == True) and (time.time() - start < 60)): # if we received both events (on let's say a good day), we are done @@ -111,7 +110,8 @@ class TinfoilTests(OESelftestTestCase): commandcomplete = True elif isinstance(event, bb.event.FilesMatchingFound): self.assertEqual(pattern, event._pattern) - self.assertIn('qemuarm.conf', event._matches) + self.assertIn('A', event._matches) + self.assertIn('B', event._matches) eventreceived = True elif isinstance(event, logging.LogRecord): continue From patchwork Sun Jan 9 22:04:11 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2163 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED9F5C433F5 for ; Sun, 9 Jan 2022 22:04:49 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.web10.23774.1641765888946999773 for ; Sun, 09 Jan 2022 14:04:49 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=dhVl77hR; spf=softfail (domain: sakoman.com, ip: 209.85.216.41, mailfrom: steve@sakoman.com) Received: by mail-pj1-f41.google.com with SMTP id r16-20020a17090a0ad000b001b276aa3aabso20190396pje.0 for ; Sun, 09 Jan 2022 14:04:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=FATPQAYl2Iy7UR4tZhtL8WuLH10jg+chr7x6mKC3XCY=; b=dhVl77hRzMbMWbhPnOAksMgrxM+2PCOQbaoClhPEjFi3wjikJgF4jGSBKvS2cP4LUX poEHuF1JjTFq0IAD0fRAP3Pfn6HfnQgTGINKXoSRTlABJXtJc94oaPb5sSPkTgrq7VWn 0Z3dLbOWXilPFkfEVn8CgAKX/oZZH81yc1HZOkevZFFJIiNNDFZPVw8LT4T37P0RuKsQ Kk1wLci4sbojQMUF9nOAg7E7ehFhxcqVbS7zhOckqhDCBPp/qpPQCY11Vz4h1NeAUiJL B4VR1ahpfdNogOrKYCjEVtyqy7Td6lhWIjYNEJTEb+U4nWwFr0dl9Q4Je4OUHH8egU+O kRMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=FATPQAYl2Iy7UR4tZhtL8WuLH10jg+chr7x6mKC3XCY=; b=s9mxnqO2eCA4ZDAJHc7P6KYb/tivZjPa8aCjBKYKx5Lb758oPHQj6MqZjrYWvEovOH 7hHnvGyc/91MDc6ytF0LHyCqBDRgY2QL2/aExdYtQ0XEppS1RLexmm1mmxYB5sp3OfRB Kzu7OYaSCPUOfTsjhUtGnZCw7T10n+EbySy4sSbbzky1pB2ifZvaWmG4INqx79I6SOvW 7ma343AqoNRC5Uc9y1b7ikpyuhkHHwbcr+UZRFEZRNSQvXFqgdQkO2SK4x7dYeetiige /xSQPxB8uNrnifeKnhGUBxg33qjBzRqG408ei1O5ZADyIcK6i9aWqloxvjfdNcq7dSIT C+Iw== X-Gm-Message-State: AOAM530KQfddS34NYcdMVgRu5xbe8+ucoci4oJr2C8BguzpnbNLfWk5Y u1B/HVllKkMPXfoOjsUzNAV8emHn+6ygYTugqfg= X-Google-Smtp-Source: ABdhPJwSj0RhmFGlbybFcas85xwcXEIKT6OF70eUR3UXgrl1MMNq8elSBx8pPESh+tKHZdAvwxo0iQ== X-Received: by 2002:a17:90a:d585:: with SMTP id v5mr24515868pju.124.1641765887595; Sun, 09 Jan 2022 14:04:47 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:47 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 07/12] weston: Backport patches to always activate the top-level surface Date: Sun, 9 Jan 2022 12:04:11 -1000 Message-Id: <0a2da895284f1687cf75297fb0f4b20cc9b53489.1641765639.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160298 From: Marek Vasut In case the device has only touchscreen input device and no keyboard or mouse, the top level surface is never activated. The behavior differs from a device which has a keyboard (or gpio-keys, or even uinput-emulated keyboard), where callchain activate()->weston_view_activate()->weston_seat_set_keyboard_focus()-> weston_keyboard_set_focus()->wl_signal_emit(&keyboard->focus_signal, keyboard)-> handle_keyboard_focus()->weston_desktop_surface_set_activated(..., true); sets the top level surface as activated. On device with touchscreen, the above is never called, hence the top level surface is never activated. Add explicit weston_desktop_surface_set_activated(shsurf->desktop_surface, true); into activate() to always active the top level surface. This fixes at least two known issues on such devices: - Wayland terminal cursor is an empty bar (full bar with keyboard present) - Chromium dropdown menus are randomly placed (they are placed correctly when keyboard is present, because then chromium can find the activated top level surface) Signed-off-by: Marek Vasut Cc: Steve Sakoman Signed-off-by: Steve Sakoman --- ...move-no-op-de-activation-of-the-xdg-.patch | 32 ++++++ ...name-gain-lose-keyboard-focus-to-act.patch | 57 +++++++++++ ...bed-keyboard-focus-handle-code-when-.patch | 99 +++++++++++++++++++ meta/recipes-graphics/wayland/weston_8.0.0.bb | 3 + 4 files changed, 191 insertions(+) create mode 100644 meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch create mode 100644 meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch create mode 100644 meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch diff --git a/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch b/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch new file mode 100644 index 0000000000..fb36d3817a --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch @@ -0,0 +1,32 @@ +From 5c74a0640e873694bf60a88eceb21f664cb4b8f7 Mon Sep 17 00:00:00 2001 +From: Marius Vlad +Date: Fri, 5 Mar 2021 20:03:49 +0200 +Subject: [PATCH 2/5] desktop-shell: Remove no-op de-activation of the xdg + top-level surface + +The shsurf is calloc'ed so the surface count is always 0. Not only +that but the surface is not set as active by default, so there's no +need to de-activate it. + +Upstream-Status: Backport [05bef4c18a3e82376a46a4a28d978389c4c0fd0f] +Signed-off-by: Marius Vlad +--- + desktop-shell/shell.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index 442a625f..3791be25 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -2427,8 +2427,6 @@ desktop_surface_added(struct weston_desktop_surface *desktop_surface, + wl_list_init(&shsurf->children_link); + + weston_desktop_surface_set_user_data(desktop_surface, shsurf); +- weston_desktop_surface_set_activated(desktop_surface, +- shsurf->focus_count > 0); + } + + static void +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch b/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch new file mode 100644 index 0000000000..dcd0700fca --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch @@ -0,0 +1,57 @@ +From edb31c456ae3da7ffffefb668a37ab88075c4b67 Mon Sep 17 00:00:00 2001 +From: Marius Vlad +Date: Fri, 5 Mar 2021 21:40:22 +0200 +Subject: [PATCH 3/5] desktop-shell: Rename gain/lose keyboard focus to + activate/de-activate + +This way it better reflects that it handles activation rather that input +focus. + +Upstream-Status: Backport [ab39e1d76d4f6715cb300bc37f5c2a0e2d426208] +Signed-off-by: Marius Vlad +--- + desktop-shell/shell.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index 3791be25..c4669f11 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -1869,14 +1869,14 @@ handle_pointer_focus(struct wl_listener *listener, void *data) + } + + static void +-shell_surface_lose_keyboard_focus(struct shell_surface *shsurf) ++shell_surface_deactivate(struct shell_surface *shsurf) + { + if (--shsurf->focus_count == 0) + weston_desktop_surface_set_activated(shsurf->desktop_surface, false); + } + + static void +-shell_surface_gain_keyboard_focus(struct shell_surface *shsurf) ++shell_surface_activate(struct shell_surface *shsurf) + { + if (shsurf->focus_count++ == 0) + weston_desktop_surface_set_activated(shsurf->desktop_surface, true); +@@ -1891,7 +1891,7 @@ handle_keyboard_focus(struct wl_listener *listener, void *data) + if (seat->focused_surface) { + struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); + if (shsurf) +- shell_surface_lose_keyboard_focus(shsurf); ++ shell_surface_deactivate(shsurf); + } + + seat->focused_surface = weston_surface_get_main_surface(keyboard->focus); +@@ -1899,7 +1899,7 @@ handle_keyboard_focus(struct wl_listener *listener, void *data) + if (seat->focused_surface) { + struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); + if (shsurf) +- shell_surface_gain_keyboard_focus(shsurf); ++ shell_surface_activate(shsurf); + } + } + +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch b/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch new file mode 100644 index 0000000000..7ca72f8494 --- /dev/null +++ b/meta/recipes-graphics/wayland/weston/0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch @@ -0,0 +1,99 @@ +From 899ad5a6a8a92f2c10e0694a45c982b7d878aed6 Mon Sep 17 00:00:00 2001 +From: Marius Vlad +Date: Fri, 5 Mar 2021 21:44:26 +0200 +Subject: [PATCH 4/5] desktop-shell: Embed keyboard focus handle code when + activating + +We shouldn't be constrained by having a keyboard plugged-in, so avoid +activating/de-activating the window/surface in the keyboard focus +handler and embed it straight into the window activation part. + +Upstream-Status: Backport [f12697bb3e4c6eb85437ed905e7de44ae2a0ba69] +Signed-off-by: Marius Vlad +--- + desktop-shell/shell.c | 41 +++++++++++++++++++++++++---------------- + 1 file changed, 25 insertions(+), 16 deletions(-) + +diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c +index c4669f11..c6a4fe91 100644 +--- a/desktop-shell/shell.c ++++ b/desktop-shell/shell.c +@@ -1885,22 +1885,7 @@ shell_surface_activate(struct shell_surface *shsurf) + static void + handle_keyboard_focus(struct wl_listener *listener, void *data) + { +- struct weston_keyboard *keyboard = data; +- struct shell_seat *seat = get_shell_seat(keyboard->seat); +- +- if (seat->focused_surface) { +- struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); +- if (shsurf) +- shell_surface_deactivate(shsurf); +- } +- +- seat->focused_surface = weston_surface_get_main_surface(keyboard->focus); +- +- if (seat->focused_surface) { +- struct shell_surface *shsurf = get_shell_surface(seat->focused_surface); +- if (shsurf) +- shell_surface_activate(shsurf); +- } ++ /* FIXME: To be removed later. */ + } + + /* The surface will be inserted into the list immediately after the link +@@ -2438,6 +2423,7 @@ desktop_surface_removed(struct weston_desktop_surface *desktop_surface, + struct shell_surface *shsurf_child, *tmp; + struct weston_surface *surface = + weston_desktop_surface_get_surface(desktop_surface); ++ struct weston_seat *seat; + + if (!shsurf) + return; +@@ -2448,6 +2434,18 @@ desktop_surface_removed(struct weston_desktop_surface *desktop_surface, + } + wl_list_remove(&shsurf->children_link); + ++ wl_list_for_each(seat, &shsurf->shell->compositor->seat_list, link) { ++ struct shell_seat *shseat = get_shell_seat(seat); ++ /* activate() controls the focused surface activation and ++ * removal of a surface requires invalidating the ++ * focused_surface to avoid activate() use a stale (and just ++ * removed) surface when attempting to de-activate it. It will ++ * also update the focused_surface once it has a chance to run. ++ */ ++ if (surface == shseat->focused_surface) ++ shseat->focused_surface = NULL; ++ } ++ + wl_signal_emit(&shsurf->destroy_signal, shsurf); + + if (shsurf->fullscreen.black_view) +@@ -3836,6 +3834,7 @@ activate(struct desktop_shell *shell, struct weston_view *view, + struct workspace *ws; + struct weston_surface *old_es; + struct shell_surface *shsurf, *shsurf_child; ++ struct shell_seat *shseat = get_shell_seat(seat); + + main_surface = weston_surface_get_main_surface(es); + shsurf = get_shell_surface(main_surface); +@@ -3855,6 +3854,16 @@ activate(struct desktop_shell *shell, struct weston_view *view, + + weston_view_activate(view, seat, flags); + ++ if (shseat->focused_surface) { ++ struct shell_surface *current_focus = ++ get_shell_surface(shseat->focused_surface); ++ assert(current_focus); ++ shell_surface_deactivate(current_focus); ++ } ++ ++ shseat->focused_surface = main_surface; ++ shell_surface_activate(shsurf); ++ + state = ensure_focus_state(shell, seat); + if (state == NULL) + return; +-- +2.34.1 + diff --git a/meta/recipes-graphics/wayland/weston_8.0.0.bb b/meta/recipes-graphics/wayland/weston_8.0.0.bb index 2b120d7404..e647fbc686 100644 --- a/meta/recipes-graphics/wayland/weston_8.0.0.bb +++ b/meta/recipes-graphics/wayland/weston_8.0.0.bb @@ -12,6 +12,9 @@ SRC_URI = "https://wayland.freedesktop.org/releases/${BPN}-${PV}.tar.xz \ file://systemd-notify.weston-start \ file://xwayland.weston-start \ file://0001-weston-launch-Provide-a-default-version-that-doesn-t.patch \ + file://0002-desktop-shell-Remove-no-op-de-activation-of-the-xdg-.patch \ + file://0003-desktop-shell-Rename-gain-lose-keyboard-focus-to-act.patch \ + file://0004-desktop-shell-Embed-keyboard-focus-handle-code-when-.patch \ " SRC_URI[md5sum] = "53e4810d852df0601d01fd986a5b22b3" SRC_URI[sha256sum] = "7518b49b2eaa1c3091f24671bdcc124fd49fc8f1af51161927afa4329c027848" From patchwork Sun Jan 9 22:04:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2164 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6C19C433EF for ; Sun, 9 Jan 2022 22:04:51 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.web09.23866.1641765891212491831 for ; Sun, 09 Jan 2022 14:04:51 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=Jk8y0K/d; spf=softfail (domain: sakoman.com, ip: 209.85.216.47, mailfrom: steve@sakoman.com) Received: by mail-pj1-f47.google.com with SMTP id l16-20020a17090a409000b001b2e9628c9cso13973854pjg.4 for ; Sun, 09 Jan 2022 14:04:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=jmvGlCt+wgbuiDk0KXHutaZG/0KYl4csD2PUxA6kZQY=; b=Jk8y0K/dKlmeC4M8FV9x6Dbh1Aj1bD2d6l4h0IUbAf2fgReRWIiXOvbJRiAHGOKY9C RXuE9ZJWiJQ0dTh1D9ogBS4w8PI4k1dfONCTBPm37xhLBDnFVVrpASGXfqMbx8qM/ItX BpcCdPXLVoWrLWhspBOuQf8z1tEwLD3TFauv1VsWJe9R1KsZcwdxjCpc9o/FgYmwBZK1 81oO35g+vjPvhBThYoVXRvpSfQpA5D327GOOvorn8pY9i8xLBJMe/GXUoynBJMJ6+jMv pni/ypQ8wLXMX+KPO+L3Ffym+yJBrdTSv6VIh2KNItFqCOBC9DRDYXsmeHAOYvAmfFY9 sfkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=jmvGlCt+wgbuiDk0KXHutaZG/0KYl4csD2PUxA6kZQY=; b=23iPSM36eDdIE/KgYwq4OJ41rswXm1zue+5+Ded3JWMsN2/1c+/BRXAPfAXAzgB1YH cOFz+V4k0FUIBt5A6gtsZXikiIJi93+jDcXakStZYkPm2HhU2lKnlYrHvo6NoByFMgw9 Xgjx24rwvCu5Oi5zq/jPhaPtwNQoKMWfrfWeo1Vy/d6lG/sgUaOVAvu2Ij++so/vPV/j ugHAhVhOyaadBltNoam3lwCQwr1nGP3Mbu8ll5RDnhx4Swt2z0eqyMrUj3+iJZlYfmPe 4Si6OgsXlMAmuYwpZlKL1wL9qbf8moI7oBpqf3i9cNfwQYiINUiN/Qfg1aCdEqjf0nWj sS5w== X-Gm-Message-State: AOAM532B6LpZrK8UQGdHi4VMge1eWa3wz8LvX5Ya+YfdfA00AEPbosgV JEZQyF/TFvJ3ERrmQ4vUMP3zVTmLRCtV9ExZkhY= X-Google-Smtp-Source: ABdhPJz8Snd61OIWjWO/1qOBR4yKl9i+zYknXYgz5ynjQIUi/YTAzlHBxz67zSGGRZMJ/YSTKGsD7Q== X-Received: by 2002:a17:90b:a0f:: with SMTP id gg15mr27340583pjb.8.1641765890276; Sun, 09 Jan 2022 14:04:50 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:49 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 08/12] scripts/buildhistory-diff: drop use of distutils Date: Sun, 9 Jan 2022 12:04:12 -1000 Message-Id: <15b1a82b4cdfadeaf89489929e10aaf9a0edd13d.1641765639.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160299 From: Tim Orling The use of distutils.version.LooseVersion to check for GitPython > 0.3.1 is not really needed anymore since any supported distribution has at least 1.0.0 (centos-7 via epel7, debian-9, ubuntu-16.04) If we want to reinstate this check, alternatives would be to require python3-packaging on all hosts and use packaging.version.Version or use an imported LooseVersion in bb.version. [YOCTO #14610] Signed-off-by: Tim Orling Signed-off-by: Richard Purdie (cherry picked from commit bc90dcae9f53ddc246942f4d9b8ae8943e3b9754) Signed-off-by: Steve Sakoman --- scripts/buildhistory-diff | 5 ----- 1 file changed, 5 deletions(-) diff --git a/scripts/buildhistory-diff b/scripts/buildhistory-diff index 833f7c33a5..02eedafd6e 100755 --- a/scripts/buildhistory-diff +++ b/scripts/buildhistory-diff @@ -11,7 +11,6 @@ import sys import os import argparse -from distutils.version import LooseVersion # Ensure PythonGit is installed (buildhistory_analysis needs it) try: @@ -71,10 +70,6 @@ def main(): parser = get_args_parser() args = parser.parse_args() - if LooseVersion(git.__version__) < '0.3.1': - sys.stderr.write("Version of GitPython is too old, please install GitPython (python-git) 0.3.1 or later in order to use this script\n") - sys.exit(1) - if len(args.revisions) > 2: sys.stderr.write('Invalid argument(s) specified: %s\n\n' % ' '.join(args.revisions[2:])) parser.print_help() From patchwork Sun Jan 9 22:04:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2165 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EE34C433EF for ; Sun, 9 Jan 2022 22:04:54 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.web12.23599.1641765893335967005 for ; Sun, 09 Jan 2022 14:04:53 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=hkroNLaL; spf=softfail (domain: sakoman.com, ip: 209.85.216.54, mailfrom: steve@sakoman.com) Received: by mail-pj1-f54.google.com with SMTP id o3so271479pjs.1 for ; Sun, 09 Jan 2022 14:04:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=l/2+OK+PnP2Qfqte71BHYz6UX0nkZEzK3x7wWlDzrVg=; b=hkroNLaLFiRb/QbfgFZIT0Paqnhg0TlhtpwyoBx9ry41VKJ6rjIzcSq0dng7CCpeMx /fnXvkCHi2o2rzZhPkwfjlkS7p8BZL81ebPi1TPFprbdMBglq/UgLylaidelYABXumyW 3n98H2CiJXU3k7W0nPhrdX+uAutjX6V5MA6u2uhFxe9O/cCr/g7CrzStx6B36KpG6/fB 3Hb4LSeKs/xgGrIz5A6m822u1EtjSoNM5/TrXFPxcQPW3E7LPEV7oENiS2z2BkKyOKeK s1gBvWHL8o9x/0Mp7TPKK34WyN0wy4KCtSVCNpWOGnYwsmxVHsOXlCWQ7alhEIIq/Uka IgFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=l/2+OK+PnP2Qfqte71BHYz6UX0nkZEzK3x7wWlDzrVg=; b=3ERfMoy1xqwbOZeCyIzu71FAFGe0HZDgHdAMOh4QxtFkjwcVrVIzqZyDLeCi7SpQEE wCGXB13n7i+w5/wiCw6Wos+6GZZ1jWmfLVKs34Ih37+MOYNPaMt+fP/udRtYU9ddoTy9 zs35h61MDvDt3mcs0R7eXW2lNSLVbG367yj9EDJFbhAzLfAXEyJJlwKxSuZqbbngPIRi zzg0vk82pTj0MRaHIVF89Vce578INlBEdYlpKFob37iZSGlAsRFYQWPbqu8KR9L2/Xyi vGyR538yKDr6HBclWokPRBQtUL6Yt6zC2uGwd0PKnVBiY1WvdGn/ZuGmZ9tnoB9Cupup tSGA== X-Gm-Message-State: AOAM531RivUBSt10+Aj0DsO/shYnHEVVOqJtclTOfL3frXr5BzjbQjnh JhWVbrdA3rqx5G0jdAI2XNnlKhsk1jpagY3qF/4= X-Google-Smtp-Source: ABdhPJzbE8xWswY5P06LGOshulHuvav832X2lkcn69PRJWk8AvEdsLn51SNp5nmXY5VRzTb5JUm+Bw== X-Received: by 2002:a17:90b:1086:: with SMTP id gj6mr2338376pjb.168.1641765892495; Sun, 09 Jan 2022 14:04:52 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:51 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 09/12] selftest: skip virgl test on fedora 35 Date: Sun, 9 Jan 2022 12:04:13 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160300 This test will fail any time the host has libdrm > 2.4.107 Signed-off-by: Steve Sakoman --- meta/lib/oeqa/selftest/cases/runtime_test.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/lib/oeqa/selftest/cases/runtime_test.py b/meta/lib/oeqa/selftest/cases/runtime_test.py index f5b3ba27a9..20dc1c9482 100644 --- a/meta/lib/oeqa/selftest/cases/runtime_test.py +++ b/meta/lib/oeqa/selftest/cases/runtime_test.py @@ -183,6 +183,8 @@ class TestImage(OESelftestTestCase): self.skipTest('virgl isn\'t working with Centos 8') if distro and distro == 'fedora-34': self.skipTest('virgl isn\'t working with Fedora 34') + if distro and distro == 'fedora-35': + self.skipTest('virgl isn\'t working with Fedora 35') if distro and distro == 'opensuseleap-15.0': self.skipTest('virgl isn\'t working with Opensuse 15.0') From patchwork Sun Jan 9 22:04:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2166 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE4FBC433EF for ; Sun, 9 Jan 2022 22:04:55 +0000 (UTC) Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by mx.groups.io with SMTP id smtpd.web12.23601.1641765895413369424 for ; Sun, 09 Jan 2022 14:04:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=kt0ceJDo; spf=softfail (domain: sakoman.com, ip: 209.85.215.173, mailfrom: steve@sakoman.com) Received: by mail-pg1-f173.google.com with SMTP id i8so9566683pgt.13 for ; Sun, 09 Jan 2022 14:04:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=/pMMuvEIxqYW3KIHpo8lVa/BPpMSpvsIZgJEWPjPMzk=; b=kt0ceJDo88pbLRrGI4s7vRYvh2qL+omL3MKUcCx8fHKSTrn9gFZNNZor7gm4pnvD+c zz67Wvte92y/ZbJxLmwp/T4bEB8u1ecR9Zs1SVt+MC6k0TvGgVI0Y/4VyMlT6y4WGJZb jZ0VCZC4urr52DGCdlS9JOcBohjeU5qNvPavnpJm8D9dTk8rgBrS97548h2uEIb/ZGSt kLH3b3k7VO3wDAlB8g9IanskRUc549LqELoPuj3zuQR6j/ZUXdQxZFYmDZ5AhUU4p6hq cLOFc/8LCzNVQYqlCFIv1C3yaQeskaWCp7VnGXZ6dlB+OTeHKtF76iGXcgo/5pzEU8He Rclg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=/pMMuvEIxqYW3KIHpo8lVa/BPpMSpvsIZgJEWPjPMzk=; b=5N7Ahn5PiTic2U0xKyX97yGet0bECFv225JWIj40I2yx1ZXtD9np93Xe/ImZvmYaeV MW1uYtVXUVtf1eWiSjmtsuKrgsOUomqTs3KarpBap1LZX8szhaqrZg/TtXSdW/uKuWjU w+E66S3aZ4rJAPYMsyYwToSI3Bj8+JjwHQJLpTxvbASjUncNa5i9555wrtUGPmefAy7h sxs6Lo8a9pEXqUeBzl87DMmCjAqJc1XSI2Dwa/636MNIcN/a6uUtFuwr0EAOBWfZ6UB+ 4vA22LAhhJ3bBad36OHBMyQR2PlSX/H7yqiPmnKS07b3N/yvc5DzGlQmu/4/xD95b4qF zsJg== X-Gm-Message-State: AOAM530IVTwV1GEbOSawCB77mZblkeJ3jvZlPAo3sNsbQVQDE/WvuEks I1wTu0lePKBsRkyEJmLd6T7DJCFo17OYr0uQgMk= X-Google-Smtp-Source: ABdhPJzt4H+Jdy3w4jjJueEzFOe9y2YqBvAf1E0WxkQdnNM6NGKn/3i8yZHRF+Vo/7LVKu3wcEgGxg== X-Received: by 2002:a63:7a10:: with SMTP id v16mr4743541pgc.453.1641765894531; Sun, 09 Jan 2022 14:04:54 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:54 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 10/12] scripts: Update to use exec_module() instead of load_module() Date: Sun, 9 Jan 2022 12:04:14 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160301 From: Richard Purdie This is deprecated in python 3.12 and Fedora 35 is throwing warnings so move to the new functions. Signed-off-by: Richard Purdie (cherry picked from commit 655cd3f614d736416eab0d708b7c49674bf5c977) Signed-off-by: Steve Sakoman --- scripts/lib/scriptutils.py | 7 +++++-- scripts/lib/wic/pluginbase.py | 8 ++++++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/scripts/lib/scriptutils.py b/scripts/lib/scriptutils.py index 3164171eb2..47a08194d0 100644 --- a/scripts/lib/scriptutils.py +++ b/scripts/lib/scriptutils.py @@ -18,7 +18,8 @@ import sys import tempfile import threading import importlib -from importlib import machinery +import importlib.machinery +import importlib.util class KeepAliveStreamHandler(logging.StreamHandler): def __init__(self, keepalive=True, **kwargs): @@ -82,7 +83,9 @@ def load_plugins(logger, plugins, pluginpath): logger.debug('Loading plugin %s' % name) spec = importlib.machinery.PathFinder.find_spec(name, path=[pluginpath] ) if spec: - return spec.loader.load_module() + mod = importlib.util.module_from_spec(spec) + spec.loader.exec_module(mod) + return mod def plugin_name(filename): return os.path.splitext(os.path.basename(filename))[0] diff --git a/scripts/lib/wic/pluginbase.py b/scripts/lib/wic/pluginbase.py index d9b4e57747..b64568339b 100644 --- a/scripts/lib/wic/pluginbase.py +++ b/scripts/lib/wic/pluginbase.py @@ -9,9 +9,11 @@ __all__ = ['ImagerPlugin', 'SourcePlugin'] import os import logging +import types from collections import defaultdict -from importlib.machinery import SourceFileLoader +import importlib +import importlib.util from wic import WicError from wic.misc import get_bitbake_var @@ -54,7 +56,9 @@ class PluginMgr: mname = fname[:-3] mpath = os.path.join(ppath, fname) logger.debug("loading plugin module %s", mpath) - SourceFileLoader(mname, mpath).load_module() + spec = importlib.util.spec_from_file_location(mname, mpath) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) return PLUGINS.get(ptype) From patchwork Sun Jan 9 22:04:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2167 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9ABAC433EF for ; Sun, 9 Jan 2022 22:04:57 +0000 (UTC) Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by mx.groups.io with SMTP id smtpd.web11.23929.1641765897478945474 for ; Sun, 09 Jan 2022 14:04:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=VaAPmLtn; spf=softfail (domain: sakoman.com, ip: 209.85.210.182, mailfrom: steve@sakoman.com) Received: by mail-pf1-f182.google.com with SMTP id w204so1079105pfc.7 for ; Sun, 09 Jan 2022 14:04:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=5rdn3sETpw3C/6p3Jv2YAV/SlycSKf35DwSm9pIexbY=; b=VaAPmLtn6LAIXumLePKpwe4fvSs9vnXGBI0NR69/L21ptzpezTngiWgG/m4BH4tBdg JNVuhMGC0k7vvZHoNR43iWUL7h2OHXkmWhbohDhzmeJ7SyNKmFvNPX6qs+EH14W2KaCh SJU2iUVfT4w6U1cdeKylU54FGxXjc3z58QqhmaU0wl5yLU4bYMyghn7DhSiflJ7oolLj FujRYmZ5L3HbIfVlcoERdwU0UA2b12EpJrKMrkPUBEI9T8fJgiy1PODbD0VqNpowebvi zJ0JiUCPjQwHIz2RgrhvFIb3Jb1WLBcFSSd8UzbsFd70iDRd20mbNqw11MCQxk802uxu rD7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=5rdn3sETpw3C/6p3Jv2YAV/SlycSKf35DwSm9pIexbY=; b=dK/T2b13WFPkOZIHieHbQwfcB4YdT3glm7d1xDqQ1WhjbJxVP5EYvpr5/8/MO/btES 8HaBLEXxcMPPlos+ru7oJ56LXnwCwjIqN2ixGoRRoWRLyRHhvkW2xOhTMi3GNZwDnGgJ tvZQ0zemhquYYaSxAW3fPBZLbL9lNKkzJZ8ONxvUL4yJDi1IzRPcdQCKwu4UDRn6b83S yq9J21XMGgU9l8AA7RUhVJUKdB85ug5rZKoBS3I9YilZsm/Z3l3kPg9h8mTFe2LMJsCB wqdoQZ45MO60XMUHCw2Yf9voQh0vwbJpLgzu+QvEI6t1YVnI6Jn7nykOWC3fjspe7YmR lQig== X-Gm-Message-State: AOAM533c132k/EqWNE+tdrx/i7d3nbLuoUd3Q4PJgmlq5WWQ6GNn2Otc 2l+SkQ2pviILl/Ltpl31A8BlldwnonpgIt4M2CQ= X-Google-Smtp-Source: ABdhPJx9gu/NiEWVUAeqKScBZ2syiHJaLTOUqFVIJoUcxSCySJiCdpmd94QK7mAhMzEL8Ex/m6cCXQ== X-Received: by 2002:aa7:8043:0:b0:4bc:1e18:466e with SMTP id y3-20020aa78043000000b004bc1e18466emr53915793pfm.49.1641765896680; Sun, 09 Jan 2022 14:04:56 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:56 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 11/12] lib/oe/reproducible: correctly set .git location when recursively looking for git repos Date: Sun, 9 Jan 2022 12:04:15 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:04:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160302 From: Alexander Kanavin Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit ffdaa1a0527691d66dd28e86bd015bfad7a020f6) Signed-off-by: Steve Sakoman --- meta/lib/oe/reproducible.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oe/reproducible.py b/meta/lib/oe/reproducible.py index 204b9bd734..0938e4cb39 100644 --- a/meta/lib/oe/reproducible.py +++ b/meta/lib/oe/reproducible.py @@ -41,7 +41,7 @@ def find_git_folder(d, sourcedir): for root, dirs, files in os.walk(workdir, topdown=True): dirs[:] = [d for d in dirs if d not in exclude] if '.git' in dirs: - return root + return os.path.join(root, ".git") bb.warn("Failed to find a git repository in WORKDIR: %s" % workdir) return None From patchwork Sun Jan 9 22:04:16 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Sakoman X-Patchwork-Id: 2168 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0658C433EF for ; Sun, 9 Jan 2022 22:05:00 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.web11.23930.1641765900009200763 for ; Sun, 09 Jan 2022 14:05:00 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20210112.gappssmtp.com header.s=20210112 header.b=IEWvjS9f; spf=softfail (domain: sakoman.com, ip: 209.85.214.173, mailfrom: steve@sakoman.com) Received: by mail-pl1-f173.google.com with SMTP id e19so3719645plc.10 for ; Sun, 09 Jan 2022 14:04:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20210112.gappssmtp.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=Ssi1YGS6CogmkGD/uwzSx/Ld5cDtzrZhhFxd5+XTI/w=; b=IEWvjS9fAujiRIatdj36SI+qqgGIL0Bd2RKuNt02je4EVr20EA0BQbPsYpGoNnGdFg fMnX+Hr07+I9r2kcPC1vgCZshDq5pQMBK0avSV73w30N/k1e0vFKutnH90vmDlawADpC qmQ297rQRYEiqI1mtlP/+yA+l7hsPWrWRPNgSdR6FBcJP2tF6kFlRqvcHFAR++KhIxGi XAVZu3jTdm95l9w4byIylq56wPWCrGlo7yq0x0VFDC1WzSuSvxmU8uKCDIApkxbhmhok HXDGlseiaEpo17vpM3U86zDxmw2eSdqCLGz+YULSCB4iYYYZuSXS2pQa2qitjNQyXaz8 ZIKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Ssi1YGS6CogmkGD/uwzSx/Ld5cDtzrZhhFxd5+XTI/w=; b=j+PWhd0V3tHRJZetfz1fHAhqzfJoZodJB6NiS34eYALsZGc95ykUWxPvdzAp8q9WcH JDMz1RQnKpK48T2rEVuIY6ciBHMeAIOcp9d+hZKxDGJss6gKliXJxg24YQ94XOE+Qwh4 qS02QLNUX8wWzPNWsSncj9J5L6WHEcXaKvYZjTP0XJTn2GpGB/nSpMVvujph+t5LiFu5 1ZouFsYScXycQhKDaV2rKgMIOP4/nfy4nux9CS5zUsb3Ep7f6QlZTF3lmG4MqX8UCrd/ z/owzREm0Ijh3actYb4Uki4y2k+F3Cf9MUHP3l6Xo0u57+nAdgUFX4olUU0MD42LtBOH n/KQ== X-Gm-Message-State: AOAM531FqvGr9vOHDRDfrWZNuatUPL5fG+7VwbwcEhZ50y/P+09jJDFT sDwXuq4xwW9Qg3rr9NZbq0P4veda0eH4aovkeuA= X-Google-Smtp-Source: ABdhPJzJ+cRwe71v/AbcZavijPkBb7Auz1I+GLkThI6nEk5BMJixcej586mZIWa31Mxbh3LX82Kxaw== X-Received: by 2002:a17:902:6e01:b0:149:8800:58b7 with SMTP id u1-20020a1709026e0100b00149880058b7mr58325992plk.47.1641765899087; Sun, 09 Jan 2022 14:04:59 -0800 (PST) Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id k10sm4426150pfi.52.2022.01.09.14.04.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Jan 2022 14:04:58 -0800 (PST) From: Steve Sakoman To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 12/12] asciidoc: properly detect and compare Python versions >= 3.10 Date: Sun, 9 Jan 2022 12:04:16 -1000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 09 Jan 2022 22:05:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/160303 asciidoc.py cannot properly detect versions of Python >= 3.10 Backport patch from upstream to correct this: https://github.com/asciidoc-py/asciidoc-py/commit/44d2d6095246124c024230f89c1029794491839f Fixed upstream in version 9.04, so this patch is not required in master. Signed-off-by: Steve Sakoman --- .../asciidoc/detect-python-version.patch | 42 +++++++++++++++++++ .../asciidoc/asciidoc_8.6.9.bb | 3 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch diff --git a/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch b/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch new file mode 100644 index 0000000000..14c1cd806e --- /dev/null +++ b/meta/recipes-extended/asciidoc/asciidoc/detect-python-version.patch @@ -0,0 +1,42 @@ +From 44d2d6095246124c024230f89c1029794491839f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Fri, 30 Oct 2020 15:10:35 +0100 +Subject: [PATCH] Properly detect and compare Python version 3.10+ (#151) + +Upstream commit: https://github.com/asciidoc-py/asciidoc-py/commit/44d2d6095246124c024230f89c1029794491839f + +Slightly modified to cleanly apply to asciidoc 8.6.9: +- VERSION and MIN_PYTHON_VERSION changed to reflect values in 8.6.9 +- line numbers corrected to eliminate offset warnings + +Upstream-Status: Backport +Signed-off-by: Steve Sakoman + +--- + asciidoc.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/asciidoc.py b/asciidoc.py +index f960e7d8..42868c4b 100755 +--- a/asciidoc.py ++++ b/asciidoc.py +@@ -30,7 +30,7 @@ + # Used by asciidocapi.py # + VERSION = '8.6.10' # See CHANGELOG file for version history. + +-MIN_PYTHON_VERSION = '3.4' # Require this version of Python or better. ++MIN_PYTHON_VERSION = (3, 4) # Require this version of Python or better. + + # --------------------------------------------------------------------------- + # Program constants. +@@ -4704,8 +4704,8 @@ def init(self, cmd): + directory. + cmd is the asciidoc command or asciidoc.py path. + """ +- if float(sys.version[:3]) < float(MIN_PYTHON_VERSION): +- message.stderr('FAILED: Python %s or better required' % MIN_PYTHON_VERSION) ++ if sys.version_info[:2] < MIN_PYTHON_VERSION: ++ message.stderr('FAILED: Python %d.%d or better required' % MIN_PYTHON_VERSION) + sys.exit(1) + if not os.path.exists(cmd): + message.stderr('FAILED: Missing asciidoc command: %s' % cmd) diff --git a/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb b/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb index 932339f739..62738dc8d9 100644 --- a/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb +++ b/meta/recipes-extended/asciidoc/asciidoc_8.6.9.bb @@ -9,7 +9,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b \ file://COPYRIGHT;md5=029ad5428ba5efa20176b396222d4069" SRC_URI = "git://github.com/asciidoc/asciidoc-py3;protocol=https;branch=main \ - file://auto-catalogs.patch" + file://auto-catalogs.patch \ + file://detect-python-version.patch" SRCREV = "618f6e6f6b558ed1e5f2588cd60a5a6b4f881ca0" PV .= "+py3-git${SRCPV}"