arm-toolchain: ignore CVE-2019-15847 CVE-2021-37322

CVE-2019-15847 is a bug in gcc POWER9 back-end, which is not relevant
for ARM architecture. (It has been fixed in gcc 8.4, 9.3, and 10.1).

CVE-2021-37322 is a bug in c++filt, which is part of binutils rather
than gcc. The issue was fixed in binutils 2.32 (poky has 2.34).

These exclusions are needed only in the dunfell branch, as it is the
only one with affected gcc versions. Master branch has gcc 11.2,
hardknott has 10.2, and honister has 10.3.

Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>

.gitlab-ci.yml

@@ -1,39 +1,50 @@
-# Use our custom Crops-derived image
-image: $CI_REGISTRY/$CI_PROJECT_NAMESPACE/yocto-builder:master
+image: ghcr.io/siemens/kas/kas:latest-release
 
   # First do a common bootstrap, and then build all the targets
 stages:
+  - prep
   - bootstrap
   - build
 
 # Common job fragment to get a worker ready
 .setup:
-  # Retry because the runner is flakey (see https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2890)
-  retry: 2
   stage: build
   variables:
     KAS_WORK_DIR: $CI_PROJECT_DIR/work
+    KAS_REPO_REF_DIR: $CI_BUILDS_DIR/persist/repos
     SSTATE_DIR: $CI_BUILDS_DIR/persist/sstate
     DL_DIR: $CI_BUILDS_DIR/persist/downloads
-    BB_LOGCONFIG: $CI_PROJECT_DIR/kas/logging.yml
+    BB_LOGCONFIG: $CI_PROJECT_DIR/ci/logging.yml
+    IMAGE_DIR: $CI_PROJECT_DIR/work/build/tmp/deploy/images
   before_script:
     - echo KAS_WORK_DIR = $KAS_WORK_DIR
     - echo SSTATE_DIR = $SSTATE_DIR
     - echo DL_DIR = $DL_DIR
-    - mkdir --verbose --parents $KAS_WORK_DIR $SSTATE_DIR $DL_DIR
+    - rm -rf $KAS_WORK_DIR
+    - mkdir --verbose --parents $KAS_WORK_DIR $KAS_REPO_REF_DIR $SSTATE_DIR $DL_DIR
 
 # Generalised fragment to do a Kas build
 .build:
   extends: .setup
+  interruptible: true
   script:
-  - KASFILES=$(kas/jobs-to-kas $CI_JOB_NAME)
-  - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
-  - kas build $KASFILES
-  - ./kas/check-warnings $KAS_WORK_DIR/build/warnings.log
+    - KASFILES=$(./ci/jobs-to-kas $CI_JOB_NAME)
+    - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
+    - kas build $KASFILES
+    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
+
+#
+# Prep stage, update repositories once
+#
+update-repos:
+  extends: .setup
+  stage: prep
+  script:
+  - flock --verbose --timeout 60 $KAS_REPO_REF_DIR ./ci/update-repos
 
 
 #
-# First phase, bootstrap and machine coverage
+# Bootstrap stage, bootstrap and machine coverage
 #
 
 # Build a number of native tools first to ensure the other builders don't race
@@ -46,12 +57,12 @@ n1sdp/bootstrap:
 machine-coverage:
   stage: bootstrap
   script:
-  - ./kas/check-machine-coverage
+  - ./ci/check-machine-coverage
   coverage: '/Coverage: \d+/'
 
 
 #
-# Second phase, the actual build jobs
+# Build stage, the actual build jobs
 #
 
 a5ds:
@@ -78,6 +89,12 @@ n1sdp:
 n1sdp/armgcc:
   extends: .build
 
+qemuarm/testimage:
+  extends: .build
+
+qemuarmv5/testimage:
+  extends: .build
+
 tc0:
   extends: .build
 
@@ -86,18 +103,42 @@ tc0:
 # Utility tasks, not executed automatically
 #
 
-# Report on disk usage
-usage:
+delete-dl-dir:
   extends: .setup
-  stage: bootstrap
+  stage: prep
   when: manual
   script:
-  - du -h -s $DL_DIR $SSTATE_DIR
+  - rm -rf $DL_DIR/*
+
+delete-repo-dir:
+  extends: .setup
+  stage: prep
+  when: manual
+  script:
+  - rm -rf $KAS_REPO_REF_DIR/*
+
+# Delete all sstate
+delete-sstate:
+  extends: .setup
+  stage: prep
+  when: manual
+  script:
+  - rm -rf $SSTATE_DIR/*
 
 # Wipe out old sstate
 prune-sstate:
   extends: .setup
-  stage: bootstrap
+  stage: prep
   when: manual
   script:
+  - du -h -s $SSTATE_DIR
   - find $SSTATE_DIR -type f -atime +30 -delete
+  - du -h -s $SSTATE_DIR
+
+# Report on disk usage
+usage:
+  extends: .setup
+  stage: prep
+  when: manual
+  script:
+  - du -h -s $DL_DIR $SSTATE_DIR $KAS_REPO_REF_DIR

ci/base.yml

@@ -34,10 +34,10 @@ local_conf_header:
     PACKAGE_CLASSES = "package_ipk"
     LICENSE_FLAGS_WHITELIST += "armcompiler"
     PACKAGECONFIG_remove_pn-qemu-system-native = "gtk+ sdl"
+    EXTRA_IMAGE_FEATURES_append = " debug-tweaks"
     BB_NUMBER_THREADS = "16"
     PARALLEL_MAKE = "-j16"
     INHERIT += "rm_work"
-    ERROR_QA = "${WARN_QA}"
   ptest: |
     DISTRO_FEATURES_remove = "ptest"
 

ci/check-machine-coverage

@@ -13,11 +13,11 @@ if metaarm.name != "meta-arm":
 machines = metaarm.glob("meta-*/conf/machine/*.conf")
 machines = set(p.stem for p in machines)
 
-# All kas files
-kas = metaarm.glob("kas/*.yml")
-kas = set(p.stem for p in kas)
+# All ci files
+ci = metaarm.glob("ci/*.yml")
+ci = set(p.stem for p in ci)
 
-missing = machines - kas
+missing = machines - ci
 print(f"The following machines are missing: {', '.join(sorted(missing))}.")
 
 covered = len(machines) - len(missing)

ci/jobs-to-kas

@@ -8,8 +8,8 @@ set -e -u
 # Read Job namne from $1 and split on /
 IFS=/ read -r -a PARTS<<<$1
 
-# Prefix each part with kas/
-PARTS=("${PARTS[@]/#/kas/}")
+# Prefix each part with ci/
+PARTS=("${PARTS[@]/#/ci/}")
 
 # Suffix each part with .yml
 PARTS=("${PARTS[@]/%/.yml}")

ci/qemuarm.yml

@@ -0,0 +1,6 @@
+header:
+  version: 9
+  includes:
+    - base.yml
+
+machine: qemuarm

ci/qemuarmv5.yml

@@ -0,0 +1,11 @@
+header:
+  version: 9
+  includes:
+    - base.yml
+
+machine: qemuarmv5
+
+local_conf_header:
+  bugs: |
+    # Remove parselogs until errors can be resolved
+    TEST_SUITES_remove = "parselogs"

ci/testimage.yml

@@ -0,0 +1,17 @@
+header:
+  version: 9
+
+local_conf_header:
+  testimage: |
+    IMAGE_CLASSES += "testimage"
+    TESTIMAGE_AUTO = "1"
+  slirp: |
+    TEST_RUNQEMUPARAMS = "slirp"
+    TEST_SERVER_IP = "127.0.0.1"
+    QEMU_USE_SLIRP = "1"
+  packages: |
+    IMAGE_FEATURES_append = " ssh-server-dropbear"
+
+# Multiple targets are available, put it down to just one
+target:
+  - core-image-base

ci/update-repos

@@ -0,0 +1,41 @@
+#! /usr/bin/env python3
+
+# Update clones of the repositories we need in KAS_REPO_REF_DIR to speed up fetches
+
+import sys
+import os
+import subprocess
+import pathlib
+
+def repo_shortname(url):
+    # Taken from Kas (Repo.__getattr__) to ensure the logic is right
+    from urllib.parse import urlparse
+    url = urlparse(url)
+    return ('{url.netloc}{url.path}'
+            .format(url=url)
+            .replace('@', '.')
+            .replace(':', '.')
+            .replace('/', '.')
+            .replace('*', '.'))
+
+repositories = (
+    "https://git.yoctoproject.org/git/poky",
+    "https://git.openembedded.org/meta-openembedded",
+    "https://git.yoctoproject.org/git/meta-virtualization",
+    "https://git.yoctoproject.org/git/meta-zephyr",
+    "https://github.com/kraj/meta-clang",
+)
+
+if __name__ == "__main__":
+    if "KAS_REPO_REF_DIR" not in os.environ:
+        print("KAS_REPO_REF_DIR needs to be set")
+        sys.exit(1)
+
+    base_repodir = pathlib.Path(os.environ["KAS_REPO_REF_DIR"])
+
+    for repo in repositories:
+        repodir = base_repodir / repo_shortname(repo)
+        if repodir.exists():
+            subprocess.run(["git", "-C", repodir, "fetch"], check=True)
+        else:
+            subprocess.run(["git", "clone", "--bare", repo, repodir], check=True)

meta-arm-bsp/recipes-devtools/gem5/gem5-aarch64-native_20.bb

@@ -21,7 +21,7 @@ require gem5-aarch64-native.inc
 require gem5-native.inc
 
 # Get rid of compiler errors when building protobuf
-GEM5_SCONS_ARGS_append = " CCFLAGS_EXTRA='-Wno-error=unused-variable' --verbose"
+GEM5_SCONS_ARGS_append = " CCFLAGS_EXTRA='-Wno-error=unused-variable -Wno-error=array-bounds -Wno-error=parentheses -Wno-type-limits' --verbose"
 
 # Get rid of linker errors and have a faster link process
 GEM5_SCONS_ARGS_append = " LDFLAGS_EXTRA='${BUILD_LDFLAGS}' \

meta-arm-bsp/recipes-kernel/linux/files/0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch

@@ -0,0 +1,54 @@
+Upstream-Status: Backport
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+
+From e33a814e772cdc36436c8c188d8c42d019fda639 Mon Sep 17 00:00:00 2001
+From: Dirk Mueller <dmueller@suse.com>
+Date: Tue, 14 Jan 2020 18:53:41 +0100
+Subject: [PATCH] scripts/dtc: Remove redundant YYLOC global declaration
+
+gcc 10 will default to -fno-common, which causes this error at link
+time:
+
+  (.text+0x0): multiple definition of `yylloc'; dtc-lexer.lex.o (symbol from plugin):(.text+0x0): first defined here
+
+This is because both dtc-lexer as well as dtc-parser define the same
+global symbol yyloc. Before with -fcommon those were merged into one
+defintion. The proper solution would be to to mark this as "extern",
+however that leads to:
+
+  dtc-lexer.l:26:16: error: redundant redeclaration of 'yylloc' [-Werror=redundant-decls]
+   26 | extern YYLTYPE yylloc;
+      |                ^~~~~~
+In file included from dtc-lexer.l:24:
+dtc-parser.tab.h:127:16: note: previous declaration of 'yylloc' was here
+  127 | extern YYLTYPE yylloc;
+      |                ^~~~~~
+cc1: all warnings being treated as errors
+
+which means the declaration is completely redundant and can just be
+dropped.
+
+Signed-off-by: Dirk Mueller <dmueller@suse.com>
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+[robh: cherry-pick from upstream]
+Cc: stable@vger.kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+---
+ scripts/dtc/dtc-lexer.l | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/scripts/dtc/dtc-lexer.l b/scripts/dtc/dtc-lexer.l
+index 5c6c3fd557d7..b3b7270300de 100644
+--- a/scripts/dtc/dtc-lexer.l
++++ b/scripts/dtc/dtc-lexer.l
+@@ -23,7 +23,6 @@ LINECOMMENT	"//".*\n
+ #include "srcpos.h"
+ #include "dtc-parser.tab.h"
+ 
+-YYLTYPE yylloc;
+ extern bool treesource_error;
+ 
+ /* CAUTION: this will stop working if we ever use yyless() or yyunput() */
+-- 
+2.30.2
+

meta-arm-bsp/recipes-kernel/linux/linux-arm64-ack-tc0.inc

@@ -8,6 +8,7 @@ SRC_URI_append = " \
     file://defconfig \
     file://0001-drm-Add-component-aware-simple-encoder.patch \
     file://0002-swap-red-and-blue-colors-in-HDLCD-driver.patch \
+    file://0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch \
     "
 
 KCONFIG_MODE = "--alldefconfig"

meta-arm-bsp/recipes-kernel/linux/linux-linaro-arm_4.19.bb

@@ -4,14 +4,13 @@ KBRANCH ?= "latest-4.19-armlt-19.01"
 
 require recipes-kernel/linux/linux-yocto.inc
 
-
 SRCREV_machine ?= "e97e8d868aba53467039dbef3b7436c857433ae3"
-
 SRCREV_meta ?= "ad6f8b357720ca8167a090713b7746230cf4b314"
 
 SRC_URI = "git://git.linaro.org/landing-teams/working/arm/kernel-release.git;name=machine;branch=${KBRANCH}; \
            git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-4.19;destsuffix=${KMETA} \
            file://0001-menuconfig-mconf-cfg-Allow-specification-of-ncurses-location.patch \
+           file://0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch \
           "
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"

meta-arm-bsp/recipes-kernel/linux/linux-linaro-arm_5.4.bb

@@ -13,6 +13,7 @@ KBRANCH = "n1sdp"
 
 SRC_URI = "git://git.linaro.org/landing-teams/working/arm/kernel-release.git;nobranch=1 \
            file://0001-menuconfig-mconf-cfg-Allow-specification-of-ncurses-location.patch \
+           file://0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch \
           "
 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
 

meta-arm-bsp/recipes-kernel/linux/linux-yocto_5.3.bb

@@ -6,7 +6,9 @@ SRCREV_machine = "d4f3318ed8fab6316cb7a269b8f42306632a3876"
 SRCREV_meta = "8d0ed83a864cc91eef4d2abbc90f13d4ecd1c213"
 
 SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \
-           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
+           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA} \
+           file://0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch \
+          "
 
 LINUX_VERSION = "5.3.18"
 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"

meta-arm-toolchain/conf/distro/include/external-arm-toolchain-versions.inc

@@ -139,19 +139,5 @@ python external_arm_toolchain_version_handler () {
     d.setVar('EAT_VER_KERNEL', eat_get_kernel_version(ld))
     d.setVar('EAT_VER_GDB', eat_get_gdb_version(ld))
     d.setVar('EAT_VER_BFD', eat_get_bfd_version(ld))
-
-    lc_libc = "LGPL-2.1"
-    lc_gcc = "GPL-3.0"
-    lc_rle = "GPL-3.0-with-GCC-exception"
-    lc_gdb = "GPL-3.0"
-    lc_bfd = "GPL-3.0"
-
-    d.setVar('EAT_LIBC_LICENSE', lc_libc)
-    d.setVar('EAT_GCC_LICENSE', lc_gcc)
-    d.setVar('EAT_RLE_LICENSE', lc_rle)
-    d.setVar('EAT_GDB_LICENSE', lc_gdb)
-    d.setVar('EAT_BFD_LICENSE', lc_bfd)
-
-    d.setVar('EAT_LICENSE', "%s & %s & %s & %s & %s" % (lc_libc, lc_gcc, lc_rle, lc_gdb, lc_bfd))
 }
 addhandler external_arm_toolchain_version_handler

meta-arm-toolchain/recipes-devtools/external-arm-toolchain/external-arm-sdk-toolchain.bb

@@ -1,5 +1,7 @@
 inherit cross-canadian
 
+require license.inc
+
 PN = "external-arm-sdk-toolchain-${TARGET_ARCH}"
 BPN = "external-arm-sdk-toolchain"
 PV = "${EAT_VER_MAIN}"
@@ -10,9 +12,6 @@ INHIBIT_SYSROOT_STRIP = "1"
 INHIBIT_DEFAULT_DEPS = "1"
 EXCLUDE_FROM_SHLIBS = "1"
 
-EAT_LICENSE ??= ""
-
-LICENSE = "${EAT_LICENSE}"
 LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302"
 
 # Skip packaging QA checks for prebuilt binaries

meta-arm-toolchain/recipes-devtools/external-arm-toolchain/license.inc

@@ -1,7 +1,10 @@
 LICENSE = "GPL-3.0-with-GCC-exception & GPLv3 & GPLv2 & LGPLv3 & LGPLv2.1 & LGPLv2"
 
+EAT_BFD_LICENSE = "GPL-3.0"
 EAT_GCC_LICENSE = "GPL-3.0-with-GCC-exception & GPLv3"
+EAT_GDB_LICENSE = "GPL-3.0"
 EAT_LIBC_LICENSE = "GPLv2 & LGPLv2.1"
+EAT_RLE_LICENSE = "GPL-3.0-with-GCC-exception"
 
 LICENSE_${PN} = "${EAT_LIBC_LICENSE}"
 LICENSE_${PN}-dev = "${EAT_LIBC_LICENSE}"

meta-arm-toolchain/recipes-devtools/gcc/gcc-arm-8.2.inc

@@ -4,6 +4,12 @@ BASEPV = "8.2"
 PV = "arm-${BASEPV}"
 CVE_VERSION = "${BASEPV}"
 
+# CVE-2019-15847 is only relevant to POWER9 architecture
+CVE_CHECK_WHITELIST += "CVE-2019-15847"
+
+# CVE-2021-37322 is in binutils < 2.32, not in gcc
+CVE_CHECK_WHITELIST += "CVE-2021-37322"
+
 MMYY = "19.01"
 RELEASE = "20${MMYY}"
 PR = "r${RELEASE}"

meta-arm-toolchain/recipes-devtools/gcc/gcc-arm-8.3.inc

@@ -9,6 +9,12 @@ RELEASE = "20${MMYY}"
 PR = "r${RELEASE}"
 BINV = "${BASEPV}.0"
 
+# CVE-2019-15847 is only relevant to POWER9 architecture
+CVE_CHECK_WHITELIST += "CVE-2019-15847"
+
+# CVE-2021-37322 is in binutils < 2.32, not in gcc
+CVE_CHECK_WHITELIST += "CVE-2021-37322"
+
 FILESEXTRAPATHS =. "${FILE_DIRNAME}/gcc-${BASEPV}:${FILE_DIRNAME}/gcc-${BASEPV}/backport:"
 
 DEPENDS =+ "mpfr gmp libmpc zlib flex-native"

meta-arm-toolchain/recipes-devtools/gcc/gcc-arm-9.2.inc

@@ -5,6 +5,12 @@ require recipes-devtools/gcc/gcc-common.inc
 PV = "arm-9.2"
 CVE_VERSION = "9.2"
 
+# CVE-2019-15847 is only relevant to POWER9 architecture
+CVE_CHECK_WHITELIST += "CVE-2019-15847"
+
+# CVE-2021-37322 is in binutils < 2.32, not in gcc
+CVE_CHECK_WHITELIST += "CVE-2021-37322"
+
 # BINV should be incremented to a revision after a minor gcc release
 
 BINV = "9.2.1"

meta-arm-toolchain/recipes-devtools/gcc/gcc-arm-9.2/0012-gcc-Fix-argument-list-too-long-error.patch

@@ -1,7 +1,7 @@
-From 2cb227cd8069c73242286f64183fb203f8d2618a Mon Sep 17 00:00:00 2001
+From faa0f712a67005ef0260f95eebe7c7c57a6f8360 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Fri, 29 Mar 2013 09:26:37 +0400
-Subject: [PATCH 12/36] gcc: Fix argument list too long error.
+Subject: [PATCH 12/39] gcc: Fix argument list too long error.
 
 There would be an "Argument list too long" error when the
 build directory is longer than 200, this is caused by:
@@ -17,24 +17,28 @@ $(sort list) doesn't need this.
 Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 
+RP: gcc then added *.h and *.def additions to this list, breaking the original
+fix. Add the sort to the original gcc code, leaving the tr+sort to fix the original
+issue but include the new files too as reported by Zhuang <qiuguang.zqg@alibaba-inc.com>
+
 Upstream-Status: Pending
 ---
  gcc/Makefile.in | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/gcc/Makefile.in b/gcc/Makefile.in
-index 41f0f592ff4..0064a282488 100644
+index fef6c4c61e3..57cf7804f0a 100644
 --- a/gcc/Makefile.in
 +++ b/gcc/Makefile.in
-@@ -3537,7 +3537,7 @@ install-plugin: installdirs lang.install-plugin s-header-vars install-gengtype
+@@ -3538,7 +3538,7 @@ install-plugin: installdirs lang.install-plugin s-header-vars install-gengtype
  # We keep the directory structure for files in config or c-family and .def
  # files. All other files are flattened to a single directory.
  	$(mkinstalldirs) $(DESTDIR)$(plugin_includedir)
 -	headers=`echo $(PLUGIN_HEADERS) $$(cd $(srcdir); echo *.h *.def) | tr ' ' '\012' | sort -u`; \
-+	headers="$(sort $(PLUGIN_HEADERS) $$(cd $(srcdir); echo *.h *.def))"; \
++	headers=`echo $(sort $(PLUGIN_HEADERS)) $$(cd $(srcdir); echo *.h *.def) | tr ' ' '\012' | sort -u`; \
  	srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`; \
  	for file in $$headers; do \
  	  if [ -f $$file ] ; then \
 -- 
-2.22.1
+2.25.1