tiff: backport upstream fix for CVE-2022-2867, CVE-2022-2868, CVE-2022-2869

See merge request !348

qemu: apply upstream fix for two CVEs

See merge request !345

Fixes upstream issue #352 (closed) where a buffer overflow was generated
by an uint underflow in tiffcrop.c computeInputPixelOffsets()
calculating (uint32_t)(0 - 1) around line 5210.
In the following tiffcrop tries to read pixels from the image at an offset
far beyond the file-/buffersize.
The main region checks in computeInputPixelOffsets() are now updated to
avoid uint underflow.
This update fixes also upstream issues #350 (closed) and #351 (closed).
Issue 350 is fixed by checking for not allowed zone input cases like -Z
0:0 in getCropOffsets().
Furthermore upstream issue #335 (closed) and #336 (closed) are also
fixed.
CVE: CVE-2022-2867, CVE-2022-2868, CVE-2022-2869

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>

This patch restricts DMA engine to memories (not MMIO devices).
Qemu upstream issue #542 reports a reentrancy problem when the DMA
engine accesses the HDA controller I/O registers.
Fix by restricting the DMA engine to memories regions
(forbidding MMIO devices such the HDA controller).
CVE: CVE-2021-3611

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>

This patch restrict DMA engine to memories.
The DMA engine is started by I/O access and then itself accesses the
I/O registers, triggering a reentrancy bug.
Fix this bug by restricting the DMA engine to memories regions.
CVE: CVE-2022-2962.
Original commit:
https://gitlab.com/qemu-project/qemu/-/commit/36a894aeb64a2e02871016da1c37d4a4ca109182



Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>

Avoid installing NVIDIA linux-firmware packages

Closes #834

See merge request !353

default.xml: Update source revision on meta-seco-rockchip

Closes #165

See merge request !352

Fixes: #834



Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

Having all linux-firmware packages for a qemu-based machine makes little
sense. Removing it from recommends aligns the machines with the X86
counterparts too.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

    This revision adds support for M.2 Socket 1 Key E connectivity slot
    of the Seco's reference board Juno SBC-D23

Signed-off-by: Natalia Kovalenko <waykovalenko@gmail.com>

oniro-grub-bootconf: Respect WIC_BOOTLOADER_TIMEOUT for timeout configuration

Closes #837

See merge request !351

The timeout argument is not effective when using a static grub
configuration. Drop it to avoid confusion.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

The timeout definition is usually handled dynamically in wic. For the
wic files using oniro-grub-bootconf as grub configuration, we need to
manually handle that via the existing WIC_BOOTLOADER_TIMEOUT variable.
In this way, WIC_BOOTLOADER_TIMEOUT can be used with oniro-grub-bootconf
and wic dynamic grub configuration (bootloader argument).

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

Cleanup/drop support for Avenger/Nitrogen boards

See merge request !347

scripts: tool to upgrade, backup or restore Oniro

See merge request !329

The Avenger board was already deprecated and this clean-ups some
remaining support on Zephyr.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

seco-imx8mm-c61: Add RAUC/SYSOTA support configuration

See merge request !346

Signed-off-by: Natalia Kovalenko <waykovalenko@gmail.com>

    manifests/default.xml: Update source revision on meta-seco-imx.
    Add a new partition scheme in wic input file for seco-imx8mm-c61.

    rauc/rauc-conf.inc: Add rauc slot A/B definitions.

    sysota/sysota_git.bb: Add seco-imx8mm-c61 model and bootloader type.

    bundles/oniro-bundle-base.bb Add target bundle compatibility string.

Signed-off-by: Natalia Kovalenko <waykovalenko@gmail.com>

and share them using the common include file.

    rauc: Move machines specific configurations into
    dedicated include file (rauc-conf.inc) for metadata sharing.

    grub/oniro-grub-bootconf.bb: Include rauc-conf.inc. Retrieve the
    values ​​of SERIAL_CONSOLES, RAUC_SLOT_A, RAUC_SLOT_B to pass them to
    grub.cfg file.

    grub/files/grub.cfg: Use SERIAL_CONSOLES, RAUC_SLOT_A, RAUC_SLOT_B
    variables instead of hard-coding their values, to be suitable for
    different target machines.

Signed-off-by: Natalia Kovalenko <waykovalenko@gmail.com>

Developed a Python tool which will allow to automatically
update an Oniro-based distribution or product tree to a
target version, create a backup or restore a previously
created backup. The tool was initially created
by Davide Gardenal <davide.gardenal@huawei.com>.

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>

README: fix a typo

See merge request !342

Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org>

.gitignore: Ignore emacs backup file

See merge request !341

This trivial change was motivated to confirm that gitlab
can allow external community contributions (gitlab pipelines checks).

For the record my affiliation has been changed
from Huawei OSTC to Individual.

Forwarded: !341


Last-update: 2022-10-17
Signed-off-by: Philippe Coval <rzr@users.sf.net>

supported-technologies/matter: Add initial Matter support docs

Closes docs#7

See merge request !344

supported-technologies/openthread: update OpenThread docs to match current status

Closes docs#8

See merge request !343

A short description on Matter and the current status on our integration
work in Oniro.

Closes: docs#7



Signed-off-by: Stefan Schmidt <stefan.schmidt@huawei.com>

Extend the OpenThread documentation to describe the different bitbake
building targets and use cases we are supporting in Oniro. Also
reference to the existing Transparent Gateway documentation for further
documentation.

Closes: docs#8



Signed-off-by: Stefan Schmidt <stefan.schmidt@huawei.com>

elfutils: Disabling the unneeded package debuginfod and dependencies

See merge request !335

Revert "Bump release to 2.0.0-beta"

See merge request !337

Revert "Bump release to 2.0.0-beta"

This reverts commit db7e0150.

Metadata files are not reverted

This change will make CI testing new changes that were
ignored since tag.

Forwarded: !337


Signed-off-by: Philippe Coval <philippe.coval.ext@huawei.com>

This is done through DISTRO_FEATURE and it allows to disable
the debuginfod package and dependencies, which are not needed.
Removing uneeded packages is a security measure.

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>

docs: Add LVGL supported tech

See merge request !331

matter: Bump recipe to final 1.0 release tag matching SRCREV

Closes #35

See merge request !333

The Matter project has released version 1.0 of the SDK and tagged the
repository accordingly. We are bumping the recipe here to match this tag
revision and also update the changed branch name.

Closes: #35



Signed-off-by: Stefan Schmidt <stefan.schmidt@huawei.com>

Relicense Yocto/OE-related files to MIT

Closes #824

See merge request !330

Relate-to: https://gitlab.eclipse.org/pcoval/oniro-presentations/-/wikis/blueprints
Forwarded: !331


Signed-off-by: Philippe Coval <philippe.coval.ext@huawei.com>

It was proposed and approved in #824 to relicense the Yocto/OE files in
this repository to MIT. This will make collaboration with the upstream
easier.

Fixes: eclipse/oniro-core/oniro#824



Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>