summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu/qemu
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/qemu/qemu')
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-configure-Fix-check-tcg-not-executing-any-tests.patch56
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-configure-support-vte-2.91.patch79
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch37
-rw-r--r--meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch36
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-chardev-connect-socket-to-a-spawned-command.patch246
-rw-r--r--meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch358
-rw-r--r--meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch47
-rw-r--r--meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch32
-rw-r--r--meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch35
-rw-r--r--meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch52
-rw-r--r--meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch34
-rw-r--r--meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch38
-rw-r--r--meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch49
-rw-r--r--meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch43
-rw-r--r--meta/recipes-devtools/qemu/qemu/Qemu-Arm-versatilepb-Add-memory-size-checking.patch46
-rw-r--r--meta/recipes-devtools/qemu/qemu/add-ptest-in-makefile.patch29
-rw-r--r--meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch32
-rw-r--r--meta/recipes-devtools/qemu/qemu/cpus.c-qemu_cpu_kick_thread_debugging.patch76
-rw-r--r--meta/recipes-devtools/qemu/qemu/cross.patch38
-rw-r--r--meta/recipes-devtools/qemu/qemu/disable-grabs.patch72
-rw-r--r--meta/recipes-devtools/qemu/qemu/exclude-some-arm-EABI-obsolete-syscalls.patch93
-rw-r--r--meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch84
-rw-r--r--meta/recipes-devtools/qemu/qemu/no-valgrind.patch19
-rw-r--r--meta/recipes-devtools/qemu/qemu/pathlimit.patch137
-rw-r--r--meta/recipes-devtools/qemu/qemu/qemu-2.5.0-cflags.patch13
-rw-r--r--meta/recipes-devtools/qemu/qemu/qemu-7.0.0-glibc-2.36.patch46
-rw-r--r--meta/recipes-devtools/qemu/qemu/qemu-enlarge-env-entry-size.patch31
-rw-r--r--meta/recipes-devtools/qemu/qemu/run-ptest11
-rw-r--r--meta/recipes-devtools/qemu/qemu/wacom.patch130
29 files changed, 1155 insertions, 844 deletions
diff --git a/meta/recipes-devtools/qemu/qemu/0001-configure-Fix-check-tcg-not-executing-any-tests.patch b/meta/recipes-devtools/qemu/qemu/0001-configure-Fix-check-tcg-not-executing-any-tests.patch
new file mode 100644
index 0000000000..66ae4deae1
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0001-configure-Fix-check-tcg-not-executing-any-tests.patch
@@ -0,0 +1,56 @@
+From f295491361ed7fbe729ef6f029d83f68b8e2bee3 Mon Sep 17 00:00:00 2001
+From: Mukilan Thiyagarajan <quic_mthiyaga@quicinc.com>
+Date: Wed, 21 Dec 2022 09:04:06 +0000
+Subject: [PATCH] configure: Fix check-tcg not executing any tests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+After configuring with --target-list=hexagon-linux-user
+running `make check-tcg` just prints the following:
+
+```
+make: Nothing to be done for 'check-tcg'
+```
+
+In the probe_target_compiler function, the 'break'
+command is used incorrectly. There are no lexically
+enclosing loops associated with that break command which
+is an unspecfied behaviour in the POSIX standard.
+
+The dash shell implementation aborts the currently executing
+loop, in this case, causing the rest of the logic for the loop
+in line 2490 to be skipped, which means no Makefiles are
+generated for the tcg target tests.
+
+Fixes: c3b570b5a9a24d25 (configure: don't enable
+cross compilers unless in target_list)
+
+Signed-off-by: Mukilan Thiyagarajan <quic_mthiyaga@quicinc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Link: https://patchew.org/QEMU/20221207082309.9966-1-quic._5Fmthiyaga@quicinc.com/
+Message-Id: <20221207082309.9966-1-quic_mthiyaga@quicinc.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-Id: <20221221090411.1995037-2-alex.bennee@linaro.org>
+
+Upstream-Status: Backport [https://github.com/qemu/qemu/commit/73acb87be536d23e42db73a306104d8fd316ff20]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ configure | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/configure b/configure
+index 0c1db72b8..6b4589273 100755
+--- a/configure
++++ b/configure
+@@ -1881,9 +1881,7 @@ probe_target_compiler() {
+ # We shall skip configuring the target compiler if the user didn't
+ # bother enabling an appropriate guest. This avoids building
+ # extraneous firmware images and tests.
+- if test "${target_list#*$1}" != "$1"; then
+- break;
+- else
++ if test "${target_list#*$1}" = "$1"; then
+ return 1
+ fi
+
diff --git a/meta/recipes-devtools/qemu/qemu/0001-configure-support-vte-2.91.patch b/meta/recipes-devtools/qemu/qemu/0001-configure-support-vte-2.91.patch
deleted file mode 100644
index c286822b21..0000000000
--- a/meta/recipes-devtools/qemu/qemu/0001-configure-support-vte-2.91.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From f40a8ceaaf0ee37fcfeb6900960632d7a7085a9f Mon Sep 17 00:00:00 2001
-From: Jussi Kukkonen <jussi.kukkonen@intel.com>
-Date: Fri, 17 Jun 2016 21:09:03 +0300
-Subject: [PATCH] configure: support vte-2.91
-
-Upstream-Status: Backport [c6feff9e09aa99]
-Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
-
-Original commit message below:
-
-From: Cole Robinson <crobinso@redhat.com>
-Date: Fri, 6 May 2016 14:03:12 -0400
-Subject: [PATCH] configure: support vte-2.91
-
-vte >= 0.37 expores API version 2.91, which is where all the active
-development is. qemu builds and runs fine with that version, so use it
-if it's available.
-
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
-Message-id: b4f0375647f7b368d3dbd3834aee58cb0253566a.1462557436.git.crobinso@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- configure | 17 +++++++++++------
- 1 file changed, 11 insertions(+), 6 deletions(-)
-
-diff --git a/configure b/configure
-index 54a3189..a16fa2b 100755
---- a/configure
-+++ b/configure
-@@ -2394,20 +2394,25 @@ fi
-
- if test "$vte" != "no"; then
- if test "$gtkabi" = "3.0"; then
-- vtepackage="vte-2.90"
-- vteversion="0.32.0"
-+ vteminversion="0.32.0"
-+ if $pkg_config --exists "vte-2.91"; then
-+ vtepackage="vte-2.91"
-+ else
-+ vtepackage="vte-2.90"
-+ fi
- else
- vtepackage="vte"
-- vteversion="0.24.0"
-+ vteminversion="0.24.0"
- fi
-- if $pkg_config --exists "$vtepackage >= $vteversion"; then
-+ if $pkg_config --exists "$vtepackage >= $vteminversion"; then
- vte_cflags=`$pkg_config --cflags $vtepackage`
- vte_libs=`$pkg_config --libs $vtepackage`
-+ vteversion=`$pkg_config --modversion $vtepackage`
- libs_softmmu="$vte_libs $libs_softmmu"
- vte="yes"
- elif test "$vte" = "yes"; then
- if test "$gtkabi" = "3.0"; then
-- feature_not_found "vte" "Install libvte-2.90 devel"
-+ feature_not_found "vte" "Install libvte-2.90/2.91 devel"
- else
- feature_not_found "vte" "Install libvte devel"
- fi
-@@ -4759,6 +4764,7 @@ echo "pixman $pixman"
- echo "SDL support $sdl"
- echo "GTK support $gtk"
- echo "GTK GL support $gtk_gl"
-+echo "VTE support $vte `echo_version $vte $vteversion`"
- echo "GNUTLS support $gnutls"
- echo "GNUTLS hash $gnutls_hash"
- echo "GNUTLS rnd $gnutls_rnd"
-@@ -4771,7 +4777,6 @@ else
- fi
- echo "nettle kdf $nettle_kdf"
- echo "libtasn1 $tasn1"
--echo "VTE support $vte"
- echo "curses support $curses"
- echo "virgl support $virglrenderer"
- echo "curl support $curl"
---
-2.1.4
-
diff --git a/meta/recipes-devtools/qemu/qemu/0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch b/meta/recipes-devtools/qemu/qemu/0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch
new file mode 100644
index 0000000000..1838c88f0e
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0001-contrib-vhost-user-blk-Replace-lseek64-with-lseek.patch
@@ -0,0 +1,37 @@
+From 38f5c88bf296dbbc04dcd57f36d64695055a2d3f Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 16 Dec 2022 20:19:49 -0800
+Subject: [PATCH 1/2] contrib/vhost-user-blk: Replace lseek64 with lseek
+
+64bit off_t is already in use since build uses _FILE_OFFSET_BITS=64
+already. Using lseek/off_t also makes it work with latest must without
+using _LARGEFILE64_SOURCE macro. This macro is implied with _GNU_SOURCE
+when using glibc but not with musl.
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2022-12/msg02840.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+CC: Raphael Norwitz <raphael.norwitz@nutanix.com>
+---
+ contrib/vhost-user-blk/vhost-user-blk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/contrib/vhost-user-blk/vhost-user-blk.c b/contrib/vhost-user-blk/vhost-user-blk.c
+index aa99877fcd..7941694e53 100644
+--- a/contrib/vhost-user-blk/vhost-user-blk.c
++++ b/contrib/vhost-user-blk/vhost-user-blk.c
+@@ -532,9 +532,9 @@ vub_get_blocksize(int fd)
+ static void
+ vub_initialize_config(int fd, struct virtio_blk_config *config)
+ {
+- off64_t capacity;
++ off_t capacity;
+
+- capacity = lseek64(fd, 0, SEEK_END);
++ capacity = lseek(fd, 0, SEEK_END);
+ config->capacity = capacity >> 9;
+ config->blk_size = vub_get_blocksize(fd);
+ config->size_max = 65536;
+--
+2.39.0
+
diff --git a/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch
new file mode 100644
index 0000000000..6fb160e6d3
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0001-qemu-Add-addition-environment-space-to-boot-loader-q.patch
@@ -0,0 +1,36 @@
+From de64af82950a6908f9407dfc92b83c17e2af3eab Mon Sep 17 00:00:00 2001
+From: Jason Wessel <jason.wessel@windriver.com>
+Date: Fri, 28 Mar 2014 17:42:43 +0800
+Subject: [PATCH 01/12] qemu: Add addition environment space to boot loader
+ qemu-system-mips
+
+Upstream-Status: Inappropriate - OE uses deep paths
+
+If you create a project with very long directory names like 128 characters
+deep and use NFS, the kernel arguments will be truncated. The kernel will
+accept longer strings such as 1024 bytes, but the qemu boot loader defaulted
+to only 256 bytes. This patch expands the limit.
+
+Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
+Signed-off-by: Roy Li <rongqing.li@windriver.com>
+
+---
+ hw/mips/malta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/mips/malta.c b/hw/mips/malta.c
+index 628851172..12d37f35d 100644
+--- a/hw/mips/malta.c
++++ b/hw/mips/malta.c
+@@ -61,7 +61,7 @@
+ #define ENVP_PADDR 0x2000
+ #define ENVP_VADDR cpu_mips_phys_to_kseg0(NULL, ENVP_PADDR)
+ #define ENVP_NB_ENTRIES 16
+-#define ENVP_ENTRY_SIZE 256
++#define ENVP_ENTRY_SIZE 1024
+
+ /* Hardware addresses */
+ #define FLASH_ADDRESS 0x1e000000ULL
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0002-chardev-connect-socket-to-a-spawned-command.patch b/meta/recipes-devtools/qemu/qemu/0002-chardev-connect-socket-to-a-spawned-command.patch
new file mode 100644
index 0000000000..63a99c9620
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0002-chardev-connect-socket-to-a-spawned-command.patch
@@ -0,0 +1,246 @@
+From 14cd62607c9de232edf0a9b8503bd02783e03411 Mon Sep 17 00:00:00 2001
+From: Alistair Francis <alistair.francis@xilinx.com>
+Date: Thu, 21 Dec 2017 11:35:16 -0800
+Subject: [PATCH 02/12] chardev: connect socket to a spawned command
+
+The command is started in a shell (sh -c) with stdin connect to QEMU
+via a Unix domain stream socket. QEMU then exchanges data via its own
+end of the socket, just like it normally does.
+
+"-chardev socket" supports some ways of connecting via protocols like
+telnet, but that is only a subset of the functionality supported by
+tools socat. To use socat instead, for example to connect via a socks
+proxy, use:
+
+ -chardev 'socket,id=socat,cmd=exec socat FD:0 SOCKS4A:socks-proxy.localdomain:example.com:9999,,socksuser=nobody' \
+ -device usb-serial,chardev=socat
+
+Beware that commas in the command must be escaped as double commas.
+
+Or interactively in the console:
+ (qemu) chardev-add socket,id=cat,cmd=cat
+ (qemu) device_add usb-serial,chardev=cat
+ ^ac
+ # cat >/dev/ttyUSB0
+ hello
+ hello
+
+Another usage is starting swtpm from inside QEMU. swtpm will
+automatically shut down once it looses the connection to the parent
+QEMU, so there is no risk of lingering processes:
+
+ -chardev 'socket,id=chrtpm0,cmd=exec swtpm socket --terminate --ctrl type=unixio,,clientfd=0 --tpmstate dir=... --log file=swtpm.log' \
+ -tpmdev emulator,id=tpm0,chardev=chrtpm0 \
+ -device tpm-tis,tpmdev=tpm0
+
+The patch was discussed upstream, but QEMU developers believe that the
+code calling QEMU should be responsible for managing additional
+processes. In OE-core, that would imply enhancing runqemu and
+oeqa. This patch is a simpler solution.
+
+Because it is not going upstream, the patch was written so that it is
+as simple as possible.
+
+Upstream-Status: Inappropriate [embedded specific]
+
+Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
+
+---
+ chardev/char-socket.c | 100 ++++++++++++++++++++++++++++++++++++++++++
+ chardev/char.c | 3 ++
+ qapi/char.json | 5 +++
+ 3 files changed, 108 insertions(+)
+
+diff --git a/chardev/char-socket.c b/chardev/char-socket.c
+index fab2d791d..c79641f24 100644
+--- a/chardev/char-socket.c
++++ b/chardev/char-socket.c
+@@ -1315,6 +1315,67 @@ static bool qmp_chardev_validate_socket(ChardevSocket *sock,
+ return true;
+ }
+
++#ifndef _WIN32
++static void chardev_open_socket_cmd(Chardev *chr,
++ const char *cmd,
++ Error **errp)
++{
++ int fds[2] = { -1, -1 };
++ QIOChannelSocket *sioc = NULL;
++ pid_t pid = -1;
++ const char *argv[] = { "/bin/sh", "-c", cmd, NULL };
++
++ /*
++ * We need a Unix domain socket for commands like swtpm and a single
++ * connection, therefore we cannot use qio_channel_command_new_spawn()
++ * without patching it first. Duplicating the functionality is easier.
++ */
++ if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0, fds)) {
++ error_setg_errno(errp, errno, "Error creating socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC)");
++ goto error;
++ }
++
++ pid = qemu_fork(errp);
++ if (pid < 0) {
++ goto error;
++ }
++
++ if (!pid) {
++ /* child */
++ dup2(fds[1], STDIN_FILENO);
++ execv(argv[0], (char * const *)argv);
++ _exit(1);
++ }
++
++ /*
++ * Hand over our end of the socket pair to the qio channel.
++ *
++ * We don't reap the child because it is expected to keep
++ * running. We also don't support the "reconnect" option for the
++ * same reason.
++ */
++ sioc = qio_channel_socket_new_fd(fds[0], errp);
++ if (!sioc) {
++ goto error;
++ }
++ fds[0] = -1;
++
++ g_free(chr->filename);
++ chr->filename = g_strdup_printf("cmd:%s", cmd);
++ tcp_chr_new_client(chr, sioc);
++
++ error:
++ if (fds[0] >= 0) {
++ close(fds[0]);
++ }
++ if (fds[1] >= 0) {
++ close(fds[1]);
++ }
++ if (sioc) {
++ object_unref(OBJECT(sioc));
++ }
++}
++#endif
+
+ static void qmp_chardev_open_socket(Chardev *chr,
+ ChardevBackend *backend,
+@@ -1323,6 +1384,9 @@ static void qmp_chardev_open_socket(Chardev *chr,
+ {
+ SocketChardev *s = SOCKET_CHARDEV(chr);
+ ChardevSocket *sock = backend->u.socket.data;
++#ifndef _WIN32
++ const char *cmd = sock->cmd;
++#endif
+ bool do_nodelay = sock->has_nodelay ? sock->nodelay : false;
+ bool is_listen = sock->has_server ? sock->server : true;
+ bool is_telnet = sock->has_telnet ? sock->telnet : false;
+@@ -1393,6 +1457,14 @@ static void qmp_chardev_open_socket(Chardev *chr,
+
+ update_disconnected_filename(s);
+
++#ifndef _WIN32
++ if (cmd) {
++ chardev_open_socket_cmd(chr, cmd, errp);
++
++ /* everything ready (or failed permanently) before we return */
++ *be_opened = true;
++ } else
++#endif
+ if (s->is_listen) {
+ if (qmp_chardev_open_socket_server(chr, is_telnet || is_tn3270,
+ is_waitconnect, errp) < 0) {
+@@ -1412,6 +1484,9 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
+ const char *host = qemu_opt_get(opts, "host");
+ const char *port = qemu_opt_get(opts, "port");
+ const char *fd = qemu_opt_get(opts, "fd");
++#ifndef _WIN32
++ const char *cmd = qemu_opt_get(opts, "cmd");
++#endif
+ #ifdef CONFIG_LINUX
+ bool tight = qemu_opt_get_bool(opts, "tight", true);
+ bool abstract = qemu_opt_get_bool(opts, "abstract", false);
+@@ -1419,6 +1494,20 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
+ SocketAddressLegacy *addr;
+ ChardevSocket *sock;
+
++#ifndef _WIN32
++ if (cmd) {
++ /*
++ * Here we have to ensure that no options are set which are incompatible with
++ * spawning a command, otherwise unmodified code that doesn't know about
++ * command spawning (like socket_reconnect_timeout()) might get called.
++ */
++ if (path || sock->server || sock->has_telnet || sock->has_tn3270 || sock->reconnect || host || port || sock->tls_creds) {
++ error_setg(errp, "chardev: socket: cmd does not support any additional options");
++ return;
++ }
++ } else
++#endif
++
+ if ((!!path + !!fd + !!host) > 1) {
+ error_setg(errp,
+ "None or one of 'path', 'fd' or 'host' option required.");
+@@ -1469,13 +1558,24 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
+ sock->tls_creds = g_strdup(qemu_opt_get(opts, "tls-creds"));
+ sock->has_tls_authz = qemu_opt_get(opts, "tls-authz");
+ sock->tls_authz = g_strdup(qemu_opt_get(opts, "tls-authz"));
++#ifndef _WIN32
++ sock->cmd = g_strdup(cmd);
++#endif
+
+ addr = g_new0(SocketAddressLegacy, 1);
++#ifndef _WIN32
++ if (path || cmd) {
++#else
+ if (path) {
++#endif
+ UnixSocketAddress *q_unix;
+ addr->type = SOCKET_ADDRESS_TYPE_UNIX;
+ q_unix = addr->u.q_unix.data = g_new0(UnixSocketAddress, 1);
++#ifndef _WIN32
++ q_unix->path = cmd ? g_strdup_printf("cmd:%s", cmd) : g_strdup(path);
++#else
+ q_unix->path = g_strdup(path);
++#endif
+ #ifdef CONFIG_LINUX
+ q_unix->has_tight = true;
+ q_unix->tight = tight;
+diff --git a/chardev/char.c b/chardev/char.c
+index 0169d8dde..ce9a21f41 100644
+--- a/chardev/char.c
++++ b/chardev/char.c
+@@ -835,6 +835,9 @@ QemuOptsList qemu_chardev_opts = {
+ },{
+ .name = "path",
+ .type = QEMU_OPT_STRING,
++ },{
++ .name = "cmd",
++ .type = QEMU_OPT_STRING,
+ },{
+ .name = "host",
+ .type = QEMU_OPT_STRING,
+diff --git a/qapi/char.json b/qapi/char.json
+index 7b4215157..37feabdac 100644
+--- a/qapi/char.json
++++ b/qapi/char.json
+@@ -250,6 +250,10 @@
+ #
+ # @addr: socket address to listen on (server=true)
+ # or connect to (server=false)
++# @cmd: command to run via "sh -c" with stdin as one end of
++# a AF_UNIX SOCK_DSTREAM socket pair. The other end
++# is used by the chardev. Either an addr or a cmd can
++# be specified, but not both.
+ # @tls-creds: the ID of the TLS credentials object (since 2.6)
+ # @tls-authz: the ID of the QAuthZ authorization object against which
+ # the client's x509 distinguished name will be validated. This
+@@ -276,6 +280,7 @@
+ ##
+ { 'struct': 'ChardevSocket',
+ 'data': { 'addr': 'SocketAddressLegacy',
++ '*cmd': 'str',
+ '*tls-creds': 'str',
+ '*tls-authz' : 'str',
+ '*server': 'bool',
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch b/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch
new file mode 100644
index 0000000000..14b5338eb2
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch
@@ -0,0 +1,358 @@
+From 71f14902256e3c3529710b713e1ea43100bf4c40 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 17 Dec 2022 08:37:46 -0800
+Subject: [PATCH 2/2] linux-user: Replace use of lfs64 related functions and
+ macros
+
+Builds defines -D_FILE_OFFSET_BITS=64 which makes the original functions
+anf macros behave same as their 64 suffixed counterparts. This also
+helps in compiling with latest musl C library, where these macros and
+functions are no more available under _GNU_SOURCE feature macro
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2022-12/msg02841.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Cc: Laurent Vivier <laurent@vivier.eu>
+---
+ linux-user/syscall.c | 153 +++++++++++--------------------------------
+ 1 file changed, 39 insertions(+), 114 deletions(-)
+
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index 1f8c10f8ef..30d83ed162 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -795,8 +795,8 @@ safe_syscall6(ssize_t, copy_file_range, int, infd, loff_t *, pinoff,
+ */
+ #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__)
+ /* Similarly for fcntl. Note that callers must always:
+- * pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK
+- * use the flock64 struct rather than unsuffixed flock
++ * pass the F_GETLK etc constants rather than the unsuffixed F_GETLK
++ * use the flock struct rather than unsuffixed flock
+ * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts.
+ */
+ #ifdef __NR_fcntl64
+@@ -6797,13 +6797,13 @@ static int target_to_host_fcntl_cmd(int cmd)
+ ret = cmd;
+ break;
+ case TARGET_F_GETLK:
+- ret = F_GETLK64;
++ ret = F_GETLK;
+ break;
+ case TARGET_F_SETLK:
+- ret = F_SETLK64;
++ ret = F_SETLK;
+ break;
+ case TARGET_F_SETLKW:
+- ret = F_SETLKW64;
++ ret = F_SETLKW;
+ break;
+ case TARGET_F_GETOWN:
+ ret = F_GETOWN;
+@@ -6817,17 +6817,6 @@ static int target_to_host_fcntl_cmd(int cmd)
+ case TARGET_F_SETSIG:
+ ret = F_SETSIG;
+ break;
+-#if TARGET_ABI_BITS == 32
+- case TARGET_F_GETLK64:
+- ret = F_GETLK64;
+- break;
+- case TARGET_F_SETLK64:
+- ret = F_SETLK64;
+- break;
+- case TARGET_F_SETLKW64:
+- ret = F_SETLKW64;
+- break;
+-#endif
+ case TARGET_F_SETLEASE:
+ ret = F_SETLEASE;
+ break;
+@@ -6879,8 +6868,8 @@ static int target_to_host_fcntl_cmd(int cmd)
+ * them to 5, 6 and 7 before making the syscall(). Since we make the
+ * syscall directly, adjust to what is supported by the kernel.
+ */
+- if (ret >= F_GETLK64 && ret <= F_SETLKW64) {
+- ret -= F_GETLK64 - 5;
++ if (ret >= F_GETLK && ret <= F_SETLKW) {
++ ret -= F_GETLK - 5;
+ }
+ #endif
+
+@@ -6913,55 +6902,11 @@ static int host_to_target_flock(int type)
+ return type;
+ }
+
+-static inline abi_long copy_from_user_flock(struct flock64 *fl,
+- abi_ulong target_flock_addr)
+-{
+- struct target_flock *target_fl;
+- int l_type;
+-
+- if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
+- return -TARGET_EFAULT;
+- }
+-
+- __get_user(l_type, &target_fl->l_type);
+- l_type = target_to_host_flock(l_type);
+- if (l_type < 0) {
+- return l_type;
+- }
+- fl->l_type = l_type;
+- __get_user(fl->l_whence, &target_fl->l_whence);
+- __get_user(fl->l_start, &target_fl->l_start);
+- __get_user(fl->l_len, &target_fl->l_len);
+- __get_user(fl->l_pid, &target_fl->l_pid);
+- unlock_user_struct(target_fl, target_flock_addr, 0);
+- return 0;
+-}
+-
+-static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
+- const struct flock64 *fl)
+-{
+- struct target_flock *target_fl;
+- short l_type;
+-
+- if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
+- return -TARGET_EFAULT;
+- }
+-
+- l_type = host_to_target_flock(fl->l_type);
+- __put_user(l_type, &target_fl->l_type);
+- __put_user(fl->l_whence, &target_fl->l_whence);
+- __put_user(fl->l_start, &target_fl->l_start);
+- __put_user(fl->l_len, &target_fl->l_len);
+- __put_user(fl->l_pid, &target_fl->l_pid);
+- unlock_user_struct(target_fl, target_flock_addr, 1);
+- return 0;
+-}
+-
+-typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr);
+-typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl);
++typedef abi_long from_flock_fn(struct flock *fl, abi_ulong target_addr);
++typedef abi_long to_flock_fn(abi_ulong target_addr, const struct flock *fl);
+
+ #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32
+-struct target_oabi_flock64 {
++struct target_oabi_flock {
+ abi_short l_type;
+ abi_short l_whence;
+ abi_llong l_start;
+@@ -6969,10 +6914,10 @@ struct target_oabi_flock64 {
+ abi_int l_pid;
+ } QEMU_PACKED;
+
+-static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
++static inline abi_long copy_from_user_oabi_flock(struct flock *fl,
+ abi_ulong target_flock_addr)
+ {
+- struct target_oabi_flock64 *target_fl;
++ struct target_oabi_flock *target_fl;
+ int l_type;
+
+ if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
+@@ -6993,10 +6938,10 @@ static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl,
+ return 0;
+ }
+
+-static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
+- const struct flock64 *fl)
++static inline abi_long copy_to_user_oabi_flock(abi_ulong target_flock_addr,
++ const struct flock *fl)
+ {
+- struct target_oabi_flock64 *target_fl;
++ struct target_oabi_flock *target_fl;
+ short l_type;
+
+ if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
+@@ -7014,10 +6959,10 @@ static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr,
+ }
+ #endif
+
+-static inline abi_long copy_from_user_flock64(struct flock64 *fl,
++static inline abi_long copy_from_user_flock(struct flock *fl,
+ abi_ulong target_flock_addr)
+ {
+- struct target_flock64 *target_fl;
++ struct target_flock *target_fl;
+ int l_type;
+
+ if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) {
+@@ -7038,10 +6983,10 @@ static inline abi_long copy_from_user_flock64(struct flock64 *fl,
+ return 0;
+ }
+
+-static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
+- const struct flock64 *fl)
++static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr,
++ const struct flock *fl)
+ {
+- struct target_flock64 *target_fl;
++ struct target_flock *target_fl;
+ short l_type;
+
+ if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) {
+@@ -7060,7 +7005,7 @@ static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr,
+
+ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
+ {
+- struct flock64 fl64;
++ struct flock fl64;
+ #ifdef F_GETOWN_EX
+ struct f_owner_ex fox;
+ struct target_f_owner_ex *target_fox;
+@@ -7073,6 +7018,7 @@ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
+
+ switch(cmd) {
+ case TARGET_F_GETLK:
++ case TARGET_F_OFD_GETLK:
+ ret = copy_from_user_flock(&fl64, arg);
+ if (ret) {
+ return ret;
+@@ -7082,32 +7028,11 @@ static abi_long do_fcntl(int fd, int cmd, abi_ulong arg)
+ ret = copy_to_user_flock(arg, &fl64);
+ }
+ break;
+-
+ case TARGET_F_SETLK:
+ case TARGET_F_SETLKW:
+- ret = copy_from_user_flock(&fl64, arg);
+- if (ret) {
+- return ret;
+- }
+- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
+- break;
+-
+- case TARGET_F_GETLK64:
+- case TARGET_F_OFD_GETLK:
+- ret = copy_from_user_flock64(&fl64, arg);
+- if (ret) {
+- return ret;
+- }
+- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64));
+- if (ret == 0) {
+- ret = copy_to_user_flock64(arg, &fl64);
+- }
+- break;
+- case TARGET_F_SETLK64:
+- case TARGET_F_SETLKW64:
+ case TARGET_F_OFD_SETLK:
+ case TARGET_F_OFD_SETLKW:
+- ret = copy_from_user_flock64(&fl64, arg);
++ ret = copy_from_user_flock(&fl64, arg);
+ if (ret) {
+ return ret;
+ }
+@@ -7332,7 +7257,7 @@ static inline abi_long target_truncate64(CPUArchState *cpu_env, const char *arg1
+ arg2 = arg3;
+ arg3 = arg4;
+ }
+- return get_errno(truncate64(arg1, target_offset64(arg2, arg3)));
++ return get_errno(truncate(arg1, target_offset64(arg2, arg3)));
+ }
+ #endif
+
+@@ -7346,7 +7271,7 @@ static inline abi_long target_ftruncate64(CPUArchState *cpu_env, abi_long arg1,
+ arg2 = arg3;
+ arg3 = arg4;
+ }
+- return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3)));
++ return get_errno(ftruncate(arg1, target_offset64(arg2, arg3)));
+ }
+ #endif
+
+@@ -8452,7 +8377,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
+ void *tdirp;
+ int hlen, hoff, toff;
+ int hreclen, treclen;
+- off64_t prev_diroff = 0;
++ off_t prev_diroff = 0;
+
+ hdirp = g_try_malloc(count);
+ if (!hdirp) {
+@@ -8505,7 +8430,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count)
+ * Return what we have, resetting the file pointer to the
+ * location of the first record not returned.
+ */
+- lseek64(dirfd, prev_diroff, SEEK_SET);
++ lseek(dirfd, prev_diroff, SEEK_SET);
+ break;
+ }
+
+@@ -8539,7 +8464,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+ void *tdirp;
+ int hlen, hoff, toff;
+ int hreclen, treclen;
+- off64_t prev_diroff = 0;
++ off_t prev_diroff = 0;
+
+ hdirp = g_try_malloc(count);
+ if (!hdirp) {
+@@ -8581,7 +8506,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
+ * Return what we have, resetting the file pointer to the
+ * location of the first record not returned.
+ */
+- lseek64(dirfd, prev_diroff, SEEK_SET);
++ lseek(dirfd, prev_diroff, SEEK_SET);
+ break;
+ }
+
+@@ -11114,7 +11039,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+ return -TARGET_EFAULT;
+ }
+ }
+- ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5)));
++ ret = get_errno(pread(arg1, p, arg3, target_offset64(arg4, arg5)));
+ unlock_user(p, arg2, ret);
+ return ret;
+ case TARGET_NR_pwrite64:
+@@ -11131,7 +11056,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+ return -TARGET_EFAULT;
+ }
+ }
+- ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5)));
++ ret = get_errno(pwrite(arg1, p, arg3, target_offset64(arg4, arg5)));
+ unlock_user(p, arg2, 0);
+ return ret;
+ #endif
+@@ -11954,14 +11879,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+ case TARGET_NR_fcntl64:
+ {
+ int cmd;
+- struct flock64 fl;
+- from_flock64_fn *copyfrom = copy_from_user_flock64;
+- to_flock64_fn *copyto = copy_to_user_flock64;
++ struct flock fl;
++ from_flock_fn *copyfrom = copy_from_user_flock;
++ to_flock_fn *copyto = copy_to_user_flock;
+
+ #ifdef TARGET_ARM
+ if (!cpu_env->eabi) {
+- copyfrom = copy_from_user_oabi_flock64;
+- copyto = copy_to_user_oabi_flock64;
++ copyfrom = copy_from_user_oabi_flock;
++ copyto = copy_to_user_oabi_flock;
+ }
+ #endif
+
+@@ -11971,7 +11896,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+ }
+
+ switch(arg2) {
+- case TARGET_F_GETLK64:
++ case TARGET_F_GETLK:
+ ret = copyfrom(&fl, arg3);
+ if (ret) {
+ break;
+@@ -11982,8 +11907,8 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
+ }
+ break;
+
+- case TARGET_F_SETLK64:
+- case TARGET_F_SETLKW64:
++ case TARGET_F_SETLK:
++ case TARGET_F_SETLKW:
+ ret = copyfrom(&fl, arg3);
+ if (ret) {
+ break;
+--
+2.39.0
+
diff --git a/meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch b/meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch
new file mode 100644
index 0000000000..f350ffce47
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0003-apic-fixup-fallthrough-to-PIC.patch
@@ -0,0 +1,47 @@
+From dc2a8ccd440ee3741b61606eafed3f7e092f4312 Mon Sep 17 00:00:00 2001
+From: Mark Asselstine <mark.asselstine@windriver.com>
+Date: Tue, 26 Feb 2013 11:43:28 -0500
+Subject: [PATCH 03/12] apic: fixup fallthrough to PIC
+
+Commit 0e21e12bb311c4c1095d0269dc2ef81196ccb60a [Don't route PIC
+interrupts through the local APIC if the local APIC config says so.]
+missed a check to ensure the local APIC is enabled. Since if the local
+APIC is disabled it doesn't matter what the local APIC config says.
+
+If this check isn't done and the guest has disabled the local APIC the
+guest will receive a general protection fault, similar to what is seen
+here:
+
+https://lists.gnu.org/archive/html/qemu-devel/2012-12/msg02304.html
+
+The GPF is caused by an attempt to service interrupt 0xffffffff. This
+comes about since cpu_get_pic_interrupt() calls apic_accept_pic_intr()
+(with the local APIC disabled apic_get_interrupt() returns -1).
+apic_accept_pic_intr() returns 0 and thus the interrupt number which
+is returned from cpu_get_pic_interrupt(), and which is attempted to be
+serviced, is -1.
+
+Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2013-04/msg00878.html]
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+
+---
+ hw/intc/apic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/intc/apic.c b/hw/intc/apic.c
+index 3df11c34d..9506c88ce 100644
+--- a/hw/intc/apic.c
++++ b/hw/intc/apic.c
+@@ -605,7 +605,7 @@ int apic_accept_pic_intr(DeviceState *dev)
+ APICCommonState *s = APIC(dev);
+ uint32_t lvt0;
+
+- if (!s)
++ if (!s || !(s->spurious_vec & APIC_SV_ENABLE))
+ return -1;
+
+ lvt0 = s->lvt[APIC_LVT_LINT0];
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch b/meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch
new file mode 100644
index 0000000000..6faebd4e09
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0004-configure-Add-pkg-config-handling-for-libgcrypt.patch
@@ -0,0 +1,32 @@
+From d8265abdce5dc2bf74b3fccdf2b7257b4f3894f0 Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Wed, 28 Aug 2019 19:56:28 +0800
+Subject: [PATCH 04/12] configure: Add pkg-config handling for libgcrypt
+
+libgcrypt may also be controlled by pkg-config, this patch adds pkg-config
+handling for libgcrypt.
+
+Upstream-Status: Denied [https://lists.nongnu.org/archive/html/qemu-devel/2019-08/msg06333.html]
+
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 861de93c4..d45ff2d7c 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1063,7 +1063,7 @@ endif
+ if not gnutls_crypto.found()
+ if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
+ gcrypt = dependency('libgcrypt', version: '>=1.8',
+- method: 'config-tool',
++ method: 'pkg-config',
+ required: get_option('gcrypt'),
+ kwargs: static_kwargs)
+ # Debian has removed -lgpg-error from libgcrypt-config
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch b/meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch
new file mode 100644
index 0000000000..3f3c39f996
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0005-qemu-Do-not-include-file-if-not-exists.patch
@@ -0,0 +1,35 @@
+From f39e7bfc5ed07b5ecaeb705c4eae4855ca120d47 Mon Sep 17 00:00:00 2001
+From: Oleksiy Obitotskyy <oobitots@cisco.com>
+Date: Wed, 25 Mar 2020 21:21:35 +0200
+Subject: [PATCH 05/12] qemu: Do not include file if not exists
+
+Script configure checks for if_alg.h and check failed but
+if_alg.h still included.
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg07188.html]
+Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com>
+
+[update patch context]
+Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
+
+---
+ linux-user/syscall.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
+index f65045efe..340e0c6f0 100644
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -113,7 +113,9 @@
+ #include <linux/blkpg.h>
+ #include <netpacket/packet.h>
+ #include <linux/netlink.h>
++#if defined(CONFIG_AF_ALG)
+ #include <linux/if_alg.h>
++#endif
+ #include <linux/rtc.h>
+ #include <sound/asound.h>
+ #ifdef HAVE_BTRFS_H
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch b/meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch
new file mode 100644
index 0000000000..75c0369318
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0006-qemu-Add-some-user-space-mmap-tweaks-to-address-musl.patch
@@ -0,0 +1,52 @@
+From 375cae3dd6151ef33cae8f243f6a2c2da6c0c356 Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Fri, 8 Jan 2021 17:27:06 +0000
+Subject: [PATCH 06/12] qemu: Add some user space mmap tweaks to address musl
+ 32 bit
+
+When using qemu-i386 to build qemux86 webkitgtk on musl, it sits in an
+infinite loop of mremap calls of ever decreasing/increasing addresses.
+
+I suspect something in the musl memory allocation code loops indefinitely
+if it only sees ENOMEM and only exits when it hits EFAULT.
+
+According to the docs, trying to mremap outside the address space
+can/should return EFAULT and changing this allows the build to succeed.
+
+A better return value for the other cases of invalid addresses is EINVAL
+rather than ENOMEM so adjust the other part of the test to this.
+
+Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg01355.html]
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org
+
+---
+ linux-user/mmap.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/linux-user/mmap.c b/linux-user/mmap.c
+index c125031b9..e651834a5 100644
+--- a/linux-user/mmap.c
++++ b/linux-user/mmap.c
+@@ -749,12 +749,16 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
+ int prot;
+ void *host_addr;
+
+- if (!guest_range_valid_untagged(old_addr, old_size) ||
+- ((flags & MREMAP_FIXED) &&
++ if (!guest_range_valid_untagged(old_addr, old_size)) {
++ errno = EFAULT;
++ return -1;
++ }
++
++ if (((flags & MREMAP_FIXED) &&
+ !guest_range_valid_untagged(new_addr, new_size)) ||
+ ((flags & MREMAP_MAYMOVE) == 0 &&
+ !guest_range_valid_untagged(old_addr, new_size))) {
+- errno = ENOMEM;
++ errno = EINVAL;
+ return -1;
+ }
+
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch b/meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch
new file mode 100644
index 0000000000..0d7dae3689
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0007-qemu-Determinism-fixes.patch
@@ -0,0 +1,34 @@
+From 50bab5c2605b609ea7ea154f57a9be96d656725a Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Mon, 1 Mar 2021 13:00:47 +0000
+Subject: [PATCH 07/12] qemu: Determinism fixes
+
+When sources are included within debug information, a couple of areas of the
+qemu build are not reproducible due to either full buildpaths or timestamps.
+
+Replace the full paths with relative ones. I couldn't figure out how to get
+meson to pass relative paths but we can fix that in the script.
+
+Upstream-Status: Pending [some version of all/part of this may be accepted]
+RP 2021/3/1
+
+---
+ scripts/decodetree.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/decodetree.py b/scripts/decodetree.py
+index a03dc6b5e..4ea24c1f3 100644
+--- a/scripts/decodetree.py
++++ b/scripts/decodetree.py
+@@ -1328,7 +1328,7 @@ def main():
+ toppat = ExcMultiPattern(0)
+
+ for filename in args:
+- input_file = filename
++ input_file = os.path.relpath(filename)
+ f = open(filename, 'rt', encoding='utf-8')
+ parse_file(f, toppat)
+ f.close()
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch b/meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch
new file mode 100644
index 0000000000..43d3c7cf1f
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0008-tests-meson.build-use-relative-path-to-refer-to-file.patch
@@ -0,0 +1,38 @@
+From 2bf9388b801d4389e2d57e95a7897bfc1c42786e Mon Sep 17 00:00:00 2001
+From: Changqing Li <changqing.li@windriver.com>
+Date: Thu, 14 Jan 2021 06:33:04 +0000
+Subject: [PATCH 08/12] tests/meson.build: use relative path to refer to files
+
+Fix error like:
+Fatal error: can't create tests/ptimer-test.p/..._qemu-5.2.0_hw_core_ptimer.c.o: File name too long
+
+when build path is too long, use meson.source_root() will make this
+filename too long. Fixed by using relative path to refer to files
+
+Upstream-Status: Submitted [send to qemu-devel]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+
+---
+ tests/unit/meson.build | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/unit/meson.build b/tests/unit/meson.build
+index 96b295263..e4c3246dc 100644
+--- a/tests/unit/meson.build
++++ b/tests/unit/meson.build
+@@ -44,9 +44,9 @@ tests = {
+ 'test-keyval': [testqapi],
+ 'test-logging': [],
+ 'test-uuid': [],
+- 'ptimer-test': ['ptimer-test-stubs.c', meson.project_source_root() / 'hw/core/ptimer.c'],
++ 'ptimer-test': ['ptimer-test-stubs.c', '../../hw/core/ptimer.c'],
+ 'test-qapi-util': [],
+- 'test-smp-parse': [qom, meson.project_source_root() / 'hw/core/machine-smp.c'],
++ 'test-smp-parse': [qom, '../../hw/core/machine-smp.c'],
+ }
+
+ if have_system or have_tools
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch b/meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch
new file mode 100644
index 0000000000..23d0a69802
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch
@@ -0,0 +1,49 @@
+From ebf4bb2f51da83af0c61480414cfa156f7308b34 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Mon, 21 Mar 2022 10:09:38 -0700
+Subject: [PATCH 09/12] Define MAP_SYNC and MAP_SHARED_VALIDATE on needed linux
+ systems
+
+linux only wires MAP_SYNC and MAP_SHARED_VALIDATE for architectures
+which include asm-generic/mman.h and mips/powerpc are not including this
+file in linux/mman.h, therefore these should be defined for such
+architectures on Linux as well. This fixes build on mips/musl/linux
+
+Upstream-Status: Submitted [https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg05298.html]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Cc: Zhang Yi <yi.z.zhang@linux.intel.com>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+
+---
+ util/mmap-alloc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/util/mmap-alloc.c b/util/mmap-alloc.c
+index 893d86435..86d3cda24 100644
+--- a/util/mmap-alloc.c
++++ b/util/mmap-alloc.c
+@@ -10,14 +10,18 @@
+ * later. See the COPYING file in the top-level directory.
+ */
+
++#include "qemu/osdep.h"
+ #ifdef CONFIG_LINUX
+ #include <linux/mman.h>
+-#else /* !CONFIG_LINUX */
++#endif /* CONFIG_LINUX */
++
++#ifndef MAP_SYNC
+ #define MAP_SYNC 0x0
++#endif /* MAP_SYNC */
++#ifndef MAP_SHARED_VALIDATE
+ #define MAP_SHARED_VALIDATE 0x0
+-#endif /* CONFIG_LINUX */
++#endif /* MAP_SHARED_VALIDATE */
+
+-#include "qemu/osdep.h"
+ #include "qemu/mmap-alloc.h"
+ #include "qemu/host-utils.h"
+ #include "qemu/cutils.h"
+--
+2.30.2
+
diff --git a/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
new file mode 100644
index 0000000000..810c74fabd
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch
@@ -0,0 +1,43 @@
+CVE: CVE-2022-1050
+Upstream-Status: Submitted [https://lore.kernel.org/qemu-devel/20220403095234.2210-1-yuval.shaia.ml@gmail.com/]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+From dbdef95c272e8f3ec037c3db4197c66002e30995 Mon Sep 17 00:00:00 2001
+From: Yuval Shaia <yuval.shaia.ml@gmail.com>
+Date: Sun, 3 Apr 2022 12:52:34 +0300
+Subject: [PATCH] hw/pvrdma: Protect against buggy or malicious guest driver
+
+Guest driver might execute HW commands when shared buffers are not yet
+allocated.
+This could happen on purpose (malicious guest) or because of some other
+guest/host address mapping error.
+We need to protect againts such case.
+
+Fixes: CVE-2022-1050
+
+Reported-by: Raven <wxhusst@gmail.com>
+Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
+---
+ hw/rdma/vmw/pvrdma_cmd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
+index da7ddfa548..89db963c46 100644
+--- a/hw/rdma/vmw/pvrdma_cmd.c
++++ b/hw/rdma/vmw/pvrdma_cmd.c
+@@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev)
+
+ dsr_info = &dev->dsr_info;
+
++ if (!dsr_info->dsr) {
++ /* Buggy or malicious guest driver */
++ rdma_error_report("Exec command without dsr, req or rsp buffers");
++ goto out;
++ }
++
+ if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) /
+ sizeof(struct cmd_handler)) {
+ rdma_error_report("Unsupported command");
+--
+2.34.1
+
diff --git a/meta/recipes-devtools/qemu/qemu/Qemu-Arm-versatilepb-Add-memory-size-checking.patch b/meta/recipes-devtools/qemu/qemu/Qemu-Arm-versatilepb-Add-memory-size-checking.patch
deleted file mode 100644
index 1a6cf5119b..0000000000
--- a/meta/recipes-devtools/qemu/qemu/Qemu-Arm-versatilepb-Add-memory-size-checking.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 896fa02c24347e6e9259812cfda187b1d6ca6199 Mon Sep 17 00:00:00 2001
-From: Jiang Lu <lu.jiang@windriver.com>
-Date: Wed, 13 Nov 2013 10:38:08 +0800
-Subject: [PATCH] Qemu:Arm:versatilepb: Add memory size checking
-
-The machine can not work with memory over 256M, so add a checking
-at startup. If the memory size exceed 256M, just stop emulation then
-throw out warning about memory limitation.
-
-Upstream-Status: Pending
-
-Signed-off-by: Jiang Lu <lu.jiang@windriver.com>
-
-Updated it on 2014-01-15 for rebasing
-
-Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
-
-Update it when upgrade qemu to 2.2.0
-
-Signed-off-by: Kai Kang <kai.kang@windriver.com>
-Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
----
- hw/arm/versatilepb.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
-index 6c69f4e..9278d90 100644
---- a/hw/arm/versatilepb.c
-+++ b/hw/arm/versatilepb.c
-@@ -204,6 +204,13 @@ static void versatile_init(MachineState *machine, int board_id)
- exit(1);
- }
-
-+ if (machine->ram_size > (256 << 20)) {
-+ fprintf(stderr,
-+ "qemu: Too much memory for this machine: %d MB, maximum 256 MB\n",
-+ ((unsigned int)ram_size / (1 << 20)));
-+ exit(1);
-+ }
-+
- cpuobj = object_new(object_class_get_name(cpu_oc));
-
- /* By default ARM1176 CPUs have EL3 enabled. This board does not
---
-2.1.0
-
diff --git a/meta/recipes-devtools/qemu/qemu/add-ptest-in-makefile.patch b/meta/recipes-devtools/qemu/qemu/add-ptest-in-makefile.patch
deleted file mode 100644
index a99f72098c..0000000000
--- a/meta/recipes-devtools/qemu/qemu/add-ptest-in-makefile.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-Upstream-Status: Pending
-
-Add subpackage -ptest which runs all unit test cases for qemu.
-
-Signed-off-by: Kai Kang <kai.kang@windriver.com>
----
- tests/Makefile | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/tests/Makefile b/tests/Makefile
-index 88f7105..3f40b4b 100644
---- a/tests/Makefile
-+++ b/tests/Makefile
-@@ -405,3 +405,12 @@ all: $(QEMU_IOTESTS_HELPERS-y)
-
- -include $(wildcard tests/*.d)
- -include $(wildcard tests/libqos/*.d)
-+
-+buildtest-TESTS: $(check-unit-y)
-+
-+runtest-TESTS:
-+ for f in $(check-unit-y); do \
-+ nf=$$(echo $$f | sed 's/tests\//\.\//g'); \
-+ $$nf; \
-+ done
-+
---
-1.7.9.5
-
diff --git a/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch b/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch
deleted file mode 100644
index 59cdc1c304..0000000000
--- a/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-Upstream-Status: Pending
-Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
-
-From 9ac096d8eccf2d56ece646320c282c8369f8337c Mon Sep 17 00:00:00 2001
-From: Cristian Iorga <cristian.iorga@intel.com>
-Date: Tue, 29 Jul 2014 18:35:59 +0300
-Subject: [PATCH] configure: fix Darwin target detection
-
-fix Darwin target detection for qemu
-cross-compilation.
-
-Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
----
- configure | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/configure b/configure
-index 283c71c..1c66a11 100755
---- a/configure
-+++ b/configure
-@@ -444,6 +444,8 @@ elif check_define __sun__ ; then
- targetos='SunOS'
- elif check_define __HAIKU__ ; then
- targetos='Haiku'
-+elif check_define __APPLE__ ; then
-+ targetos='Darwin'
- else
- targetos=`uname -s`
- fi
---
-1.9.1
-
diff --git a/meta/recipes-devtools/qemu/qemu/cpus.c-qemu_cpu_kick_thread_debugging.patch b/meta/recipes-devtools/qemu/qemu/cpus.c-qemu_cpu_kick_thread_debugging.patch
deleted file mode 100644
index 6822132541..0000000000
--- a/meta/recipes-devtools/qemu/qemu/cpus.c-qemu_cpu_kick_thread_debugging.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 697a834c35d19447b7dcdb9e1d9434bc6ce17c21 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?An=C3=ADbal=20Lim=C3=B3n?= <anibal.limon@linux.intel.com>
-Date: Wed, 12 Aug 2015 15:11:30 -0500
-Subject: [PATCH] cpus.c: Add error messages when qemi_cpu_kick_thread fails.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Add custom_debug.h with function for print backtrace information.
-When pthread_kill fails in qemu_cpu_kick_thread display backtrace and
-current cpu information.
-
-Upstream-Status: Inappropriate
-Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com>
----
- cpus.c | 5 +++++
- custom_debug.h | 24 ++++++++++++++++++++++++
- 2 files changed, 29 insertions(+)
- create mode 100644 custom_debug.h
-
-diff --git a/cpus.c b/cpus.c
-index a822ce3..7e4786e 100644
---- a/cpus.c
-+++ b/cpus.c
-@@ -1080,6 +1080,8 @@ static void *qemu_tcg_cpu_thread_fn(void *arg)
- return NULL;
- }
-
-+#include "custom_debug.h"
-+
- static void qemu_cpu_kick_thread(CPUState *cpu)
- {
- #ifndef _WIN32
-@@ -1088,6 +1090,9 @@ static void qemu_cpu_kick_thread(CPUState *cpu)
- err = pthread_kill(cpu->thread->thread, SIG_IPI);
- if (err) {
- fprintf(stderr, "qemu:%s: %s", __func__, strerror(err));
-+ fprintf(stderr, "CPU #%d:\n", cpu->cpu_index);
-+ cpu_dump_state(cpu, stderr, fprintf, 0);
-+ backtrace_print();
- exit(1);
- }
- #else /* _WIN32 */
-diff --git a/custom_debug.h b/custom_debug.h
-new file mode 100644
-index 0000000..f029e45
---- /dev/null
-+++ b/custom_debug.h
-@@ -0,0 +1,24 @@
-+#include <execinfo.h>
-+#include <stdio.h>
-+#define BACKTRACE_MAX 128
-+static void backtrace_print(void)
-+{
-+ int nfuncs = 0;
-+ void *buf[BACKTRACE_MAX];
-+ char **symbols;
-+ int i;
-+
-+ nfuncs = backtrace(buf, BACKTRACE_MAX);
-+
-+ symbols = backtrace_symbols(buf, nfuncs);
-+ if (symbols == NULL) {
-+ fprintf(stderr, "backtrace_print failed to get symbols");
-+ return;
-+ }
-+
-+ fprintf(stderr, "Backtrace ...\n");
-+ for (i = 0; i < nfuncs; i++)
-+ fprintf(stderr, "%s\n", symbols[i]);
-+
-+ free(symbols);
-+}
---
-1.9.1
-
diff --git a/meta/recipes-devtools/qemu/qemu/cross.patch b/meta/recipes-devtools/qemu/qemu/cross.patch
new file mode 100644
index 0000000000..ca2ad361ef
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/cross.patch
@@ -0,0 +1,38 @@
+From 76c3fc4c87231bed32974ebbbdb5079cff45a6b7 Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Tue, 5 Jan 2021 23:00:14 +0000
+Subject: [PATCH 12/12] qemu: Upgrade 5.1.0->5.2.0
+
+We need to be able to trigger configure's cross code but we don't want
+to set cross_prefix as it does other things we don't want. Patch things
+so we can do what we need in the target config case.
+
+Upstream-Status: Inappropriate [may be rewritten in a way upstream may accept?]
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+
+---
+ configure | 4 ----
+ 1 file changed, 4 deletions(-)
+
+Index: qemu-7.1.0/configure
+===================================================================
+--- qemu-7.1.0.orig/configure
++++ qemu-7.1.0/configure
+@@ -2710,7 +2710,6 @@ if test "$skip_meson" = no; then
+ echo "strip = [$(meson_quote $strip)]" >> $cross
+ echo "widl = [$(meson_quote $widl)]" >> $cross
+ echo "windres = [$(meson_quote $windres)]" >> $cross
+- if test "$cross_compile" = "yes"; then
+ cross_arg="--cross-file config-meson.cross"
+ echo "[host_machine]" >> $cross
+ echo "system = '$targetos'" >> $cross
+@@ -2728,9 +2727,6 @@ if test "$skip_meson" = no; then
+ else
+ echo "endian = 'little'" >> $cross
+ fi
+- else
+- cross_arg="--native-file config-meson.cross"
+- fi
+ mv $cross config-meson.cross
+
+ rm -rf meson-private meson-info meson-logs
diff --git a/meta/recipes-devtools/qemu/qemu/disable-grabs.patch b/meta/recipes-devtools/qemu/qemu/disable-grabs.patch
deleted file mode 100644
index 123833f824..0000000000
--- a/meta/recipes-devtools/qemu/qemu/disable-grabs.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-When the pointer enters the Qemu window it calls SDL_WM_GrabInput, which calls
-XGrabPointer in a busyloop until it returns GrabSuccess. However if there's already
-a pointer grab (screen is locked, a menu is open) then qemu will hang until the
-grab can be taken. In the specific case of a headless X server on an autobuilder, once
-the screensaver has kicked in any qemu instance that appears underneath the
-pointer will hang.
-
-I'm not entirely sure why pointer grabs are required (the documentation
-explicitly says it doesn't do grabs when using a tablet, which we are) so wrap
-them in a conditional that can be set by the autobuilder environment, preserving
-the current grabbing behaviour for everyone else.
-
-Upstream-Status: Pending
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-From 4b1988ecb01a178269ec0513a75f2ec620c7ef6a Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@intel.com>
-Date: Wed, 18 Sep 2013 14:04:54 +0100
-Subject: [PATCH] sdl.c: allow user to disable pointer grabs
-
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-Signed-off-by: Eric Bénard <eric@eukrea.com>
----
- ui/sdl.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/ui/sdl.c b/ui/sdl.c
-index 39a42d6..9b8abe5 100644
---- a/ui/sdl.c
-+++ b/ui/sdl.c
-@@ -59,6 +59,10 @@ static SDL_Cursor *guest_sprite = NULL;
- static int scaling_active = 0;
- static Notifier mouse_mode_notifier;
- static int idle_counter;
-+#ifndef True
-+#define True 1
-+#endif
-+static doing_grabs = True;
-
- static void sdl_update(DisplayChangeListener *dcl,
- int x, int y, int w, int h)
-@@ -384,14 +388,16 @@ static void sdl_grab_start(void)
- }
- } else
- sdl_hide_cursor();
-- SDL_WM_GrabInput(SDL_GRAB_ON);
-+ if (doing_grabs)
-+ SDL_WM_GrabInput(SDL_GRAB_ON);
- gui_grab = 1;
- sdl_update_caption();
- }
-
- static void sdl_grab_end(void)
- {
-- SDL_WM_GrabInput(SDL_GRAB_OFF);
-+ if (doing_grabs)
-+ SDL_WM_GrabInput(SDL_GRAB_OFF);
- gui_grab = 0;
- sdl_show_cursor();
- sdl_update_caption();
-@@ -909,6 +915,8 @@ void sdl_display_init(DisplayState *ds, int full_screen, int no_frame)
- * This requires SDL >= 1.2.14. */
- setenv("SDL_DISABLE_LOCK_KEYS", "1", 1);
-
-+ doing_grabs = (getenv("QEMU_DONT_GRAB") == NULL);
-+
- flags = SDL_INIT_VIDEO | SDL_INIT_NOPARACHUTE;
- if (SDL_Init (flags)) {
- fprintf(stderr, "Could not initialize SDL(%s) - exiting\n",
---
-1.8.3.1
-
diff --git a/meta/recipes-devtools/qemu/qemu/exclude-some-arm-EABI-obsolete-syscalls.patch b/meta/recipes-devtools/qemu/qemu/exclude-some-arm-EABI-obsolete-syscalls.patch
deleted file mode 100644
index 171bda7e95..0000000000
--- a/meta/recipes-devtools/qemu/qemu/exclude-some-arm-EABI-obsolete-syscalls.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-[PATCH] exclude some arm EABI obsolete syscalls
-
-Upstream-Status: Pending
-
-some syscalls are obsolete and no longer available for EABI, exclude them to
-fix the below error:
- In file included from qemu-seccomp.c:16:0:
- qemu-seccomp.c:28:7: error: '__NR_select' undeclared here (not in a function)
- { SCMP_SYS(select), 252 },
- ^
- qemu-seccomp.c:36:7: error: '__NR_mmap' undeclared here (not in a function)
- { SCMP_SYS(mmap), 247 },
- ^
- qemu-seccomp.c:57:7: error: '__NR_getrlimit' undeclared here (not in a function)
- { SCMP_SYS(getrlimit), 245 },
- ^
- qemu-seccomp.c:96:7: error: '__NR_time' undeclared here (not in a function)
- { SCMP_SYS(time), 245 },
- ^
- qemu-seccomp.c:185:7: error: '__NR_alarm' undeclared here (not in a function)
- { SCMP_SYS(alarm), 241 },
-
-please refer source files:
- arch/arm/include/uapi/asm/unistd.h
-or kernel header:
- /usr/include/asm/unistd.h
-
-Signed-off-by: Roy.Li <rongqing.li@windriver.com>
----
- qemu-seccomp.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/qemu-seccomp.c b/qemu-seccomp.c
-index caa926e..5a78502 100644
---- a/qemu-seccomp.c
-+++ b/qemu-seccomp.c
-@@ -25,15 +25,21 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
- { SCMP_SYS(timer_settime), 255 },
- { SCMP_SYS(timer_gettime), 254 },
- { SCMP_SYS(futex), 253 },
-+#if !defined(__ARM_EABI__)
- { SCMP_SYS(select), 252 },
-+ { SCMP_SYS(time), 245 },
-+ { SCMP_SYS(alarm), 241 },
-+ { SCMP_SYS(getrlimit), 245 },
-+ { SCMP_SYS(mmap), 247 },
-+ { SCMP_SYS(socketcall), 250 },
-+ { SCMP_SYS(ipc), 245 },
-+#endif
- { SCMP_SYS(recvfrom), 251 },
- { SCMP_SYS(sendto), 250 },
-- { SCMP_SYS(socketcall), 250 },
- { SCMP_SYS(read), 249 },
- { SCMP_SYS(io_submit), 249 },
- { SCMP_SYS(brk), 248 },
- { SCMP_SYS(clone), 247 },
-- { SCMP_SYS(mmap), 247 },
- { SCMP_SYS(mprotect), 246 },
- { SCMP_SYS(execve), 245 },
- { SCMP_SYS(open), 245 },
-@@ -48,13 +54,11 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
- { SCMP_SYS(bind), 245 },
- { SCMP_SYS(listen), 245 },
- { SCMP_SYS(semget), 245 },
-- { SCMP_SYS(ipc), 245 },
- { SCMP_SYS(gettimeofday), 245 },
- { SCMP_SYS(readlink), 245 },
- { SCMP_SYS(access), 245 },
- { SCMP_SYS(prctl), 245 },
- { SCMP_SYS(signalfd), 245 },
-- { SCMP_SYS(getrlimit), 245 },
- { SCMP_SYS(set_tid_address), 245 },
- { SCMP_SYS(statfs), 245 },
- { SCMP_SYS(unlink), 245 },
-@@ -93,7 +97,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
- { SCMP_SYS(times), 245 },
- { SCMP_SYS(exit), 245 },
- { SCMP_SYS(clock_gettime), 245 },
-- { SCMP_SYS(time), 245 },
- { SCMP_SYS(restart_syscall), 245 },
- { SCMP_SYS(pwrite64), 245 },
- { SCMP_SYS(nanosleep), 245 },
-@@ -182,7 +185,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
- { SCMP_SYS(lstat64), 241 },
- { SCMP_SYS(sendfile64), 241 },
- { SCMP_SYS(ugetrlimit), 241 },
-- { SCMP_SYS(alarm), 241 },
- { SCMP_SYS(rt_sigsuspend), 241 },
- { SCMP_SYS(rt_sigqueueinfo), 241 },
- { SCMP_SYS(rt_tgsigqueueinfo), 241 },
---
-1.9.1
-
diff --git a/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch b/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch
deleted file mode 100644
index cee6a676ab..0000000000
--- a/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-fix libcap header issue on some distro
-
-1, When build qemu-native on SLED 11.2, there is an error:
-...
-| In file included from /usr/include/bits/sigcontext.h:28,
-| from /usr/include/signal.h:339,
-| from /buildarea2/tmp/work/i686-linux/qemu-native/1.4.0-r0/
-qemu-1.4.0/include/qemu-common.h:42,
-| from fsdev/virtfs-proxy-helper.c:23:
-| /usr/include/asm/sigcontext.h:28: error: expected specifier-
-qualifier-list before '__u64'
-| /usr/include/asm/sigcontext.h:191: error: expected specifier-
-qualifier-list before '__u64'
-...
-
-2, The virtfs-proxy-helper.c includes <sys/capability.h> and
-qemu-common.h in sequence. The header include map is:
-(`-->' presents `include')
-...
-"virtfs-proxy-helper.c" --> <sys/capability.h>
-...
-"virtfs-proxy-helper.c" --> "qemu-common.h" --> <signal.h> -->
-<bits/sigcontext.h> --> <asm/sigcontext.h> --> <linux/types.h> -->
-<asm/types.h> --> <asm-generic/types.h> --> <asm-generic/int-ll64.h>
-...
-
-3, The bug is found on SLED 11.2 x86. In libcap header file
-/usr/include/sys/capability.h, it does evil stuff like this:
-...
- 25 /*
- 26 * Make sure we can be included from userland by preventing
- 27 * capability.h from including other kernel headers
- 28 */
- 29 #define _LINUX_TYPES_H
- 30 #define _LINUX_FS_H
- 31 #define __LINUX_COMPILER_H
- 32 #define __user
- 33
- 34 typedef unsigned int __u32;
- 35 typedef __u32 __le32;
-...
-This completely prevents including /usr/include/linux/types.h.
-The above `<asm/sigcontext.h> --> <linux/types.h>' is prevented,
-and '__u64' is defined in <asm-generic/int-ll64.h>.
-
-4, Modify virtfs-proxy-helper.c to include <sys/capability.h>
-last to workaround the issue.
-
-http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
-http://patchwork.linuxtv.org/patch/12748/
-
-Upstream-Status: Pending
-Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
----
- fsdev/virtfs-proxy-helper.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
---- a/fsdev/virtfs-proxy-helper.c
-+++ b/fsdev/virtfs-proxy-helper.c
-@@ -12,7 +12,6 @@
- #include <sys/resource.h>
- #include <getopt.h>
- #include <syslog.h>
--#include <sys/capability.h>
- #include <sys/fsuid.h>
- #include <sys/vfs.h>
- #include <sys/ioctl.h>
-@@ -26,7 +25,11 @@
- #include "9p-iov-marshal.h"
- #include "hw/9pfs/9p-proxy.h"
- #include "fsdev/9p-iov-marshal.h"
--
-+/*
-+ * Include this one last due to some versions of it being buggy:
-+ * http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
-+ */
-+#include <sys/capability.h>
- #define PROGNAME "virtfs-proxy-helper"
-
- #ifndef XFS_SUPER_MAGIC
---
-1.7.10.4
-
diff --git a/meta/recipes-devtools/qemu/qemu/no-valgrind.patch b/meta/recipes-devtools/qemu/qemu/no-valgrind.patch
deleted file mode 100644
index 91f728042d..0000000000
--- a/meta/recipes-devtools/qemu/qemu/no-valgrind.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-There isn't an option to enable or disable valgrind support, so disable it to avoid non-deterministic builds.
-
-Upstream-Status: Inappropriate
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-
-diff --git a/configure b/configure
-index b3c4f51..4d3929e 100755
---- a/configure
-+++ b/configure
-@@ -4193,9 +4192,0 @@ valgrind_h=no
--cat > $TMPC << EOF
--#include <valgrind/valgrind.h>
--int main(void) {
-- return 0;
--}
--EOF
--if compile_prog "" "" ; then
-- valgrind_h=yes
--fi
diff --git a/meta/recipes-devtools/qemu/qemu/pathlimit.patch b/meta/recipes-devtools/qemu/qemu/pathlimit.patch
deleted file mode 100644
index 57ab981c61..0000000000
--- a/meta/recipes-devtools/qemu/qemu/pathlimit.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-By default qemu builds a complete list of directories within the user
-emulation sysroot (-L option). The OE sysroot directory is large and
-this is confusing, for example it indexes all pkgdata. In particular this
-confuses strace of qemu binaries with tons of irrelevant paths.
-
-This patch stops the code indexing up front and instead only indexes
-things if/as/when it needs to. This drastically reduces the files it
-reads and reduces memory usage and cleans up strace.
-
-It would also avoid the infinite directory traversal bug in [YOCTO #6996]
-although the code could still be vulnerable if it parsed those specific
-paths.
-
-RP
-2016/3/9
-Upstream-Status: Pending
-
-Index: qemu-2.5.0/util/path.c
-===================================================================
---- qemu-2.5.0.orig/util/path.c
-+++ qemu-2.5.0/util/path.c
-@@ -19,6 +19,7 @@ struct pathelem
- char *name;
- /* Full path name, eg. /usr/gnemul/x86-linux/lib. */
- char *pathname;
-+ int populated_entries;
- struct pathelem *parent;
- /* Children */
- unsigned int num_entries;
-@@ -49,6 +50,7 @@ static struct pathelem *new_entry(const
- new->name = g_strdup(name);
- new->pathname = g_strdup_printf("%s/%s", root, name);
- new->num_entries = 0;
-+ new->populated_entries = 0;
- return new;
- }
-
-@@ -57,15 +59,16 @@ static struct pathelem *new_entry(const
- /* Not all systems provide this feature */
- #if defined(DT_DIR) && defined(DT_UNKNOWN) && defined(DT_LNK)
- # define dirent_type(dirent) ((dirent)->d_type)
--# define is_dir_maybe(type) \
-- ((type) == DT_DIR || (type) == DT_UNKNOWN || (type) == DT_LNK)
-+# define is_not_dir(type) \
-+ ((type) != DT_DIR && (type) != DT_UNKNOWN && (type) != DT_LNK)
- #else
- # define dirent_type(dirent) (1)
--# define is_dir_maybe(type) (type)
-+# define is_not_dir(type) (0)
- #endif
-
- static struct pathelem *add_dir_maybe(struct pathelem *path)
- {
-+ unsigned int i;
- DIR *dir;
-
- if ((dir = opendir(path->pathname)) != NULL) {
-@@ -78,6 +81,11 @@ static struct pathelem *add_dir_maybe(st
- }
- closedir(dir);
- }
-+
-+ for (i = 0; i < path->num_entries; i++)
-+ (path->entries[i])->parent = path;
-+
-+ path->populated_entries = 1;
- return path;
- }
-
-@@ -93,26 +101,16 @@ static struct pathelem *add_entry(struct
- e = &root->entries[root->num_entries-1];
-
- *e = new_entry(root->pathname, root, name);
-- if (is_dir_maybe(type)) {
-- *e = add_dir_maybe(*e);
-+ if (is_not_dir(type)) {
-+ (*e)->populated_entries = 1;
- }
-
- return root;
- }
-
--/* This needs to be done after tree is stabilized (ie. no more reallocs!). */
--static void set_parents(struct pathelem *child, struct pathelem *parent)
--{
-- unsigned int i;
--
-- child->parent = parent;
-- for (i = 0; i < child->num_entries; i++)
-- set_parents(child->entries[i], child);
--}
--
- /* FIXME: Doesn't handle DIR/.. where DIR is not in emulated dir. */
- static const char *
--follow_path(const struct pathelem *cursor, const char *name)
-+follow_path(struct pathelem *cursor, struct pathelem **source, const char *name)
- {
- unsigned int i, namelen;
-
-@@ -123,14 +121,18 @@ follow_path(const struct pathelem *curso
- return cursor->pathname;
-
- if (strneq(name, namelen, ".."))
-- return follow_path(cursor->parent, name + namelen);
-+ return follow_path(cursor->parent, &cursor->parent, name + namelen);
-
- if (strneq(name, namelen, "."))
-- return follow_path(cursor, name + namelen);
-+ return follow_path(cursor, source, name + namelen);
-+
-+ if (!cursor->populated_entries)
-+ *source = add_dir_maybe(cursor);
-+ cursor = *source;
-
- for (i = 0; i < cursor->num_entries; i++)
- if (strneq(name, namelen, cursor->entries[i]->name))
-- return follow_path(cursor->entries[i], name + namelen);
-+ return follow_path(cursor->entries[i], &cursor->entries[i], name + namelen);
-
- /* Not found */
- return NULL;
-@@ -164,8 +166,6 @@ void init_paths(const char *prefix)
- g_free(base->name);
- g_free(base);
- base = NULL;
-- } else {
-- set_parents(base, base);
- }
- }
-
-@@ -177,5 +177,5 @@ const char *path(const char *name)
- if (!base || !name || name[0] != '/')
- return name;
-
-- return follow_path(base, name) ?: name;
-+ return follow_path(base, &base, name) ?: name;
- }
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-2.5.0-cflags.patch b/meta/recipes-devtools/qemu/qemu/qemu-2.5.0-cflags.patch
deleted file mode 100644
index 173394fd02..0000000000
--- a/meta/recipes-devtools/qemu/qemu/qemu-2.5.0-cflags.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/configure
-+++ b/configure
-@@ -4468,10 +4468,6 @@ fi
- if test "$gcov" = "yes" ; then
- CFLAGS="-fprofile-arcs -ftest-coverage -g $CFLAGS"
- LDFLAGS="-fprofile-arcs -ftest-coverage $LDFLAGS"
--elif test "$fortify_source" = "yes" ; then
-- CFLAGS="-O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $CFLAGS"
--elif test "$debug" = "no"; then
-- CFLAGS="-O2 $CFLAGS"
- fi
-
- ##########################################
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-7.0.0-glibc-2.36.patch b/meta/recipes-devtools/qemu/qemu/qemu-7.0.0-glibc-2.36.patch
new file mode 100644
index 0000000000..abad1cfeeb
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/qemu-7.0.0-glibc-2.36.patch
@@ -0,0 +1,46 @@
+Avoid conflicts between sys/mount.h and linux/mount.h that are seen
+with glibc 2.36
+
+Source: https://github.com/archlinux/svntogit-packages/blob/packages/qemu/trunk/qemu-7.0.0-glibc-2.36.patch
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+--- a/linux-user/syscall.c
++++ b/linux-user/syscall.c
+@@ -95,7 +95,25 @@
+ #include <linux/soundcard.h>
+ #include <linux/kd.h>
+ #include <linux/mtio.h>
++
++#ifdef HAVE_SYS_MOUNT_FSCONFIG
++/*
++ * glibc >= 2.36 linux/mount.h conflicts with sys/mount.h,
++ * which in turn prevents use of linux/fs.h. So we have to
++ * define the constants ourselves for now.
++ */
++#define FS_IOC_GETFLAGS _IOR('f', 1, long)
++#define FS_IOC_SETFLAGS _IOW('f', 2, long)
++#define FS_IOC_GETVERSION _IOR('v', 1, long)
++#define FS_IOC_SETVERSION _IOW('v', 2, long)
++#define FS_IOC_FIEMAP _IOWR('f', 11, struct fiemap)
++#define FS_IOC32_GETFLAGS _IOR('f', 1, int)
++#define FS_IOC32_SETFLAGS _IOW('f', 2, int)
++#define FS_IOC32_GETVERSION _IOR('v', 1, int)
++#define FS_IOC32_SETVERSION _IOW('v', 2, int)
++#else
+ #include <linux/fs.h>
++#endif
+ #include <linux/fd.h>
+ #if defined(CONFIG_FIEMAP)
+ #include <linux/fiemap.h>
+--- a/meson.build
++++ b/meson.build
+@@ -1686,6 +1686,8 @@ config_host_data.set('HAVE_OPTRESET',
+ cc.has_header_symbol('getopt.h', 'optreset'))
+ config_host_data.set('HAVE_IPPROTO_MPTCP',
+ cc.has_header_symbol('netinet/in.h', 'IPPROTO_MPTCP'))
++config_host_data.set('HAVE_SYS_MOUNT_FSCONFIG',
++ cc.has_header_symbol('sys/mount.h', 'FSCONFIG_SET_FLAG'))
+
+ # has_member
+ config_host_data.set('HAVE_SIGEV_NOTIFY_THREAD_ID',
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-enlarge-env-entry-size.patch b/meta/recipes-devtools/qemu/qemu/qemu-enlarge-env-entry-size.patch
deleted file mode 100644
index c7425ab8d4..0000000000
--- a/meta/recipes-devtools/qemu/qemu/qemu-enlarge-env-entry-size.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-qemu: Add addition environment space to boot loader qemu-system-mips
-
-Upstream-Status: Inappropriate - OE uses deep paths
-
-If you create a project with very long directory names like 128 characters
-deep and use NFS, the kernel arguments will be truncated. The kernel will
-accept longer strings such as 1024 bytes, but the qemu boot loader defaulted
-to only 256 bytes. This patch expands the limit.
-
-Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
-Signed-off-by: Roy Li <rongqing.li@windriver.com>
----
- hw/mips/mips_malta.c | 2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
-index 9d521cc..17c0391 100644
---- a/hw/mips/mips_malta.c
-+++ b/hw/mips/mips_malta.c
-@@ -53,7 +53,7 @@
-
- #define ENVP_ADDR 0x80002000l
- #define ENVP_NB_ENTRIES 16
--#define ENVP_ENTRY_SIZE 256
-+#define ENVP_ENTRY_SIZE 1024
-
- /* Hardware addresses */
- #define FLASH_ADDRESS 0x1e000000ULL
---
-1.7.10.4
-
diff --git a/meta/recipes-devtools/qemu/qemu/run-ptest b/meta/recipes-devtools/qemu/qemu/run-ptest
index f4b8e97e1e..f9a4e8fb2b 100644
--- a/meta/recipes-devtools/qemu/qemu/run-ptest
+++ b/meta/recipes-devtools/qemu/qemu/run-ptest
@@ -1,8 +1,13 @@
#!/bin/sh
#
#This script is used to run qemu test suites
-ptestdir=$(pwd)
-cd tests
+#
+ptestdir=$(dirname "$(readlink -f "$0")")
export SRC_PATH=$ptestdir
-make -k runtest-TESTS | sed '/: OK/ s/^/PASS: /g'
+
+cd $ptestdir/tests
+tests=$(find . -name "test-*" ! -name "*.p")
+for f in $tests; do
+ $f | sed '/^ok/ s/ok/PASS:/g'
+done
diff --git a/meta/recipes-devtools/qemu/qemu/wacom.patch b/meta/recipes-devtools/qemu/qemu/wacom.patch
deleted file mode 100644
index cd06aa4ac6..0000000000
--- a/meta/recipes-devtools/qemu/qemu/wacom.patch
+++ /dev/null
@@ -1,130 +0,0 @@
-The USB wacom device is missing a HID descriptor which causes it
-to fail to operate with recent kernels (e.g. 3.17).
-
-This patch adds a HID desriptor to the device, based upon one from
-real wcom device.
-
-Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-
-Upstream-Status: Submitted
-2014/11/27
-
-Index: qemu-2.1.0/hw/usb/dev-wacom.c
-===================================================================
---- qemu-2.1.0.orig/hw/usb/dev-wacom.c 2014-08-01 15:12:17.000000000 +0100
-+++ qemu-2.1.0/hw/usb/dev-wacom.c 2014-10-12 12:13:30.540306042 +0100
-@@ -68,6 +68,89 @@
- [STR_SERIALNUMBER] = "1",
- };
-
-+static const uint8_t qemu_tablet_hid_report_descriptor[] = {
-+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
-+ 0x09, 0x02, /* Usage (Mouse) */
-+ 0xa1, 0x01, /* Collection (Application) */
-+ 0x85, 0x01, /* Report ID (1) */
-+ 0x09, 0x01, /* Usage (Pointer) */
-+ 0xa1, 0x00, /* Collection (Physical) */
-+ 0x05, 0x09, /* Usage Page (Button) */
-+ 0x19, 0x01, /* Usage Minimum (1) */
-+ 0x29, 0x05, /* Usage Maximum (5) */
-+ 0x15, 0x00, /* Logical Minimum (0) */
-+ 0x25, 0x01, /* Logical Maximum (1) */
-+ 0x95, 0x05, /* Report Count (5) */
-+ 0x75, 0x01, /* Report Size (1) */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0x95, 0x01, /* Report Count (1) */
-+ 0x75, 0x03, /* Report Size (3) */
-+ 0x81, 0x01, /* Input (Constant) */
-+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
-+ 0x09, 0x30, /* Usage (X) */
-+ 0x09, 0x31, /* Usage (Y) */
-+ 0x15, 0x81, /* Logical Minimum (-127) */
-+ 0x25, 0x7f, /* Logical Maximum (127) */
-+ 0x75, 0x08, /* Report Size (8) */
-+ 0x95, 0x02, /* Report Count (2) */
-+ 0x81, 0x06, /* Input (Data, Variable, Relative) */
-+ 0xc0, /* End Collection */
-+ 0xc0, /* End Collection */
-+ 0x05, 0x0d, /* Usage Page (Digitizer) */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0xa1, 0x01, /* Collection (Application) */
-+ 0x85, 0x02, /* Report ID (2) */
-+ 0xa1, 0x00, /* Collection (Physical) */
-+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0x15, 0x00, /* Logical Minimum (0) */
-+ 0x26, 0xff, 0x00, /* Logical Maximum (255) */
-+ 0x75, 0x08, /* Report Size (8) */
-+ 0x95, 0x08, /* Report Count (8) */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0xc0, /* End Collection */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0x85, 0x02, /* Report ID (2) */
-+ 0x95, 0x01, /* Report Count (1) */
-+ 0xb1, 0x02, /* FEATURE (2) */
-+ 0xc0, /* End Collection */
-+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0xa1, 0x01, /* Collection (Application) */
-+ 0x85, 0x02, /* Report ID (2) */
-+ 0x05, 0x0d, /* Usage Page (Digitizer) */
-+ 0x09, 0x22, /* Usage (Finger) */
-+ 0xa1, 0x00, /* Collection (Physical) */
-+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0x15, 0x00, /* Logical Minimum (0) */
-+ 0x26, 0xff, 0x00, /* Logical Maximum */
-+ 0x75, 0x08, /* Report Size (8) */
-+ 0x95, 0x02, /* Report Count (2) */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
-+ 0x09, 0x30, /* Usage (X) */
-+ 0x35, 0x00, /* Physical Minimum */
-+ 0x46, 0xe0, 0x2e, /* Physical Maximum */
-+ 0x26, 0xe0, 0x01, /* Logical Maximum */
-+ 0x75, 0x10, /* Report Size (16) */
-+ 0x95, 0x01, /* Report Count (1) */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0x09, 0x31, /* Usage (Y) */
-+ 0x46, 0x40, 0x1f, /* Physical Maximum */
-+ 0x26, 0x40, 0x01, /* Logical Maximum */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
-+ 0x09, 0x01, /* Usage (Digitizer) */
-+ 0x26, 0xff, 0x00, /* Logical Maximum */
-+ 0x75, 0x08, /* Report Size (8) */
-+ 0x95, 0x0d, /* Report Count (13) */
-+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
-+ 0xc0, /* End Collection */
-+ 0xc0, /* End Collection */
-+};
-+
-+
- static const USBDescIface desc_iface_wacom = {
- .bInterfaceNumber = 0,
- .bNumEndpoints = 1,
-@@ -85,7 +168,7 @@
- 0x00, /* u8 country_code */
- 0x01, /* u8 num_descriptors */
- 0x22, /* u8 type: Report */
-- 0x6e, 0, /* u16 len */
-+ sizeof(qemu_tablet_hid_report_descriptor), 0, /* u16 len */
- },
- },
- },
-@@ -265,6 +350,15 @@
- }
-
- switch (request) {
-+ case InterfaceRequest | USB_REQ_GET_DESCRIPTOR:
-+ switch (value >> 8) {
-+ case 0x22:
-+ memcpy(data, qemu_tablet_hid_report_descriptor,
-+ sizeof(qemu_tablet_hid_report_descriptor));
-+ p->actual_length = sizeof(qemu_tablet_hid_report_descriptor);
-+ break;
-+ }
-+ break;
- case WACOM_SET_REPORT:
- if (s->mouse_grabbed) {
- qemu_remove_mouse_event_handler(s->eh_entry);