qemu: upgrade to 2.7.0

This upgrade can fix a qemuppc + openssh bug, the ssh connection maybe
refused or closed randomly, and it's not easy to reproduce. RP pointed
that this upgrade can fix the problem, and it does work in my local
testing.

* Update add-ptest-in-makefile.patch

Here is the Changlog:
http://wiki.qemu.org/ChangeLog/2.7

(From OE-Core rev: 056ce17e168bf856ff95a6f659098403169cb889)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

1 files changed, 0 insertions, 75 deletions

diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-6351_p1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-6351_p1.patch
deleted file mode 100644
index 350ae2becc..0000000000
--- a/meta/recipes-devtools/qemu/qemu/CVE-2016-6351_p1.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 926cde5f3e4d2504ed161ed0cb771ac7cad6fd11 Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 16 Jun 2016 00:22:35 +0200
-Subject: [PATCH] scsi: esp: make cmdbuf big enough for maximum CDB size
-
-While doing DMA read into ESP command buffer 's->cmdbuf', it could
-write past the 's->cmdbuf' area, if it was transferring more than 16
-bytes.  Increase the command buffer size to 32, which is maximum when
-'s->do_cmd' is set, and add a check on 'len' to avoid OOB access.
-
-Reported-by: Li Qiang <liqiang6-s@360.cn>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-Upstream-Status: Backport
-CVE: CVE-2016-6351 patch1
-Signed-off-by: Armin Kuster <akuster@mvista.com>
-
----
- hw/scsi/esp.c         | 6 ++++--
- include/hw/scsi/esp.h | 3 ++-
- 2 files changed, 6 insertions(+), 3 deletions(-)
-
-Index: qemu-2.4.0/hw/scsi/esp.c
-===================================================================
---- qemu-2.4.0.orig/hw/scsi/esp.c
-+++ qemu-2.4.0/hw/scsi/esp.c
-@@ -241,6 +241,8 @@ static void esp_do_dma(ESPState *s)
-     len = s->dma_left;
-     if (s->do_cmd) {
-         trace_esp_do_dma(s->cmdlen, len);
-+        assert (s->cmdlen <= sizeof(s->cmdbuf) &&
-+                len <= sizeof(s->cmdbuf) - s->cmdlen);
-         s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
-         s->ti_size = 0;
-         s->cmdlen = 0;
-@@ -340,7 +342,7 @@ static void handle_ti(ESPState *s)
-     s->dma_counter = dmalen;
- 
-     if (s->do_cmd)
--        minlen = (dmalen < 32) ? dmalen : 32;
-+        minlen = (dmalen < ESP_CMDBUF_SZ) ? dmalen : ESP_CMDBUF_SZ;
-     else if (s->ti_size < 0)
-         minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
-     else
-@@ -446,7 +448,7 @@ void esp_reg_write(ESPState *s, uint32_t
-         break;
-     case ESP_FIFO:
-         if (s->do_cmd) {
--            if (s->cmdlen < TI_BUFSZ) {
-+            if (s->cmdlen < ESP_CMDBUF_SZ) {
-                 s->cmdbuf[s->cmdlen++] = val & 0xff;
-             } else {
-                 trace_esp_error_fifo_overrun();
-Index: qemu-2.4.0/include/hw/scsi/esp.h
-===================================================================
---- qemu-2.4.0.orig/include/hw/scsi/esp.h
-+++ qemu-2.4.0/include/hw/scsi/esp.h
-@@ -14,6 +14,7 @@ void esp_init(hwaddr espaddr, int it_shi
- 
- #define ESP_REGS 16
- #define TI_BUFSZ 16
-+#define ESP_CMDBUF_SZ 32
- 
- typedef struct ESPState ESPState;
- 
-@@ -31,7 +32,7 @@ struct ESPState {
-     SCSIBus bus;
-     SCSIDevice *current_dev;
-     SCSIRequest *current_req;
--    uint8_t cmdbuf[TI_BUFSZ];
-+    uint8_t cmdbuf[ESP_CMDBUF_SZ];
-     uint32_t cmdlen;
-     uint32_t do_cmd;
-