From 71d585a8deafbeea66a517313d9ae10862484d22 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 10 May 2017 14:17:32 +0200 Subject: qemu: Upgrade 2.5.1 -> 2.5.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a minor upgrade only comes with security fixes in qemu VGA and UART code to avoid corruptions (CVE-2016-3710 and CVE-2016-3712). For review details, http://git.qemu.org/?p=qemu.git;a=log;h=v2.5.1.1 (From OE-Core rev: da522c0c248c9a8b10a90de4cd6e7e05367e637d) This patch is backported from upstream morty branch: http://git.yoctoproject.org/cgit/cgit.cgi/poky/patch/?id=b0207e742542cc44086d612df0a216cc45875538 Signed-off-by: Aníbal Limón Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau --- .../recipes-devtools/qemu/qemu/CVE-2016-3710.patch | 112 ----------------- .../qemu/qemu/CVE-2016-3712_p1.patch | 73 ------------ .../qemu/qemu/CVE-2016-3712_p2.patch | 132 --------------------- .../qemu/qemu/CVE-2016-3712_p3.patch | 34 ------ .../qemu/qemu/CVE-2016-3712_p4.patch | 80 ------------- meta/recipes-devtools/qemu/qemu_2.5.1.1.bb | 33 ++++++ meta/recipes-devtools/qemu/qemu_2.5.1.bb | 38 ------ 7 files changed, 33 insertions(+), 469 deletions(-) delete mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-3710.patch delete mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p1.patch delete mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p2.patch delete mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p3.patch delete mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p4.patch create mode 100644 meta/recipes-devtools/qemu/qemu_2.5.1.1.bb delete mode 100644 meta/recipes-devtools/qemu/qemu_2.5.1.bb diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-3710.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-3710.patch deleted file mode 100644 index d3cd52bd5f..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2016-3710.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 4f0323d26c8da08b7bcfdd4722a38711bd2f1a3b Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Tue, 26 Apr 2016 08:49:10 +0200 -Subject: [PATCH] vga: fix banked access bounds checking (CVE-2016-3710) - -vga allows banked access to video memory using the window at 0xa00000 -and it supports a different access modes with different address -calculations. - -The VBE bochs extentions support banked access too, using the -VBE_DISPI_INDEX_BANK register. The code tries to take the different -address calculations into account and applies different limits to -VBE_DISPI_INDEX_BANK depending on the current access mode. - -Which is probably effective in stopping misprogramming by accident. -But from a security point of view completely useless as an attacker -can easily change access modes after setting the bank register. - -Drop the bogus check, add range checks to vga_mem_{readb,writeb} -instead. - -Fixes: CVE-2016-3710 -Reported-by: Qinghao Tang -Signed-off-by: Gerd Hoffmann -Signed-off-by: Michael Roth - -Upstream-Status: Backport -CVE: CVE-2016-3710 -Signed-off-by: Armin Kuster ---- - hw/display/vga.c | 24 ++++++++++++++++++------ - 1 file changed, 18 insertions(+), 6 deletions(-) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index 9f68394..442fee9 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -177,6 +177,7 @@ static void vga_update_memory_access(VGACommonState *s) - size = 0x8000; - break; - } -+ assert(offset + size <= s->vram_size); - memory_region_init_alias(&s->chain4_alias, memory_region_owner(&s->vram), - "vga.chain4", &s->vram, offset, size); - memory_region_add_subregion_overlap(s->legacy_address_space, base, -@@ -714,11 +715,7 @@ void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val) - vbe_fixup_regs(s); - break; - case VBE_DISPI_INDEX_BANK: -- if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) { -- val &= (s->vbe_bank_mask >> 2); -- } else { -- val &= s->vbe_bank_mask; -- } -+ val &= s->vbe_bank_mask; - s->vbe_regs[s->vbe_index] = val; - s->bank_offset = (val << 16); - vga_update_memory_access(s); -@@ -817,13 +814,21 @@ uint32_t vga_mem_readb(VGACommonState *s, hwaddr addr) - - if (s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) { - /* chain 4 mode : simplest access */ -+ assert(addr < s->vram_size); - ret = s->vram_ptr[addr]; - } else if (s->gr[VGA_GFX_MODE] & 0x10) { - /* odd/even mode (aka text mode mapping) */ - plane = (s->gr[VGA_GFX_PLANE_READ] & 2) | (addr & 1); -- ret = s->vram_ptr[((addr & ~1) << 1) | plane]; -+ addr = ((addr & ~1) << 1) | plane; -+ if (addr >= s->vram_size) { -+ return 0xff; -+ } -+ ret = s->vram_ptr[addr]; - } else { - /* standard VGA latched access */ -+ if (addr * sizeof(uint32_t) >= s->vram_size) { -+ return 0xff; -+ } - s->latch = ((uint32_t *)s->vram_ptr)[addr]; - - if (!(s->gr[VGA_GFX_MODE] & 0x08)) { -@@ -880,6 +885,7 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val) - plane = addr & 3; - mask = (1 << plane); - if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) { -+ assert(addr < s->vram_size); - s->vram_ptr[addr] = val; - #ifdef DEBUG_VGA_MEM - printf("vga: chain4: [0x" TARGET_FMT_plx "]\n", addr); -@@ -893,6 +899,9 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val) - mask = (1 << plane); - if (s->sr[VGA_SEQ_PLANE_WRITE] & mask) { - addr = ((addr & ~1) << 1) | plane; -+ if (addr >= s->vram_size) { -+ return; -+ } - s->vram_ptr[addr] = val; - #ifdef DEBUG_VGA_MEM - printf("vga: odd/even: [0x" TARGET_FMT_plx "]\n", addr); -@@ -966,6 +975,9 @@ void vga_mem_writeb(VGACommonState *s, hwaddr addr, uint32_t val) - mask = s->sr[VGA_SEQ_PLANE_WRITE]; - s->plane_updated |= mask; /* only used to detect font change */ - write_mask = mask16[mask]; -+ if (addr * sizeof(uint32_t) >= s->vram_size) { -+ return; -+ } - ((uint32_t *)s->vram_ptr)[addr] = - (((uint32_t *)s->vram_ptr)[addr] & ~write_mask) | - (val & write_mask); --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p1.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p1.patch deleted file mode 100644 index 07582ef929..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p1.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 46aff2c7e91ef9f372ad38ba5e90c42b9b27ac75 Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Tue, 26 Apr 2016 14:11:34 +0200 -Subject: [PATCH 1/4] vga: add vbe_enabled() helper - -Makes code a bit easier to read. - -Signed-off-by: Gerd Hoffmann -Signed-off-by: Michael Roth - -Upstream-Status: Backport -CVE: CVE-2016-3712 patch1 -Signed-off-by: Armin Kuster - ---- - hw/display/vga.c | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index 442fee9..cc1a682 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -140,6 +140,11 @@ static uint32_t expand4[256]; - static uint16_t expand2[256]; - static uint8_t expand4to8[16]; - -+static inline bool vbe_enabled(VGACommonState *s) -+{ -+ return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED; -+} -+ - static void vga_update_memory_access(VGACommonState *s) - { - hwaddr base, offset, size; -@@ -562,7 +567,7 @@ static void vbe_fixup_regs(VGACommonState *s) - uint16_t *r = s->vbe_regs; - uint32_t bits, linelength, maxy, offset; - -- if (!(r[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED)) { -+ if (!vbe_enabled(s)) { - /* vbe is turned off -- nothing to do */ - return; - } -@@ -1056,7 +1061,7 @@ static void vga_get_offsets(VGACommonState *s, - { - uint32_t start_addr, line_offset, line_compare; - -- if (s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED) { -+ if (vbe_enabled(s)) { - line_offset = s->vbe_line_offset; - start_addr = s->vbe_start_addr; - line_compare = 65535; -@@ -1381,7 +1386,7 @@ static int vga_get_bpp(VGACommonState *s) - { - int ret; - -- if (s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED) { -+ if (vbe_enabled(s)) { - ret = s->vbe_regs[VBE_DISPI_INDEX_BPP]; - } else { - ret = 0; -@@ -1393,7 +1398,7 @@ static void vga_get_resolution(VGACommonState *s, int *pwidth, int *pheight) - { - int width, height; - -- if (s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED) { -+ if (vbe_enabled(s)) { - width = s->vbe_regs[VBE_DISPI_INDEX_XRES]; - height = s->vbe_regs[VBE_DISPI_INDEX_YRES]; - } else { --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p2.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p2.patch deleted file mode 100644 index 11330d766d..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p2.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 2f2f74e87c15e830f5a4dda7a166effcab5047ec Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Tue, 26 Apr 2016 15:24:18 +0200 -Subject: [PATCH 2/4] vga: factor out vga register setup - -When enabling vbe mode qemu will setup a bunch of vga registers to make -sure the vga emulation operates in correct mode for a linear -framebuffer. Move that code to a separate function so we can call it -from other places too. - -Signed-off-by: Gerd Hoffmann -Signed-off-by: Michael Roth - -Upstream-Status: Backport -CVE: CVE-2016-3712 patch2 -Signed-off-by: Armin Kuster - ---- - hw/display/vga.c | 78 ++++++++++++++++++++++++++++++++------------------------ - 1 file changed, 44 insertions(+), 34 deletions(-) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index cc1a682..f1987e3 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -642,6 +642,49 @@ static void vbe_fixup_regs(VGACommonState *s) - s->vbe_start_addr = offset / 4; - } - -+/* we initialize the VGA graphic mode */ -+static void vbe_update_vgaregs(VGACommonState *s) -+{ -+ int h, shift_control; -+ -+ if (!vbe_enabled(s)) { -+ /* vbe is turned off -- nothing to do */ -+ return; -+ } -+ -+ /* graphic mode + memory map 1 */ -+ s->gr[VGA_GFX_MISC] = (s->gr[VGA_GFX_MISC] & ~0x0c) | 0x04 | -+ VGA_GR06_GRAPHICS_MODE; -+ s->cr[VGA_CRTC_MODE] |= 3; /* no CGA modes */ -+ s->cr[VGA_CRTC_OFFSET] = s->vbe_line_offset >> 3; -+ /* width */ -+ s->cr[VGA_CRTC_H_DISP] = -+ (s->vbe_regs[VBE_DISPI_INDEX_XRES] >> 3) - 1; -+ /* height (only meaningful if < 1024) */ -+ h = s->vbe_regs[VBE_DISPI_INDEX_YRES] - 1; -+ s->cr[VGA_CRTC_V_DISP_END] = h; -+ s->cr[VGA_CRTC_OVERFLOW] = (s->cr[VGA_CRTC_OVERFLOW] & ~0x42) | -+ ((h >> 7) & 0x02) | ((h >> 3) & 0x40); -+ /* line compare to 1023 */ -+ s->cr[VGA_CRTC_LINE_COMPARE] = 0xff; -+ s->cr[VGA_CRTC_OVERFLOW] |= 0x10; -+ s->cr[VGA_CRTC_MAX_SCAN] |= 0x40; -+ -+ if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) { -+ shift_control = 0; -+ s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */ -+ } else { -+ shift_control = 2; -+ /* set chain 4 mode */ -+ s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M; -+ /* activate all planes */ -+ s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES; -+ } -+ s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) | -+ (shift_control << 5); -+ s->cr[VGA_CRTC_MAX_SCAN] &= ~0x9f; /* no double scan */ -+} -+ - static uint32_t vbe_ioport_read_index(void *opaque, uint32_t addr) - { - VGACommonState *s = opaque; -@@ -728,52 +771,19 @@ void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val) - case VBE_DISPI_INDEX_ENABLE: - if ((val & VBE_DISPI_ENABLED) && - !(s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED)) { -- int h, shift_control; - - s->vbe_regs[VBE_DISPI_INDEX_VIRT_WIDTH] = 0; - s->vbe_regs[VBE_DISPI_INDEX_X_OFFSET] = 0; - s->vbe_regs[VBE_DISPI_INDEX_Y_OFFSET] = 0; - s->vbe_regs[VBE_DISPI_INDEX_ENABLE] |= VBE_DISPI_ENABLED; - vbe_fixup_regs(s); -+ vbe_update_vgaregs(s); - - /* clear the screen */ - if (!(val & VBE_DISPI_NOCLEARMEM)) { - memset(s->vram_ptr, 0, - s->vbe_regs[VBE_DISPI_INDEX_YRES] * s->vbe_line_offset); - } -- -- /* we initialize the VGA graphic mode */ -- /* graphic mode + memory map 1 */ -- s->gr[VGA_GFX_MISC] = (s->gr[VGA_GFX_MISC] & ~0x0c) | 0x04 | -- VGA_GR06_GRAPHICS_MODE; -- s->cr[VGA_CRTC_MODE] |= 3; /* no CGA modes */ -- s->cr[VGA_CRTC_OFFSET] = s->vbe_line_offset >> 3; -- /* width */ -- s->cr[VGA_CRTC_H_DISP] = -- (s->vbe_regs[VBE_DISPI_INDEX_XRES] >> 3) - 1; -- /* height (only meaningful if < 1024) */ -- h = s->vbe_regs[VBE_DISPI_INDEX_YRES] - 1; -- s->cr[VGA_CRTC_V_DISP_END] = h; -- s->cr[VGA_CRTC_OVERFLOW] = (s->cr[VGA_CRTC_OVERFLOW] & ~0x42) | -- ((h >> 7) & 0x02) | ((h >> 3) & 0x40); -- /* line compare to 1023 */ -- s->cr[VGA_CRTC_LINE_COMPARE] = 0xff; -- s->cr[VGA_CRTC_OVERFLOW] |= 0x10; -- s->cr[VGA_CRTC_MAX_SCAN] |= 0x40; -- -- if (s->vbe_regs[VBE_DISPI_INDEX_BPP] == 4) { -- shift_control = 0; -- s->sr[VGA_SEQ_CLOCK_MODE] &= ~8; /* no double line */ -- } else { -- shift_control = 2; -- /* set chain 4 mode */ -- s->sr[VGA_SEQ_MEMORY_MODE] |= VGA_SR04_CHN_4M; -- /* activate all planes */ -- s->sr[VGA_SEQ_PLANE_WRITE] |= VGA_SR02_ALL_PLANES; -- } -- s->gr[VGA_GFX_MODE] = (s->gr[VGA_GFX_MODE] & ~0x60) | -- (shift_control << 5); -- s->cr[VGA_CRTC_MAX_SCAN] &= ~0x9f; /* no double scan */ - } else { - s->bank_offset = 0; - } --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p3.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p3.patch deleted file mode 100644 index 3e6644d942..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p3.patch +++ /dev/null @@ -1,34 +0,0 @@ -From a6e5e5dd4bbc022acbd10ebcf415a6a57418d09e Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Tue, 26 Apr 2016 15:39:22 +0200 -Subject: [PATCH 3/4] vga: update vga register setup on vbe changes - -Call the new vbe_update_vgaregs() function on vbe configuration -changes, to make sure vga registers are up-to-date. - -Signed-off-by: Gerd Hoffmann -Signed-off-by: Michael Roth - -Upstream-Status: Backport -CVE: CVE-2016-3712 patch3 -Signed-off-by: Armin Kuster - ---- - hw/display/vga.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index f1987e3..10ac7df 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -761,6 +761,7 @@ void vbe_ioport_write_data(void *opaque, uint32_t addr, uint32_t val) - case VBE_DISPI_INDEX_Y_OFFSET: - s->vbe_regs[s->vbe_index] = val; - vbe_fixup_regs(s); -+ vbe_update_vgaregs(s); - break; - case VBE_DISPI_INDEX_BANK: - val &= s->vbe_bank_mask; --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p4.patch b/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p4.patch deleted file mode 100644 index 96e980a58d..0000000000 --- a/meta/recipes-devtools/qemu/qemu/CVE-2016-3712_p4.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 44b86aa32e4147c727fadd9a0f0bc503a5dedb72 Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Tue, 26 Apr 2016 14:48:06 +0200 -Subject: [PATCH 4/4] vga: make sure vga register setup for vbe stays intact - (CVE-2016-3712). - -Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT -registers, to make sure the vga registers will always have the -values needed by vbe mode. This makes sure the sanity checks -applied by vbe_fixup_regs() are effective. - -Without this guests can muck with shift_control, can turn on planar -vga modes or text mode emulation while VBE is active, making qemu -take code paths meant for CGA compatibility, but with the very -large display widths and heigts settable using VBE registers. - -Which is good for one or another buffer overflow. Not that -critical as they typically read overflows happening somewhere -in the display code. So guests can DoS by crashing qemu with a -segfault, but it is probably not possible to break out of the VM. - -Fixes: CVE-2016-3712 -Reported-by: Zuozhi Fzz -Reported-by: P J P -Signed-off-by: Gerd Hoffmann -Signed-off-by: Michael Roth - -Upstream-Status: Backport -CVE: CVE-2016-3712 patch4 ( the fix) -Signed-off-by: Armin Kuster - ---- - hw/display/vga.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index 10ac7df..679070e 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -140,6 +140,8 @@ static uint32_t expand4[256]; - static uint16_t expand2[256]; - static uint8_t expand4to8[16]; - -+static void vbe_update_vgaregs(VGACommonState *s); -+ - static inline bool vbe_enabled(VGACommonState *s) - { - return s->vbe_regs[VBE_DISPI_INDEX_ENABLE] & VBE_DISPI_ENABLED; -@@ -482,6 +484,7 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val) - printf("vga: write SR%x = 0x%02x\n", s->sr_index, val); - #endif - s->sr[s->sr_index] = val & sr_mask[s->sr_index]; -+ vbe_update_vgaregs(s); - if (s->sr_index == VGA_SEQ_CLOCK_MODE) { - s->update_retrace_info(s); - } -@@ -513,6 +516,7 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val) - printf("vga: write GR%x = 0x%02x\n", s->gr_index, val); - #endif - s->gr[s->gr_index] = val & gr_mask[s->gr_index]; -+ vbe_update_vgaregs(s); - vga_update_memory_access(s); - break; - case VGA_CRT_IM: -@@ -531,10 +535,12 @@ void vga_ioport_write(void *opaque, uint32_t addr, uint32_t val) - if (s->cr_index == VGA_CRTC_OVERFLOW) { - s->cr[VGA_CRTC_OVERFLOW] = (s->cr[VGA_CRTC_OVERFLOW] & ~0x10) | - (val & 0x10); -+ vbe_update_vgaregs(s); - } - return; - } - s->cr[s->cr_index] = val; -+ vbe_update_vgaregs(s); - - switch(s->cr_index) { - case VGA_CRTC_H_TOTAL: --- -2.7.4 - diff --git a/meta/recipes-devtools/qemu/qemu_2.5.1.1.bb b/meta/recipes-devtools/qemu/qemu_2.5.1.1.bb new file mode 100644 index 0000000000..bd6beafe17 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu_2.5.1.1.bb @@ -0,0 +1,33 @@ +require qemu.inc + +LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \ + file://COPYING.LIB;endline=24;md5=c04def7ae38850e7d3ef548588159913" + +SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ + file://qemu-enlarge-env-entry-size.patch \ + file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \ + file://no-valgrind.patch \ + file://CVE-2016-2198.patch \ + file://pathlimit.patch \ + file://rng_move_request_from_RngEgd_to_RngBackend.patch \ + file://rng_remove_the_unused_request_cancellation_code.patch \ + file://rng_move_request_queue_cleanup_from_RngEgd_to_RngBackend.patch \ + file://CVE-2016-2858.patch \ + file://CVE-2016-4439.patch \ + file://CVE-2016-6351_p1.patch \ + file://CVE-2016-6351_p2.patch \ + file://CVE-2016-4002.patch \ + file://CVE-2016-5403.patch \ + file://CVE-2016-4441.patch \ + file://CVE-2016-4952.patch \ + " +SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" +SRC_URI[md5sum] = "f5ff0e71398b9e428b4f177001ba4285" +SRC_URI[sha256sum] = "28d9946e43765a44ccccca3cba5f4f9034f2759ec1f2ce16594ddb6776c8efe6" + +COMPATIBLE_HOST_class-target_mips64 = "null" + +do_install_append() { + # Prevent QA warnings about installed ${localstatedir}/run + if [ -d ${D}${localstatedir}/run ]; then rmdir ${D}${localstatedir}/run; fi +} diff --git a/meta/recipes-devtools/qemu/qemu_2.5.1.bb b/meta/recipes-devtools/qemu/qemu_2.5.1.bb deleted file mode 100644 index 528e54649d..0000000000 --- a/meta/recipes-devtools/qemu/qemu_2.5.1.bb +++ /dev/null @@ -1,38 +0,0 @@ -require qemu.inc - -LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \ - file://COPYING.LIB;endline=24;md5=c04def7ae38850e7d3ef548588159913" - -SRC_URI += "file://configure-fix-Darwin-target-detection.patch \ - file://qemu-enlarge-env-entry-size.patch \ - file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \ - file://no-valgrind.patch \ - file://CVE-2016-2198.patch \ - file://pathlimit.patch \ - file://rng_move_request_from_RngEgd_to_RngBackend.patch \ - file://rng_remove_the_unused_request_cancellation_code.patch \ - file://rng_move_request_queue_cleanup_from_RngEgd_to_RngBackend.patch \ - file://CVE-2016-2858.patch \ - file://CVE-2016-3710.patch \ - file://CVE-2016-3712_p1.patch \ - file://CVE-2016-3712_p2.patch \ - file://CVE-2016-3712_p3.patch \ - file://CVE-2016-3712_p4.patch \ - file://CVE-2016-4439.patch \ - file://CVE-2016-6351_p1.patch \ - file://CVE-2016-6351_p2.patch \ - file://CVE-2016-4002.patch \ - file://CVE-2016-5403.patch \ - file://CVE-2016-4441.patch \ - file://CVE-2016-4952.patch \ - " -SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2" -SRC_URI[md5sum] = "42e73182dea8b9213fa7050e168a4615" -SRC_URI[sha256sum] = "028752c33bb786abbfe496ba57315dc5a7d0a33b5a7a767f6d7a29020c525d2c" - -COMPATIBLE_HOST_class-target_mips64 = "null" - -do_install_append() { - # Prevent QA warnings about installed ${localstatedir}/run - if [ -d ${D}${localstatedir}/run ]; then rmdir ${D}${localstatedir}/run; fi -} -- cgit v1.2.3-54-g00ecf