Skip to content

Commit

Permalink
qemu: 2.7 -> 2.8, drop 2.7
Browse files Browse the repository at this point in the history
  • Loading branch information
@grahamc
grahamc committed Jan 27, 2017
1 parent f97d456 commit 19d9fe2
Showing 1 changed file with 9 additions and 126 deletions.
135 changes: 9 additions & 126 deletions pkgs/applications/virtualization/qemu/default.nix
View file
@@ -1,6 +1,6 @@
{ stdenv, fetchurl, fetchpatch, python, zlib, pkgconfig, glib
, ncurses, perl, pixman, vde2, alsaLib, texinfo, libuuid, flex
, bison, lzo, snappy, libaio, gnutls, nettle
{ stdenv, fetchurl, fetchpatch, python2, zlib, pkgconfig, glib
, ncurses, perl, pixman, vde2, alsaLib, texinfo, flex
, bison, lzo, snappy, libaio, gnutls, nettle, curl
, makeWrapper
, attr, libcap, libcap_ng
, CoreServices, Cocoa, rez, setfile
Expand All @@ -16,27 +16,27 @@

with stdenv.lib;
let
version = "2.7.0";
version = "2.8.0";
audio = optionalString (hasSuffix "linux" stdenv.system) "alsa,"
+ optionalString pulseSupport "pa,"
+ optionalString sdlSupport "sdl,";
in

stdenv.mkDerivation rec {
name = "qemu-"
name = "qemu-"
+ stdenv.lib.optionalString x86Only "x86-only-"
+ stdenv.lib.optionalString nixosTestRunner "for-vm-tests-"
+ version;

src = fetchurl {
url = "http://wiki.qemu.org/download/qemu-${version}.tar.bz2";
sha256 = "0lqyz01z90nvxpc3nx4djbci7hx62cwvs5zwd6phssds0sap6vij";
sha256 = "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs";
};

buildInputs =
[ python zlib pkgconfig glib ncurses perl pixman
vde2 texinfo libuuid flex bison makeWrapper lzo snappy
gnutls nettle
[ python2 zlib pkgconfig glib ncurses perl pixman
vde2 texinfo flex bison makeWrapper lzo snappy
gnutls nettle curl
]
++ optionals stdenv.isDarwin [ CoreServices Cocoa rez setfile ]
++ optionals seccompSupport [ libseccomp ]
Expand All @@ -51,123 +51,6 @@ stdenv.mkDerivation rec {

patches = [
./no-etc-install.patch
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/net-vmxnet-initialise-local-tx-descriptor-CVE-2016-6836.patch";
sha256 = "1i01vsxsdwrb5r7i9dmrshal4fvpj2j01cmvfkl5wz3ssq5z02wc";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-mptconfig-fix-an-assert-expression-CVE-2016-7157.patch";
sha256 = "1wqf9k79wdr1k25siyhhybz1bpb0iyshv6fvsf55pgk5p0dg1970";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-mptconfig-fix-misuse-of-MPTSAS_CONFIG_PACK-CVE-2016-7157.patch";
sha256 = "0l78fcbq8mywlgax234dh4226kxzbdgmarz1yrssaaiipkzq4xgw";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-mptsas-use-g_new0-to-allocate-MPTSASRequest-obj-CVE-2016-7423.patch";
sha256 = "14l8w40zjjhpmzz4rkh69h5na8d4did7v99ng7nzrychakd5l29h";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-pvscsi-check-page-count-while-initialising-descriptor-rings-CVE-2016-7155.patch";
sha256 = "1dwkci5mqgx3xz2q69kbcn48l8vwql9g3qaza2jxi402xdgc07zn";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-pvscsi-limit-loop-to-fetch-SG-list-CVE-2016-7156.patch";
sha256 = "1r5xm4m9g39p89smsia4i9jbs32nq9gdkpx6wgd91vmswggcbqsi";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/scsi-pvscsi-limit-process-IO-loop-to-ring-size-CVE-2016-7421.patch";
sha256 = "07661d1kd0ddkmzsrjph7jnhz2qbfavkxamnvs3axaqpp52kx6ga";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/usb-xhci-fix-memory-leak-in-usb_xhci_exit-CVE-2016-7466.patch";
sha256 = "0nckwzn9k6369vni12s8hhjn73gbk6ns0mazns0dlgcq546q2fjj";
})
(fetchpatch {
url = "https://sources.debian.net/data/main/q/qemu/1:2.7+dfsg-3/debian/patches/virtio-add-check-for-descriptor-s-mapped-address-CVE-2016-7422.patch";
sha256 = "1f1ilpzlxfjqvwmv9h0mzygwl5l8zd690f32vxfv9g6rfbr5h72k";
})
(fetchpatch {
name = "qemu-CVE-2016-8909.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=0c0fc2b5fd534786051889459848764edd798050";
sha256 = "0mavkajxchfacpl4gpg7dhppbnhs1bbqn2rwqwiwkl0m5h19d9fv";
})
(fetchpatch {
name = "qemu-CVE-2016-8910.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=c7c35916692fe010fef25ac338443d3fe40be225";
sha256 = "10qmlggifdmvj5hg3brs712agjq6ppnslm0n5d5jfgjl7599wxml";
})
(fetchpatch {
name = "qemu-CVE-2016-9103.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=eb687602853b4ae656e9236ee4222609f3a6887d";
sha256 = "0j20n4z1wzybx8m7pn1zsxmz4rbl8z14mbalfabcjdgz8sx8g90d";
})
(fetchpatch {
name = "qemu-CVE-2016-9104.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=7e55d65c56a03dcd2c5d7c49d37c5a74b55d4bd6";
sha256 = "1l99sf70098l6v05dq4x7p2glxx1l4nq1l8l3711ykp9vxkp91qs";
})
(fetchpatch {
name = "qemu-CVE-2016-9105.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=4c1586787ff43c9acd18a56c12d720e3e6be9f7c";
sha256 = "0b2w5myw2vjqk81wm8dz373xfhfkx3hgy7bxr94l060snxcl7ar4";
})
(fetchpatch {
name = "qemu-CVE-2016-9106.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=fdfcc9aeea1492f4b819a24c94dfb678145b1bf9";
sha256 = "0npi3fag52icq7xr799h5zi11xscbakdhqmdab0kyl6q331cc32z";
})
(fetchpatch {
name = "qemu-CVE-2016-7994.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=cb3a0522b694cc5bb6424497b3f828ccd28fd1dd";
sha256 = "1zhmbqlj0hc69ia4s6h59pi1z3nmijkryxwmf4bzp9gahx8x4xm3";
})
(fetchpatch {
name = "qemu-CVE-2016-8668.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=8caed3d564672e8bc6d2e4c6a35228afd01f4723";
sha256 = "19sq6fh7nh8wrk52skky4vwm80029lhm093g11f539krmzjgipik";
})
(fetchpatch {
name = "qemu-CVE-2016-7907.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=070c4b92b8cd5390889716677a0b92444d6e087a";
sha256 = "0in89697r6kwkf302v3cg16390q7qs33n2b4kba26m4x65632dxm";
})

# FIXME: Fix for CVE-2016-9101 not yet ready: https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03024.html

# from http://git.qemu.org/?p=qemu.git;a=patch;h=ff55e94d23ae94c8628b0115320157c763eb3e06
./CVE-2016-9102.patch

(fetchpatch {
name = "qemu-CVE-2016-9911.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=791f97758e223de3290592d169f8e6339c281714";
sha256 = "0952mpc81h42k5kqsw42prnw5vw86r3j88wk5z4sr1xd1sg428d6";
})
(fetchpatch {
name = "qemu-CVE-2016-9921_9922.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=4299b90e9ba9ce5ca9024572804ba751aa1a7e70";
sha256 = "125xlysdgpp59m4rp1mb59i3ipmf3yjk8x01gzvxcg1hnpgm4j4c";
})
(fetchpatch {
name = "qemu-CVE-2016-9845.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=42a8dadc74f8982fc269e54e3c5627b54d9f83d8";
sha256 = "0qivj585pp1g6xfzknzgi5d2p6can3ihfgpxz3wi12h5jl5q6677";
})
(fetchpatch {
name = "qemu-CVE-2016-9846.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=2d1cd6c7a91a4beb99a0c3a21be529222a708545";
sha256 = "1pa8wwxaz4k4sw1zfa4w0zlxkw6qpsrny1z8c8i8di91aswspq3i";
})
(fetchpatch {
name = "qemu-CVE-2016-9907.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=07b026fd82d6cf11baf7d7c603c4f5f6070b35bf";
sha256 = "0phsk2x6mfsd6gabmfk4pr5nc4aymcqsfd88zihlm9d20gg9pbv3";
})
(fetchpatch {
name = "qemu-CVE-2016-9912.patch";
url = "http://git.qemu.org/?p=qemu.git;a=patch;h=b8e23926c568f2e963af39028b71c472e3023793";
sha256 = "1b711s63pg6rzqkqyx0mrlb4x6jv3dscc90qg8w6lflwlhwa73iv";
})
] ++ optional nixosTestRunner ./force-uid0-on-9p.patch;
hardeningDisable = [ "stackprotector" ];

Expand Down

4 comments on commit 19d9fe2

@edolstra
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure whether major QEMU updates are appropriate for the stable branch. They've caused breakage in the past...

@fpletz
Copy link
Member

@fpletz fpletz commented on 19d9fe2 Feb 2, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reasoning here is that security fixes are only applied to the 2.8 branch upstream and some patches were difficult to backport.

@grahamc
Copy link
Member Author

@grahamc grahamc commented on 19d9fe2 Feb 2, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was agonizing over whether or not to backport the upgrade. I ran several of the tests and didn't find any issues, so I went with it. I wasn't thrilled either :/

@edolstra
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, thanks :-)

Please sign in to comment.