diff --git a/0001-virtio-9p-use-accessor-to-get-thread_pool.patch b/0001-virtio-9p-use-accessor-to-get-thread_pool.patch
deleted file mode 100644
index 83da7db..0000000
--- a/0001-virtio-9p-use-accessor-to-get-thread_pool.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Wed, 23 Dec 2015 10:56:58 +0100
-Subject: [PATCH] virtio-9p: use accessor to get thread_pool
-
-The aio_context_new() function does not allocate a thread pool. This is
-deferred to the first call to the aio_get_thread_pool() accessor. It is
-hence forbidden to access the thread_pool field directly, as it may be
-NULL. The accessor *must* be used always.
-
-Fixes: ebac1202c95a4f1b76b6ef3f0f63926fa76e753e
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-Tested-by: Michael Tokarev <mjt@tls.msk.ru>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-(cherry picked from commit 4b3a4f2d458ca5a7c6c16ac36a8d9ac22cc253d6)
----
- hw/9pfs/virtio-9p-coth.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/9pfs/virtio-9p-coth.c b/hw/9pfs/virtio-9p-coth.c
-index fb6e8f8..ab9425c 100644
---- a/hw/9pfs/virtio-9p-coth.c
-+++ b/hw/9pfs/virtio-9p-coth.c
-@@ -36,6 +36,6 @@ static int coroutine_enter_func(void *arg)
- void co_run_in_worker_bh(void *opaque)
- {
- Coroutine *co = opaque;
-- thread_pool_submit_aio(qemu_get_aio_context()->thread_pool,
-+ thread_pool_submit_aio(aio_get_thread_pool(qemu_get_aio_context()),
- coroutine_enter_func, co, coroutine_enter_cb, co);
- }
diff --git a/0002-ehci-make-idt-processing-more-robust.patch b/0002-ehci-make-idt-processing-more-robust.patch
deleted file mode 100644
index d8caaff..0000000
--- a/0002-ehci-make-idt-processing-more-robust.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 14 Dec 2015 09:21:23 +0100
-Subject: [PATCH] ehci: make idt processing more robust
-
-Make ehci_process_itd return an error in case we didn't do any actual
-iso transfer because we've found no active transaction. That'll avoid
-ehci happily run in circles forever if the guest builds a loop out of
-idts.
-
-This is CVE-2015-8558.
-
-Cc: qemu-stable@nongnu.org
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Tested-by: P J P <ppandit@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 156a2e4dbffa85997636a7a39ef12da6f1b40254)
----
- hw/usb/hcd-ehci.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
-index 4e2161b..d07f228 100644
---- a/hw/usb/hcd-ehci.c
-+++ b/hw/usb/hcd-ehci.c
-@@ -1389,7 +1389,7 @@ static int ehci_process_itd(EHCIState *ehci,
- {
- USBDevice *dev;
- USBEndpoint *ep;
-- uint32_t i, len, pid, dir, devaddr, endp;
-+ uint32_t i, len, pid, dir, devaddr, endp, xfers = 0;
- uint32_t pg, off, ptr1, ptr2, max, mult;
-
- ehci->periodic_sched_active = PERIODIC_ACTIVE;
-@@ -1479,9 +1479,10 @@ static int ehci_process_itd(EHCIState *ehci,
- ehci_raise_irq(ehci, USBSTS_INT);
- }
- itd->transact[i] &= ~ITD_XACT_ACTIVE;
-+ xfers++;
- }
- }
-- return 0;
-+ return xfers ? 0 : -1;
- }
-
-
diff --git a/0003-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch b/0003-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch
deleted file mode 100644
index 518faf7..0000000
--- a/0003-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From: P J P <ppandit@redhat.com>
-Date: Tue, 15 Dec 2015 12:27:54 +0530
-Subject: [PATCH] net: vmxnet3: avoid memory leakage in activate_device
-
-Vmxnet3 device emulator does not check if the device is active
-before activating it, also it did not free the transmit & receive
-buffers while deactivating the device, thus resulting in memory
-leakage on the host. This patch fixes both these issues to avoid
-host memory leakage.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit aa4a3dce1c88ed51b616806b8214b7c8428b7470)
----
- hw/net/vmxnet3.c | 24 ++++++++++++++++--------
- 1 file changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
-index 37373e5..2b4aad7 100644
---- a/hw/net/vmxnet3.c
-+++ b/hw/net/vmxnet3.c
-@@ -1194,8 +1194,13 @@ static void vmxnet3_reset_mac(VMXNET3State *s)
-
- static void vmxnet3_deactivate_device(VMXNET3State *s)
- {
-- VMW_CBPRN("Deactivating vmxnet3...");
-- s->device_active = false;
-+ if (s->device_active) {
-+ VMW_CBPRN("Deactivating vmxnet3...");
-+ vmxnet_tx_pkt_reset(s->tx_pkt);
-+ vmxnet_tx_pkt_uninit(s->tx_pkt);
-+ vmxnet_rx_pkt_uninit(s->rx_pkt);
-+ s->device_active = false;
-+ }
- }
-
- static void vmxnet3_reset(VMXNET3State *s)
-@@ -1204,7 +1209,6 @@ static void vmxnet3_reset(VMXNET3State *s)
-
- vmxnet3_deactivate_device(s);
- vmxnet3_reset_interrupt_states(s);
-- vmxnet_tx_pkt_reset(s->tx_pkt);
- s->drv_shmem = 0;
- s->tx_sop = true;
- s->skip_current_tx_pkt = false;
-@@ -1431,6 +1435,12 @@ static void vmxnet3_activate_device(VMXNET3State *s)
- return;
- }
-
-+ /* Verify if device is active */
-+ if (s->device_active) {
-+ VMW_CFPRN("Vmxnet3 device is active");
-+ return;
-+ }
-+
- vmxnet3_adjust_by_guest_type(s);
- vmxnet3_update_features(s);
- vmxnet3_update_pm_state(s);
-@@ -1627,7 +1637,7 @@ static void vmxnet3_handle_command(VMXNET3State *s, uint64_t cmd)
- break;
-
- case VMXNET3_CMD_QUIESCE_DEV:
-- VMW_CBPRN("Set: VMXNET3_CMD_QUIESCE_DEV - pause the device");
-+ VMW_CBPRN("Set: VMXNET3_CMD_QUIESCE_DEV - deactivate the device");
- vmxnet3_deactivate_device(s);
- break;
-
-@@ -1741,7 +1751,7 @@ vmxnet3_io_bar1_write(void *opaque,
- * shared address only after we get the high part
- */
- if (val == 0) {
-- s->device_active = false;
-+ vmxnet3_deactivate_device(s);
- }
- s->temp_shared_guest_driver_memory = val;
- s->drv_shmem = 0;
-@@ -2021,9 +2031,7 @@ static bool vmxnet3_peer_has_vnet_hdr(VMXNET3State *s)
- static void vmxnet3_net_uninit(VMXNET3State *s)
- {
- g_free(s->mcast_list);
-- vmxnet_tx_pkt_reset(s->tx_pkt);
-- vmxnet_tx_pkt_uninit(s->tx_pkt);
-- vmxnet_rx_pkt_uninit(s->rx_pkt);
-+ vmxnet3_deactivate_device(s);
- qemu_del_nic(s->nic);
- }
-
diff --git a/0004-i386-avoid-null-pointer-dereference.patch b/0004-i386-avoid-null-pointer-dereference.patch
deleted file mode 100644
index 17b2c5c..0000000
--- a/0004-i386-avoid-null-pointer-dereference.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From: P J P <ppandit@redhat.com>
-Date: Fri, 18 Dec 2015 11:35:07 +0530
-Subject: [PATCH] i386: avoid null pointer dereference
-
- Hello,
-
-A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It
-occurs while doing I/O port write operations via hmp interface. In that,
-'current_cpu' remains null as it is not called from cpu_exec loop, which
-results in the said issue.
-
-Below is a proposed (tested)patch to fix this issue; Does it look okay?
-
-===
-From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Fri, 18 Dec 2015 11:16:07 +0530
-Subject: [PATCH] i386: avoid null pointer dereference
-
-When I/O port write operation is called from hmp interface,
-'current_cpu' remains null, as it is not called from cpu_exec()
-loop. This leads to a null pointer dereference in vapic_write
-routine. Add check to avoid it.
-
-Reported-by: Ling Liu <liuling-it@360.cn>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-Id: <alpine.LFD.2.20.1512181129320.9805@wniryva>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: P J P <ppandit@redhat.com>
-(cherry picked from commit 4c1396cb576c9b14425558b73de1584c7a9735d7)
----
- hw/i386/kvmvapic.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
-index c6d34b2..f0922da 100644
---- a/hw/i386/kvmvapic.c
-+++ b/hw/i386/kvmvapic.c
-@@ -634,13 +634,18 @@ static int vapic_prepare(VAPICROMState *s)
- static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
- unsigned int size)
- {
-- CPUState *cs = current_cpu;
-- X86CPU *cpu = X86_CPU(cs);
-- CPUX86State *env = &cpu->env;
-- hwaddr rom_paddr;
- VAPICROMState *s = opaque;
-+ X86CPU *cpu;
-+ CPUX86State *env;
-+ hwaddr rom_paddr;
-
-- cpu_synchronize_state(cs);
-+ if (!current_cpu) {
-+ return;
-+ }
-+
-+ cpu_synchronize_state(current_cpu);
-+ cpu = X86_CPU(current_cpu);
-+ env = &cpu->env;
-
- /*
- * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
diff --git a/0005-scsi-initialise-info-object-with-appropriate-size.patch b/0005-scsi-initialise-info-object-with-appropriate-size.patch
deleted file mode 100644
index 2d5605c..0000000
--- a/0005-scsi-initialise-info-object-with-appropriate-size.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: P J P <ppandit@redhat.com>
-Date: Mon, 21 Dec 2015 15:13:13 +0530
-Subject: [PATCH] scsi: initialise info object with appropriate size
-
-While processing controller 'CTRL_GET_INFO' command, the routine
-'megasas_ctrl_get_info' overflows the '&info' object size. Use its
-appropriate size to null initialise it.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-Id: <alpine.LFD.2.20.1512211501420.22471@wniryva>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: P J P <ppandit@redhat.com>
-(cherry picked from commit 36fef36b91f7ec0435215860f1458b5342ce2811)
----
- hw/scsi/megasas.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
-index d7dc667..576f56c 100644
---- a/hw/scsi/megasas.c
-+++ b/hw/scsi/megasas.c
-@@ -718,7 +718,7 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
- BusChild *kid;
- int num_pd_disks = 0;
-
-- memset(&info, 0x0, cmd->iov_size);
-+ memset(&info, 0x0, dcmd_size);
- if (cmd->iov_size < dcmd_size) {
- trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
- dcmd_size);
diff --git a/0006-net-rocker-fix-an-incorrect-array-bounds-check.patch b/0006-net-rocker-fix-an-incorrect-array-bounds-check.patch
deleted file mode 100644
index 6701693..0000000
--- a/0006-net-rocker-fix-an-incorrect-array-bounds-check.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Mon, 28 Dec 2015 16:24:08 +0530
-Subject: [PATCH] net: rocker: fix an incorrect array bounds check
-
-While processing transmit(tx) descriptors in 'tx_consume' routine
-the switch emulator suffers from an off-by-one error, if a
-descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16)
-fragments. Fix an incorrect bounds check to avoid it.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit 007cd223de527b5f41278f2d886c1a4beb3e67aa)
----
- hw/net/rocker/rocker.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
-index c57f1a6..2e77e50 100644
---- a/hw/net/rocker/rocker.c
-+++ b/hw/net/rocker/rocker.c
-@@ -232,6 +232,9 @@ static int tx_consume(Rocker *r, DescInfo *info)
- frag_addr = rocker_tlv_get_le64(tlvs[ROCKER_TLV_TX_FRAG_ATTR_ADDR]);
- frag_len = rocker_tlv_get_le16(tlvs[ROCKER_TLV_TX_FRAG_ATTR_LEN]);
-
-+ if (iovcnt >= ROCKER_TX_FRAGS_MAX) {
-+ goto err_too_many_frags;
-+ }
- iov[iovcnt].iov_len = frag_len;
- iov[iovcnt].iov_base = g_malloc(frag_len);
- if (!iov[iovcnt].iov_base) {
-@@ -244,10 +247,7 @@ static int tx_consume(Rocker *r, DescInfo *info)
- err = -ROCKER_ENXIO;
- goto err_bad_io;
- }
--
-- if (++iovcnt > ROCKER_TX_FRAGS_MAX) {
-- goto err_too_many_frags;
-- }
-+ iovcnt++;
- }
-
- if (iovcnt) {
diff --git a/0007-net-ne2000-fix-bounds-check-in-ioport-operations.patch b/0007-net-ne2000-fix-bounds-check-in-ioport-operations.patch
deleted file mode 100644
index fcd93bc..0000000
--- a/0007-net-ne2000-fix-bounds-check-in-ioport-operations.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 31 Dec 2015 17:05:27 +0530
-Subject: [PATCH] net: ne2000: fix bounds check in ioport operations
-
-While doing ioport r/w operations, ne2000 device emulation suffers
-from OOB r/w errors. Update respective array bounds check to avoid
-OOB access.
-
-Reported-by: Ling Liu <liuling-it@360.cn>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit aa7f9966dfdff500bbbf1956d9e115b1fa8987a6)
----
- hw/net/ne2000.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
-index 010f9ef..a3dffff 100644
---- a/hw/net/ne2000.c
-+++ b/hw/net/ne2000.c
-@@ -467,8 +467,9 @@ static inline void ne2000_mem_writel(NE2000State *s, uint32_t addr,
- uint32_t val)
- {
- addr &= ~1; /* XXX: check exact behaviour if not even */
-- if (addr < 32 ||
-- (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
-+ if (addr < 32
-+ || (addr >= NE2000_PMEM_START
-+ && addr + sizeof(uint32_t) <= NE2000_MEM_SIZE)) {
- stl_le_p(s->mem + addr, val);
- }
- }
-@@ -497,8 +498,9 @@ static inline uint32_t ne2000_mem_readw(NE2000State *s, uint32_t addr)
- static inline uint32_t ne2000_mem_readl(NE2000State *s, uint32_t addr)
- {
- addr &= ~1; /* XXX: check exact behaviour if not even */
-- if (addr < 32 ||
-- (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
-+ if (addr < 32
-+ || (addr >= NE2000_PMEM_START
-+ && addr + sizeof(uint32_t) <= NE2000_MEM_SIZE)) {
- return ldl_le_p(s->mem + addr);
- } else {
- return 0xffffffff;
diff --git a/0008-ide-ahci-reset-ncq-object-to-unused-on-error.patch b/0008-ide-ahci-reset-ncq-object-to-unused-on-error.patch
deleted file mode 100644
index 865e17a..0000000
--- a/0008-ide-ahci-reset-ncq-object-to-unused-on-error.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Mon, 11 Jan 2016 14:10:42 -0500
-Subject: [PATCH] ide: ahci: reset ncq object to unused on error
-
-When processing NCQ commands, AHCI device emulation prepares a
-NCQ transfer object; To which an aio control block(aiocb) object
-is assigned in 'execute_ncq_command'. In case, when the NCQ
-command is invalid, the 'aiocb' object is not assigned, and NCQ
-transfer object is left as 'used'. This leads to a use after
-free kind of error in 'bdrv_aio_cancel_async' via 'ahci_reset_port'.
-Reset NCQ transfer object to 'unused' to avoid it.
-
-[Maintainer edit: s/ACHI/AHCI/ in the commit message. --js]
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Reviewed-by: John Snow <jsnow@redhat.com>
-Message-id: 1452282511-4116-1-git-send-email-ppandit@redhat.com
-Signed-off-by: John Snow <jsnow@redhat.com>
-(cherry picked from commit 4ab0359a8ae182a7ac5c99609667273167703fab)
----
- hw/ide/ahci.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
-index dd1912e..17f1cbd 100644
---- a/hw/ide/ahci.c
-+++ b/hw/ide/ahci.c
-@@ -910,6 +910,7 @@ static void ncq_err(NCQTransferState *ncq_tfs)
- ide_state->error = ABRT_ERR;
- ide_state->status = READY_STAT | ERR_STAT;
- ncq_tfs->drive->port_regs.scr_err |= (1 << ncq_tfs->tag);
-+ ncq_tfs->used = 0;
- }
-
- static void ncq_finish(NCQTransferState *ncq_tfs)
diff --git a/0009-hmp-fix-sendkey-out-of-bounds-write-CVE-2015-8619.patch b/0009-hmp-fix-sendkey-out-of-bounds-write-CVE-2015-8619.patch
deleted file mode 100644
index 5961343..0000000
--- a/0009-hmp-fix-sendkey-out-of-bounds-write-CVE-2015-8619.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Wed, 13 Jan 2016 09:09:58 +0100
-Subject: [PATCH] hmp: fix sendkey out of bounds write (CVE-2015-8619)
-
-When processing 'sendkey' command, hmp_sendkey routine null
-terminates the 'keyname_buf' array. This results in an OOB
-write issue, if 'keyname_len' was to fall outside of
-'keyname_buf' array.
-
-Since the keyname's length is known the keyname_buf can be
-removed altogether by adding a length parameter to
-index_from_key() and using it for the error output as well.
-
-Reported-by: Ling Liu <liuling-it@360.cn>
-Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Message-Id: <20160113080958.GA18934@olga>
-[Comparison with "<" dumbed down, test for junk after strtoul()
-tweaked]
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
-
-(cherry picked from commit 64ffbe04eaafebf4045a3ace52a360c14959d196)
----
- hmp.c | 18 ++++++++----------
- include/ui/console.h | 2 +-
- ui/input-legacy.c | 5 +++--
- 3 files changed, 12 insertions(+), 13 deletions(-)
-
-diff --git a/hmp.c b/hmp.c
-index 2140605..1904203 100644
---- a/hmp.c
-+++ b/hmp.c
-@@ -1734,21 +1734,18 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict)
- int has_hold_time = qdict_haskey(qdict, "hold-time");
- int hold_time = qdict_get_try_int(qdict, "hold-time", -1);
- Error *err = NULL;
-- char keyname_buf[16];
- char *separator;
- int keyname_len;
-
- while (1) {
- separator = strchr(keys, '-');
- keyname_len = separator ? separator - keys : strlen(keys);
-- pstrcpy(keyname_buf, sizeof(keyname_buf), keys);
-
- /* Be compatible with old interface, convert user inputted "<" */
-- if (!strncmp(keyname_buf, "<", 1) && keyname_len == 1) {
-- pstrcpy(keyname_buf, sizeof(keyname_buf), "less");
-+ if (keys[0] == '<' && keyname_len == 1) {
-+ keys = "less";
- keyname_len = 4;
- }
-- keyname_buf[keyname_len] = 0;
-
- keylist = g_malloc0(sizeof(*keylist));
- keylist->value = g_malloc0(sizeof(*keylist->value));
-@@ -1761,16 +1758,17 @@ void hmp_sendkey(Monitor *mon, const QDict *qdict)
- }
- tmp = keylist;
-
-- if (strstart(keyname_buf, "0x", NULL)) {
-+ if (strstart(keys, "0x", NULL)) {
- char *endp;
-- int value = strtoul(keyname_buf, &endp, 0);
-- if (*endp != '\0') {
-+ int value = strtoul(keys, &endp, 0);
-+ assert(endp <= keys + keyname_len);
-+ if (endp != keys + keyname_len) {
- goto err_out;
- }
- keylist->value->type = KEY_VALUE_KIND_NUMBER;
- keylist->value->u.number = value;
- } else {
-- int idx = index_from_key(keyname_buf);
-+ int idx = index_from_key(keys, keyname_len);
- if (idx == Q_KEY_CODE_MAX) {
- goto err_out;
- }
-@@ -1792,7 +1790,7 @@ out:
- return;
-
- err_out:
-- monitor_printf(mon, "invalid parameter: %s\n", keyname_buf);
-+ monitor_printf(mon, "invalid parameter: %.*s\n", keyname_len, keys);
- goto out;
- }
-
-diff --git a/include/ui/console.h b/include/ui/console.h
-index c249db4..5739bdd 100644
---- a/include/ui/console.h
-+++ b/include/ui/console.h
-@@ -433,7 +433,7 @@ static inline int vnc_display_pw_expire(const char *id, time_t expires)
- void curses_display_init(DisplayState *ds, int full_screen);
-
- /* input.c */
--int index_from_key(const char *key);
-+int index_from_key(const char *key, size_t key_length);
-
- /* gtk.c */
- void early_gtk_display_init(int opengl);
-diff --git a/ui/input-legacy.c b/ui/input-legacy.c
-index e0a39f0..3f28bbc 100644
---- a/ui/input-legacy.c
-+++ b/ui/input-legacy.c
-@@ -57,12 +57,13 @@ struct QEMUPutLEDEntry {
- static QTAILQ_HEAD(, QEMUPutLEDEntry) led_handlers =
- QTAILQ_HEAD_INITIALIZER(led_handlers);
-
--int index_from_key(const char *key)
-+int index_from_key(const char *key, size_t key_length)
- {
- int i;
-
- for (i = 0; QKeyCode_lookup[i] != NULL; i++) {
-- if (!strcmp(key, QKeyCode_lookup[i])) {
-+ if (!strncmp(key, QKeyCode_lookup[i], key_length) &&
-+ !QKeyCode_lookup[i][key_length]) {
- break;
- }
- }
diff --git a/0010-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch b/0010-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch
deleted file mode 100644
index 03e7b33..0000000
--- a/0010-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Tue, 19 Jan 2016 14:17:20 +0100
-Subject: [PATCH] e1000: eliminate infinite loops on out-of-bounds transfer
- start
-
-The start_xmit() and e1000_receive_iov() functions implement DMA transfers
-iterating over a set of descriptors that the guest's e1000 driver
-prepares:
-
-- the TDLEN and RDLEN registers store the total size of the descriptor
- area,
-
-- while the TDH and RDH registers store the offset (in whole tx / rx
- descriptors) into the area where the transfer is supposed to start.
-
-Each time a descriptor is processed, the TDH and RDH register is bumped
-(as appropriate for the transfer direction).
-
-QEMU already contains logic to deal with bogus transfers submitted by the
-guest:
-
-- Normally, the transmit case wants to increase TDH from its initial value
- to TDT. (TDT is allowed to be numerically smaller than the initial TDH
- value; wrapping at or above TDLEN bytes to zero is normal.) The failsafe
- that QEMU currently has here is a check against reaching the original
- TDH value again -- a complete wraparound, which should never happen.
-
-- In the receive case RDH is increased from its initial value until
- "total_size" bytes have been received; preferably in a single step, or
- in "s->rxbuf_size" byte steps, if the latter is smaller. However, null
- RX descriptors are skipped without receiving data, while RDH is
- incremented just the same. QEMU tries to prevent an infinite loop
- (processing only null RX descriptors) by detecting whether RDH assumes
- its original value during the loop. (Again, wrapping from RDLEN to 0 is
- normal.)
-
-What both directions miss is that the guest could program TDLEN and RDLEN
-so low, and the initial TDH and RDH so high, that these registers will
-immediately be truncated to zero, and then never reassume their initial
-values in the loop -- a full wraparound will never occur.
-
-The condition that expresses this is:
-
- xdh_start >= s->mac_reg[XDLEN] / sizeof(desc)
-
-i.e., TDH or RDH start out after the last whole rx or tx descriptor that
-fits into the TDLEN or RDLEN sized area.
-
-This condition could be checked before we enter the loops, but
-pci_dma_read() / pci_dma_write() knows how to fill in buffers safely for
-bogus DMA addresses, so we just extend the existing failsafes with the
-above condition.
-
-This is CVE-2016-1981.
-
-Cc: "Michael S. Tsirkin" <mst@redhat.com>
-Cc: Petr Matousek <pmatouse@redhat.com>
-Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
-Cc: Prasad Pandit <ppandit@redhat.com>
-Cc: Michael Roth <mdroth@linux.vnet.ibm.com>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: qemu-stable@nongnu.org
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1296044
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Reviewed-by: Jason Wang <jasowang@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit dd793a74882477ca38d49e191110c17dfee51dcc)
----
- hw/net/e1000.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index bec06e9..34d0823 100644
---- a/hw/net/e1000.c
-+++ b/hw/net/e1000.c
-@@ -908,7 +908,8 @@ start_xmit(E1000State *s)
- * bogus values to TDT/TDLEN.
- * there's nothing too intelligent we could do about this.
- */
-- if (s->mac_reg[TDH] == tdh_start) {
-+ if (s->mac_reg[TDH] == tdh_start ||
-+ tdh_start >= s->mac_reg[TDLEN] / sizeof(desc)) {
- DBGOUT(TXERR, "TDH wraparound @%x, TDT %x, TDLEN %x\n",
- tdh_start, s->mac_reg[TDT], s->mac_reg[TDLEN]);
- break;
-@@ -1165,7 +1166,8 @@ e1000_receive_iov(NetClientState *nc, const struct iovec *iov, int iovcnt)
- if (++s->mac_reg[RDH] * sizeof(desc) >= s->mac_reg[RDLEN])
- s->mac_reg[RDH] = 0;
- /* see comment in start_xmit; same here */
-- if (s->mac_reg[RDH] == rdh_start) {
-+ if (s->mac_reg[RDH] == rdh_start ||
-+ rdh_start >= s->mac_reg[RDLEN] / sizeof(desc)) {
- DBGOUT(RXERR, "RDH wraparound @%x, RDT %x, RDLEN %x\n",
- rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]);
- set_ics(s, 0, E1000_ICS_RXO);
diff --git a/0011-usb-check-page-select-value-while-processing-iTD.patch b/0011-usb-check-page-select-value-while-processing-iTD.patch
deleted file mode 100644
index d63c083..0000000
--- a/0011-usb-check-page-select-value-while-processing-iTD.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 20 Jan 2016 01:26:46 +0530
-Subject: [PATCH] usb: check page select value while processing iTD
-
-While processing isochronous transfer descriptors(iTD), the page
-select(PG) field value could lead to an OOB read access. Add
-check to avoid it.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1453233406-12165-1-git-send-email-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 49d925ce50383a286278143c05511d30ec41a36e)
----
- hw/usb/hcd-ehci.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
-index d07f228..c40013e 100644
---- a/hw/usb/hcd-ehci.c
-+++ b/hw/usb/hcd-ehci.c
-@@ -1404,21 +1404,23 @@ static int ehci_process_itd(EHCIState *ehci,
- if (itd->transact[i] & ITD_XACT_ACTIVE) {
- pg = get_field(itd->transact[i], ITD_XACT_PGSEL);
- off = itd->transact[i] & ITD_XACT_OFFSET_MASK;
-- ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
-- ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK);
- len = get_field(itd->transact[i], ITD_XACT_LENGTH);
-
- if (len > max * mult) {
- len = max * mult;
- }
--
-- if (len > BUFF_SIZE) {
-+ if (len > BUFF_SIZE || pg > 6) {
- return -1;
- }
-
-+ ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK);
- qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as);
- if (off + len > 4096) {
- /* transfer crosses page border */
-+ if (pg == 6) {
-+ return -1; /* avoid page pg + 1 */
-+ }
-+ ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK);
- uint32_t len2 = off + len - 4096;
- uint32_t len1 = len - len2;
- qemu_sglist_add(&ehci->isgl, ptr1 + off, len1);
diff --git a/0012-ahci-Do-not-unmap-NULL-addresses.patch b/0012-ahci-Do-not-unmap-NULL-addresses.patch
deleted file mode 100644
index d851e1e..0000000
--- a/0012-ahci-Do-not-unmap-NULL-addresses.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From: John Snow <jsnow@redhat.com>
-Date: Wed, 10 Feb 2016 13:29:40 -0500
-Subject: [PATCH] ahci: Do not unmap NULL addresses
-
-Definitely don't try to unmap a garbage address.
-
-Reported-by: Zuozhi fzz <zuozhi.fzz@alibaba-inc.com>
-Signed-off-by: John Snow <jsnow@redhat.com>
-Message-id: 1454103689-13042-2-git-send-email-jsnow@redhat.com
-(cherry picked from commit 99b4cb71069f109b79b27bc629fc0cf0886dbc4b)
----
- hw/ide/ahci.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
-index 17f1cbd..cdc9299 100644
---- a/hw/ide/ahci.c
-+++ b/hw/ide/ahci.c
-@@ -661,6 +661,10 @@ static bool ahci_map_fis_address(AHCIDevice *ad)
-
- static void ahci_unmap_fis_address(AHCIDevice *ad)
- {
-+ if (ad->res_fis == NULL) {
-+ DPRINTF(ad->port_no, "Attempt to unmap NULL FIS address\n");
-+ return;
-+ }
- dma_memory_unmap(ad->hba->as, ad->res_fis, 256,
- DMA_DIRECTION_FROM_DEVICE, 256);
- ad->res_fis = NULL;
-@@ -677,6 +681,10 @@ static bool ahci_map_clb_address(AHCIDevice *ad)
-
- static void ahci_unmap_clb_address(AHCIDevice *ad)
- {
-+ if (ad->lst == NULL) {
-+ DPRINTF(ad->port_no, "Attempt to unmap NULL CLB address\n");
-+ return;
-+ }
- dma_memory_unmap(ad->hba->as, ad->lst, 1024,
- DMA_DIRECTION_FROM_DEVICE, 1024);
- ad->lst = NULL;
diff --git a/0013-target-ppc-rename-and-export-maybe_bswap_register.patch b/0013-target-ppc-rename-and-export-maybe_bswap_register.patch
deleted file mode 100644
index caf6386..0000000
--- a/0013-target-ppc-rename-and-export-maybe_bswap_register.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:18 +0100
-Subject: [PATCH] target-ppc: rename and export maybe_bswap_register()
-
-This helper will be used to support FP, Altivec and VSX registers when
-the guest is little-endian.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 376dbce0e3abe456fb8c7a3cd40dc369f8b33d30)
----
- target-ppc/cpu.h | 1 +
- target-ppc/gdbstub.c | 10 +++++-----
- 2 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/target-ppc/cpu.h b/target-ppc/cpu.h
-index 9706000..1e2516e 100644
---- a/target-ppc/cpu.h
-+++ b/target-ppc/cpu.h
-@@ -2355,4 +2355,5 @@ int ppc_get_vcpu_dt_id(PowerPCCPU *cpu);
- */
- PowerPCCPU *ppc_get_vcpu_by_dt_id(int cpu_dt_id);
-
-+void ppc_maybe_bswap_register(CPUPPCState *env, uint8_t *mem_buf, int len);
- #endif /* !defined (__CPU_PPC_H__) */
-diff --git a/target-ppc/gdbstub.c b/target-ppc/gdbstub.c
-index 14675f4..b20bb0c 100644
---- a/target-ppc/gdbstub.c
-+++ b/target-ppc/gdbstub.c
-@@ -88,7 +88,7 @@ static int ppc_gdb_register_len(int n)
- the proper ordering for the binary, and cannot be changed.
- For system mode, TARGET_WORDS_BIGENDIAN is always set, and we must check
- the current mode of the chip to see if we're running in little-endian. */
--static void maybe_bswap_register(CPUPPCState *env, uint8_t *mem_buf, int len)
-+void ppc_maybe_bswap_register(CPUPPCState *env, uint8_t *mem_buf, int len)
- {
- #ifndef CONFIG_USER_ONLY
- if (!msr_le) {
-@@ -158,7 +158,7 @@ int ppc_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
- break;
- }
- }
-- maybe_bswap_register(env, mem_buf, r);
-+ ppc_maybe_bswap_register(env, mem_buf, r);
- return r;
- }
-
-@@ -214,7 +214,7 @@ int ppc_cpu_gdb_read_register_apple(CPUState *cs, uint8_t *mem_buf, int n)
- break;
- }
- }
-- maybe_bswap_register(env, mem_buf, r);
-+ ppc_maybe_bswap_register(env, mem_buf, r);
- return r;
- }
-
-@@ -227,7 +227,7 @@ int ppc_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
- if (!r) {
- return r;
- }
-- maybe_bswap_register(env, mem_buf, r);
-+ ppc_maybe_bswap_register(env, mem_buf, r);
- if (n < 32) {
- /* gprs */
- env->gpr[n] = ldtul_p(mem_buf);
-@@ -277,7 +277,7 @@ int ppc_cpu_gdb_write_register_apple(CPUState *cs, uint8_t *mem_buf, int n)
- if (!r) {
- return r;
- }
-- maybe_bswap_register(env, mem_buf, r);
-+ ppc_maybe_bswap_register(env, mem_buf, r);
- if (n < 32) {
- /* gprs */
- env->gpr[n] = ldq_p(mem_buf);
diff --git a/0014-target-ppc-gdbstub-fix-float-registers-for-little-en.patch b/0014-target-ppc-gdbstub-fix-float-registers-for-little-en.patch
deleted file mode 100644
index dc71eda..0000000
--- a/0014-target-ppc-gdbstub-fix-float-registers-for-little-en.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:25 +0100
-Subject: [PATCH] target-ppc: gdbstub: fix float registers for little-endian
- guests
-
-Let's reuse the ppc_maybe_bswap_register() helper, like we already do
-with the general registers.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 385abeb3e356452eace44f3fe15e18c2532dcaa7)
----
- target-ppc/translate_init.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
-index e88dc7f..d31d7f6 100644
---- a/target-ppc/translate_init.c
-+++ b/target-ppc/translate_init.c
-@@ -8755,10 +8755,12 @@ static int gdb_get_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
- stfq_p(mem_buf, env->fpr[n]);
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
- return 8;
- }
- if (n == 32) {
- stl_p(mem_buf, env->fpscr);
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- return 4;
- }
- return 0;
-@@ -8767,10 +8769,12 @@ static int gdb_get_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- static int gdb_set_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
- env->fpr[n] = ldfq_p(mem_buf);
- return 8;
- }
- if (n == 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- helper_store_fpscr(env, ldl_p(mem_buf), 0xffffffff);
- return 4;
- }
diff --git a/0015-target-ppc-gdbstub-introduce-avr_need_swap.patch b/0015-target-ppc-gdbstub-introduce-avr_need_swap.patch
deleted file mode 100644
index 67de0b1..0000000
--- a/0015-target-ppc-gdbstub-introduce-avr_need_swap.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:31 +0100
-Subject: [PATCH] target-ppc: gdbstub: introduce avr_need_swap()
-
-This helper will be used to support Altivec registers in little-endian guests.
-This patch does not change functionnality.
-
-Note: I had to put the helper some lines away from the gdb_*_avr_reg()
-routines to get a more readable patch.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 87601e2d5c22d9c1fef0e09978d377f46336c1db)
----
- target-ppc/translate_init.c | 37 +++++++++++++++++++++++--------------
- 1 file changed, 23 insertions(+), 14 deletions(-)
-
-diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
-index d31d7f6..18e9e56 100644
---- a/target-ppc/translate_init.c
-+++ b/target-ppc/translate_init.c
-@@ -8751,6 +8751,15 @@ static void dump_ppc_insns (CPUPPCState *env)
- }
- #endif
-
-+static bool avr_need_swap(CPUPPCState *env)
-+{
-+#ifdef HOST_WORDS_BIGENDIAN
-+ return false;
-+#else
-+ return true;
-+#endif
-+}
-+
- static int gdb_get_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
-@@ -8784,13 +8793,13 @@ static int gdb_set_float_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- static int gdb_get_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
--#ifdef HOST_WORDS_BIGENDIAN
-- stq_p(mem_buf, env->avr[n].u64[0]);
-- stq_p(mem_buf+8, env->avr[n].u64[1]);
--#else
-- stq_p(mem_buf, env->avr[n].u64[1]);
-- stq_p(mem_buf+8, env->avr[n].u64[0]);
--#endif
-+ if (!avr_need_swap(env)) {
-+ stq_p(mem_buf, env->avr[n].u64[0]);
-+ stq_p(mem_buf+8, env->avr[n].u64[1]);
-+ } else {
-+ stq_p(mem_buf, env->avr[n].u64[1]);
-+ stq_p(mem_buf+8, env->avr[n].u64[0]);
-+ }
- return 16;
- }
- if (n == 32) {
-@@ -8807,13 +8816,13 @@ static int gdb_get_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- static int gdb_set_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
--#ifdef HOST_WORDS_BIGENDIAN
-- env->avr[n].u64[0] = ldq_p(mem_buf);
-- env->avr[n].u64[1] = ldq_p(mem_buf+8);
--#else
-- env->avr[n].u64[1] = ldq_p(mem_buf);
-- env->avr[n].u64[0] = ldq_p(mem_buf+8);
--#endif
-+ if (!avr_need_swap(env)) {
-+ env->avr[n].u64[0] = ldq_p(mem_buf);
-+ env->avr[n].u64[1] = ldq_p(mem_buf+8);
-+ } else {
-+ env->avr[n].u64[1] = ldq_p(mem_buf);
-+ env->avr[n].u64[0] = ldq_p(mem_buf+8);
-+ }
- return 16;
- }
- if (n == 32) {
diff --git a/0016-target-ppc-gdbstub-fix-altivec-registers-for-little-.patch b/0016-target-ppc-gdbstub-fix-altivec-registers-for-little-.patch
deleted file mode 100644
index 8eb5309..0000000
--- a/0016-target-ppc-gdbstub-fix-altivec-registers-for-little-.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:38 +0100
-Subject: [PATCH] target-ppc: gdbstub: fix altivec registers for little-endian
- guests
-
-Altivec registers are 128-bit wide. They are stored in memory as two
-64-bit values that must be byteswapped when the guest is little-endian.
-Let's reuse the ppc_maybe_bswap_register() helper for this.
-
-We also need to fix the ordering of the 64-bit elements according to
-the target endianness, for both system and user mode.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit ea499e71506c91aa259a7fdccf1d6b2022f5b530)
----
- target-ppc/translate_init.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
-index 18e9e56..80d53e4 100644
---- a/target-ppc/translate_init.c
-+++ b/target-ppc/translate_init.c
-@@ -8754,9 +8754,9 @@ static void dump_ppc_insns (CPUPPCState *env)
- static bool avr_need_swap(CPUPPCState *env)
- {
- #ifdef HOST_WORDS_BIGENDIAN
-- return false;
-+ return msr_le;
- #else
-- return true;
-+ return !msr_le;
- #endif
- }
-
-@@ -8800,14 +8800,18 @@ static int gdb_get_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- stq_p(mem_buf, env->avr[n].u64[1]);
- stq_p(mem_buf+8, env->avr[n].u64[0]);
- }
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
-+ ppc_maybe_bswap_register(env, mem_buf + 8, 8);
- return 16;
- }
- if (n == 32) {
- stl_p(mem_buf, env->vscr);
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- return 4;
- }
- if (n == 33) {
- stl_p(mem_buf, (uint32_t)env->spr[SPR_VRSAVE]);
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- return 4;
- }
- return 0;
-@@ -8816,6 +8820,8 @@ static int gdb_get_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- static int gdb_set_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- {
- if (n < 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
-+ ppc_maybe_bswap_register(env, mem_buf + 8, 8);
- if (!avr_need_swap(env)) {
- env->avr[n].u64[0] = ldq_p(mem_buf);
- env->avr[n].u64[1] = ldq_p(mem_buf+8);
-@@ -8826,10 +8832,12 @@ static int gdb_set_avr_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- return 16;
- }
- if (n == 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- env->vscr = ldl_p(mem_buf);
- return 4;
- }
- if (n == 33) {
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- env->spr[SPR_VRSAVE] = (target_ulong)ldl_p(mem_buf);
- return 4;
- }
diff --git a/0017-target-ppc-gdbstub-fix-spe-registers-for-little-endi.patch b/0017-target-ppc-gdbstub-fix-spe-registers-for-little-endi.patch
deleted file mode 100644
index 80b858e..0000000
--- a/0017-target-ppc-gdbstub-fix-spe-registers-for-little-endi.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:44 +0100
-Subject: [PATCH] target-ppc: gdbstub: fix spe registers for little-endian
- guests
-
-Let's reuse the ppc_maybe_bswap_register() helper, like we already do
-with the general registers.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 95f5b540abd964ac3bc9c63434d07681a5a175eb)
----
- target-ppc/translate_init.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
-index 80d53e4..5ea168c 100644
---- a/target-ppc/translate_init.c
-+++ b/target-ppc/translate_init.c
-@@ -8849,6 +8849,7 @@ static int gdb_get_spe_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- if (n < 32) {
- #if defined(TARGET_PPC64)
- stl_p(mem_buf, env->gpr[n] >> 32);
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- #else
- stl_p(mem_buf, env->gprh[n]);
- #endif
-@@ -8856,10 +8857,12 @@ static int gdb_get_spe_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- }
- if (n == 32) {
- stq_p(mem_buf, env->spe_acc);
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
- return 8;
- }
- if (n == 33) {
- stl_p(mem_buf, env->spe_fscr);
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- return 4;
- }
- return 0;
-@@ -8870,7 +8873,11 @@ static int gdb_set_spe_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- if (n < 32) {
- #if defined(TARGET_PPC64)
- target_ulong lo = (uint32_t)env->gpr[n];
-- target_ulong hi = (target_ulong)ldl_p(mem_buf) << 32;
-+ target_ulong hi;
-+
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
-+
-+ hi = (target_ulong)ldl_p(mem_buf) << 32;
- env->gpr[n] = lo | hi;
- #else
- env->gprh[n] = ldl_p(mem_buf);
-@@ -8878,10 +8885,12 @@ static int gdb_set_spe_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- return 4;
- }
- if (n == 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
- env->spe_acc = ldq_p(mem_buf);
- return 8;
- }
- if (n == 33) {
-+ ppc_maybe_bswap_register(env, mem_buf, 4);
- env->spe_fscr = ldl_p(mem_buf);
- return 4;
- }
diff --git a/0018-target-ppc-gdbstub-Add-VSX-support.patch b/0018-target-ppc-gdbstub-Add-VSX-support.patch
deleted file mode 100644
index 1d4219f..0000000
--- a/0018-target-ppc-gdbstub-Add-VSX-support.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From: Anton Blanchard <anton@samba.org>
-Date: Fri, 15 Jan 2016 16:00:51 +0100
-Subject: [PATCH] target-ppc: gdbstub: Add VSX support
-
-Add the XML and functions to get and set VSX registers.
-
-Signed-off-by: Anton Blanchard <anton@samba.org>
-(fixed little-endian guests)
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-
-(cherry picked from commit 1438eff302cbc6c85d477fd7181b8a9aeea2efd7)
----
- configure | 6 +++---
- gdb-xml/power-vsx.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
- target-ppc/translate_init.c | 24 ++++++++++++++++++++++++
- 3 files changed, 71 insertions(+), 3 deletions(-)
- create mode 100644 gdb-xml/power-vsx.xml
-
-diff --git a/configure b/configure
-index b9552fd..7811180 100755
---- a/configure
-+++ b/configure
-@@ -5617,20 +5617,20 @@ case "$target_name" in
- ppc64)
- TARGET_BASE_ARCH=ppc
- TARGET_ABI_DIR=ppc
-- gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-+ gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml power-vsx.xml"
- ;;
- ppc64le)
- TARGET_ARCH=ppc64
- TARGET_BASE_ARCH=ppc
- TARGET_ABI_DIR=ppc
-- gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-+ gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml power-vsx.xml"
- ;;
- ppc64abi32)
- TARGET_ARCH=ppc64
- TARGET_BASE_ARCH=ppc
- TARGET_ABI_DIR=ppc
- echo "TARGET_ABI32=y" >> $config_target_mak
-- gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-+ gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml power-vsx.xml"
- ;;
- sh4|sh4eb)
- TARGET_ARCH=sh4
-diff --git a/gdb-xml/power-vsx.xml b/gdb-xml/power-vsx.xml
-new file mode 100644
-index 0000000..fd290e9
---- /dev/null
-+++ b/gdb-xml/power-vsx.xml
-@@ -0,0 +1,44 @@
-+<?xml version="1.0"?>
-+<!-- Copyright (C) 2008-2015 Free Software Foundation, Inc.
-+
-+ Copying and distribution of this file, with or without modification,
-+ are permitted in any medium without royalty provided the copyright
-+ notice and this notice are preserved. -->
-+
-+<!-- POWER7 VSX registers that do not overlap existing FP and VMX
-+ registers. -->
-+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-+<feature name="org.gnu.gdb.power.vsx">
-+ <reg name="vs0h" bitsize="64" type="uint64"/>
-+ <reg name="vs1h" bitsize="64" type="uint64"/>
-+ <reg name="vs2h" bitsize="64" type="uint64"/>
-+ <reg name="vs3h" bitsize="64" type="uint64"/>
-+ <reg name="vs4h" bitsize="64" type="uint64"/>
-+ <reg name="vs5h" bitsize="64" type="uint64"/>
-+ <reg name="vs6h" bitsize="64" type="uint64"/>
-+ <reg name="vs7h" bitsize="64" type="uint64"/>
-+ <reg name="vs8h" bitsize="64" type="uint64"/>
-+ <reg name="vs9h" bitsize="64" type="uint64"/>
-+ <reg name="vs10h" bitsize="64" type="uint64"/>
-+ <reg name="vs11h" bitsize="64" type="uint64"/>
-+ <reg name="vs12h" bitsize="64" type="uint64"/>
-+ <reg name="vs13h" bitsize="64" type="uint64"/>
-+ <reg name="vs14h" bitsize="64" type="uint64"/>
-+ <reg name="vs15h" bitsize="64" type="uint64"/>
-+ <reg name="vs16h" bitsize="64" type="uint64"/>
-+ <reg name="vs17h" bitsize="64" type="uint64"/>
-+ <reg name="vs18h" bitsize="64" type="uint64"/>
-+ <reg name="vs19h" bitsize="64" type="uint64"/>
-+ <reg name="vs20h" bitsize="64" type="uint64"/>
-+ <reg name="vs21h" bitsize="64" type="uint64"/>
-+ <reg name="vs22h" bitsize="64" type="uint64"/>
-+ <reg name="vs23h" bitsize="64" type="uint64"/>
-+ <reg name="vs24h" bitsize="64" type="uint64"/>
-+ <reg name="vs25h" bitsize="64" type="uint64"/>
-+ <reg name="vs26h" bitsize="64" type="uint64"/>
-+ <reg name="vs27h" bitsize="64" type="uint64"/>
-+ <reg name="vs28h" bitsize="64" type="uint64"/>
-+ <reg name="vs29h" bitsize="64" type="uint64"/>
-+ <reg name="vs30h" bitsize="64" type="uint64"/>
-+ <reg name="vs31h" bitsize="64" type="uint64"/>
-+</feature>
-diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
-index 5ea168c..8069f3c 100644
---- a/target-ppc/translate_init.c
-+++ b/target-ppc/translate_init.c
-@@ -8897,6 +8897,26 @@ static int gdb_set_spe_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
- return 0;
- }
-
-+static int gdb_get_vsx_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
-+{
-+ if (n < 32) {
-+ stq_p(mem_buf, env->vsr[n]);
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
-+ return 8;
-+ }
-+ return 0;
-+}
-+
-+static int gdb_set_vsx_reg(CPUPPCState *env, uint8_t *mem_buf, int n)
-+{
-+ if (n < 32) {
-+ ppc_maybe_bswap_register(env, mem_buf, 8);
-+ env->vsr[n] = ldq_p(mem_buf);
-+ return 8;
-+ }
-+ return 0;
-+}
-+
- static int ppc_fixup_cpu(PowerPCCPU *cpu)
- {
- CPUPPCState *env = &cpu->env;
-@@ -9002,6 +9022,10 @@ static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
- gdb_register_coprocessor(cs, gdb_get_spe_reg, gdb_set_spe_reg,
- 34, "power-spe.xml", 0);
- }
-+ if (pcc->insns_flags2 & PPC2_VSX) {
-+ gdb_register_coprocessor(cs, gdb_get_vsx_reg, gdb_set_vsx_reg,
-+ 32, "power-vsx.xml", 0);
-+ }
-
- qemu_init_vcpu(cs);
-
diff --git a/0019-target-ppc-kvm-fix-floating-point-registers-sync-on-.patch b/0019-target-ppc-kvm-fix-floating-point-registers-sync-on-.patch
deleted file mode 100644
index 4e3b651..0000000
--- a/0019-target-ppc-kvm-fix-floating-point-registers-sync-on-.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Date: Fri, 15 Jan 2016 16:00:12 +0100
-Subject: [PATCH] target-ppc: kvm: fix floating point registers sync on
- little-endian hosts
-
-On VSX capable CPUs, the 32 FP registers are mapped to the high-bits
-of the 32 first VSX registers. So if you have:
-
-VSR31 = (uint128) 0x0102030405060708090a0b0c0d0e0f00
-
-then
-
-FPR31 = (uint64) 0x0102030405060708
-
-The kernel stores the VSX registers in the fp_state struct following the
-host endian element ordering.
-
-On big-endian:
-
-fp_state.fpr[31][0] = 0x0102030405060708
-fp_state.fpr[31][1] = 0x090a0b0c0d0e0f00
-
-On little-endian:
-
-fp_state.fpr[31][0] = 0x090a0b0c0d0e0f00
-fp_state.fpr[31][1] = 0x0102030405060708
-
-The KVM_GET_ONE_REG and KVM_SET_ONE_REG ioctls preserve this ordering, but
-QEMU considers it as big-endian and always copies element [0] to the
-fpr[] array and element [1] to the vsr[] array. This does not work with
-little-endian hosts, and you will get:
-
-(qemu) p $f31
-0x90a0b0c0d0e0f00
-
-instead of:
-
-(qemu) p $f31
-0x102030405060708
-
-This patch fixes the element ordering for little-endian hosts.
-
-Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
-Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 3a4b791b4c13e02537a5cc572fa3de70bc5f68da)
----
- target-ppc/kvm.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
-index ac70f08..acd3275 100644
---- a/target-ppc/kvm.c
-+++ b/target-ppc/kvm.c
-@@ -650,8 +650,13 @@ static int kvm_put_fp(CPUState *cs)
- for (i = 0; i < 32; i++) {
- uint64_t vsr[2];
-
-+#ifdef HOST_WORDS_BIGENDIAN
- vsr[0] = float64_val(env->fpr[i]);
- vsr[1] = env->vsr[i];
-+#else
-+ vsr[0] = env->vsr[i];
-+ vsr[1] = float64_val(env->fpr[i]);
-+#endif
- reg.addr = (uintptr_t) &vsr;
- reg.id = vsx ? KVM_REG_PPC_VSR(i) : KVM_REG_PPC_FPR(i);
-
-@@ -721,10 +726,17 @@ static int kvm_get_fp(CPUState *cs)
- vsx ? "VSR" : "FPR", i, strerror(errno));
- return ret;
- } else {
-+#ifdef HOST_WORDS_BIGENDIAN
- env->fpr[i] = vsr[0];
- if (vsx) {
- env->vsr[i] = vsr[1];
- }
-+#else
-+ env->fpr[i] = vsr[1];
-+ if (vsx) {
-+ env->vsr[i] = vsr[0];
-+ }
-+#endif
- }
- }
- }
diff --git a/0101-vmdk-Create-streamOptimized-as-version-3.patch b/0101-vmdk-Create-streamOptimized-as-version-3.patch
deleted file mode 100644
index 44c84fa..0000000
--- a/0101-vmdk-Create-streamOptimized-as-version-3.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Fam Zheng <famz@redhat.com>
-Date: Thu, 17 Sep 2015 13:04:10 +0800
-Subject: [PATCH] vmdk: Create streamOptimized as version 3
-
-VMware products accept only version 3 for streamOptimized, let's bump
-the version.
-
-Reported-by: Radoslav Gerganov <rgerganov@vmware.com>
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit d62d9dc4b814950dcc8bd261a3e2e9300d9065e6)
----
- block/vmdk.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/block/vmdk.c b/block/vmdk.c
-index 6f819e4..26b76d9 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -1654,7 +1654,13 @@ static int vmdk_create_extent(const char *filename, int64_t filesize,
- }
- magic = cpu_to_be32(VMDK4_MAGIC);
- memset(&header, 0, sizeof(header));
-- header.version = zeroed_grain ? 2 : 1;
-+ if (compress) {
-+ header.version = 3;
-+ } else if (zeroed_grain) {
-+ header.version = 2;
-+ } else {
-+ header.version = 1;
-+ }
- header.flags = VMDK4_FLAG_RGD | VMDK4_FLAG_NL_DETECT
- | (compress ? VMDK4_FLAG_COMPRESS | VMDK4_FLAG_MARKER : 0)
- | (zeroed_grain ? VMDK4_FLAG_ZERO_GRAIN : 0);
diff --git a/0102-vmdk-Fix-converting-to-streamOptimized.patch b/0102-vmdk-Fix-converting-to-streamOptimized.patch
deleted file mode 100644
index aeb724e..0000000
--- a/0102-vmdk-Fix-converting-to-streamOptimized.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From: Fam Zheng <famz@redhat.com>
-Date: Mon, 25 Jan 2016 10:26:23 +0800
-Subject: [PATCH] vmdk: Fix converting to streamOptimized
-
-Commit d62d9dc4b8 lifted streamOptimized images's version to 3, but we
-now refuse to open version 3 images read-write. We need to make
-streamOptimized an exception to allow converting to it. This fixes the
-accidentally broken iotests case 059 for the same reason.
-
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-(cherry picked from commit 3db1d98a20262228373bb973ca62b1ab64b29af4)
----
- block/vmdk.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/block/vmdk.c b/block/vmdk.c
-index 26b76d9..e46271a 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -570,6 +570,7 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
- VmdkExtent *extent;
- BDRVVmdkState *s = bs->opaque;
- int64_t l1_backup_offset = 0;
-+ bool compressed;
-
- ret = bdrv_pread(file->bs, sizeof(magic), &header, sizeof(header));
- if (ret < 0) {
-@@ -644,6 +645,8 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
- header = footer.header;
- }
-
-+ compressed =
-+ le16_to_cpu(header.compressAlgorithm) == VMDK4_COMPRESSION_DEFLATE;
- if (le32_to_cpu(header.version) > 3) {
- char buf[64];
- snprintf(buf, sizeof(buf), "VMDK version %" PRId32,
-@@ -651,7 +654,8 @@ static int vmdk_open_vmdk4(BlockDriverState *bs,
- error_setg(errp, QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
- bdrv_get_device_or_node_name(bs), "vmdk", buf);
- return -ENOTSUP;
-- } else if (le32_to_cpu(header.version) == 3 && (flags & BDRV_O_RDWR)) {
-+ } else if (le32_to_cpu(header.version) == 3 && (flags & BDRV_O_RDWR) &&
-+ !compressed) {
- /* VMware KB 2064959 explains that version 3 added support for
- * persistent changed block tracking (CBT), and backup software can
- * read it as version=1 if it doesn't care about the changed area
diff --git a/0103-usb-check-RNDIS-message-length.patch b/0103-usb-check-RNDIS-message-length.patch
deleted file mode 100644
index 3cc986a..0000000
--- a/0103-usb-check-RNDIS-message-length.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 17 Feb 2016 00:23:40 +0530
-Subject: [PATCH] usb: check RNDIS message length
-
-When processing remote NDIS control message packets, the USB Net
-device emulator uses a fixed length(4096) data buffer. The incoming
-packet length could exceed this limit. Add a check to avoid it.
-
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1455648821-17340-2-git-send-email-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 64c9bc181fc78275596649f591302d72df2d3071)
----
- hw/usb/core.c | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/hw/usb/core.c b/hw/usb/core.c
-index d0025db..7f46370 100644
---- a/hw/usb/core.c
-+++ b/hw/usb/core.c
-@@ -128,9 +128,16 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
- }
-
- usb_packet_copy(p, s->setup_buf, p->iov.size);
-+ s->setup_index = 0;
- p->actual_length = 0;
- s->setup_len = (s->setup_buf[7] << 8) | s->setup_buf[6];
-- s->setup_index = 0;
-+ if (s->setup_len > sizeof(s->data_buf)) {
-+ fprintf(stderr,
-+ "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
-+ s->setup_len, sizeof(s->data_buf));
-+ p->status = USB_RET_STALL;
-+ return;
-+ }
-
- request = (s->setup_buf[0] << 8) | s->setup_buf[1];
- value = (s->setup_buf[3] << 8) | s->setup_buf[2];
-@@ -151,13 +158,6 @@ static void do_token_setup(USBDevice *s, USBPacket *p)
- }
- s->setup_state = SETUP_STATE_DATA;
- } else {
-- if (s->setup_len > sizeof(s->data_buf)) {
-- fprintf(stderr,
-- "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
-- s->setup_len, sizeof(s->data_buf));
-- p->status = USB_RET_STALL;
-- return;
-- }
- if (s->setup_len == 0)
- s->setup_state = SETUP_STATE_ACK;
- else
-@@ -176,7 +176,7 @@ static void do_token_in(USBDevice *s, USBPacket *p)
- request = (s->setup_buf[0] << 8) | s->setup_buf[1];
- value = (s->setup_buf[3] << 8) | s->setup_buf[2];
- index = (s->setup_buf[5] << 8) | s->setup_buf[4];
--
-+
- switch(s->setup_state) {
- case SETUP_STATE_ACK:
- if (!(s->setup_buf[0] & USB_DIR_IN)) {
diff --git a/0104-usb-check-RNDIS-buffer-offsets-length.patch b/0104-usb-check-RNDIS-buffer-offsets-length.patch
deleted file mode 100644
index e989fec..0000000
--- a/0104-usb-check-RNDIS-buffer-offsets-length.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 17 Feb 2016 00:23:41 +0530
-Subject: [PATCH] usb: check RNDIS buffer offsets & length
-
-When processing remote NDIS control message packets,
-the USB Net device emulator uses a fixed length(4096) data buffer.
-The incoming informationBufferOffset & Length combination could
-overflow and cross that range. Check control message buffer
-offsets and length to avoid it.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1455648821-17340-3-git-send-email-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit fe3c546c5ff2a6210f9a4d8561cc64051ca8603e)
----
- hw/usb/dev-network.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
-index 7800cee..ba3c7a7 100644
---- a/hw/usb/dev-network.c
-+++ b/hw/usb/dev-network.c
-@@ -914,8 +914,9 @@ static int rndis_query_response(USBNetState *s,
-
- bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
- buflen = le32_to_cpu(buf->InformationBufferLength);
-- if (bufoffs + buflen > length)
-+ if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
- return USB_RET_STALL;
-+ }
-
- infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
- bufoffs + (uint8_t *) buf, buflen, infobuf,
-@@ -960,8 +961,9 @@ static int rndis_set_response(USBNetState *s,
-
- bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
- buflen = le32_to_cpu(buf->InformationBufferLength);
-- if (bufoffs + buflen > length)
-+ if (buflen > length || bufoffs >= length || bufoffs + buflen > length) {
- return USB_RET_STALL;
-+ }
-
- ret = ndis_set(s, le32_to_cpu(buf->OID),
- bufoffs + (uint8_t *) buf, buflen);
-@@ -1211,8 +1213,9 @@ static void usb_net_handle_dataout(USBNetState *s, USBPacket *p)
- if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) {
- uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
- uint32_t size = le32_to_cpu(msg->DataLength);
-- if (offs + size <= len)
-+ if (offs < len && size < len && offs + size <= len) {
- qemu_send_packet(qemu_get_queue(s->nic), s->out_buf + offs, size);
-+ }
- }
- s->out_ptr -= len;
- memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
diff --git a/0105-net-ne2000-check-ring-buffer-control-registers.patch b/0105-net-ne2000-check-ring-buffer-control-registers.patch
deleted file mode 100644
index 4e2c64a..0000000
--- a/0105-net-ne2000-check-ring-buffer-control-registers.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 24 Feb 2016 11:41:33 +0530
-Subject: [PATCH] net: ne2000: check ring buffer control registers
-
-Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
-bytes to process network packets. Registers PSTART & PSTOP
-define ring buffer size & location. Setting these registers
-to invalid values could lead to infinite loop or OOB r/w
-access issues. Add check to avoid it.
-
-Reported-by: Yang Hongke <yanghongke@huawei.com>
-Tested-by: Yang Hongke <yanghongke@huawei.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit 415ab35a441eca767d033a2702223e785b9d5190)
----
- hw/net/ne2000.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/hw/net/ne2000.c b/hw/net/ne2000.c
-index a3dffff..995115e 100644
---- a/hw/net/ne2000.c
-+++ b/hw/net/ne2000.c
-@@ -154,6 +154,10 @@ static int ne2000_buffer_full(NE2000State *s)
- {
- int avail, index, boundary;
-
-+ if (s->stop <= s->start) {
-+ return 1;
-+ }
-+
- index = s->curpag << 8;
- boundary = s->boundary << 8;
- if (index < boundary)
diff --git a/0106-net-check-packet-payload-length.patch b/0106-net-check-packet-payload-length.patch
deleted file mode 100644
index a85831d..0000000
--- a/0106-net-check-packet-payload-length.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Wed, 2 Mar 2016 17:29:58 +0530
-Subject: [PATCH] net: check packet payload length
-
-While computing IP checksum, 'net_checksum_calculate' reads
-payload length from the packet. It could exceed the given 'data'
-buffer size. Add a check to avoid it.
-
-Reported-by: Liu Ling <liuling-it@360.cn>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
-(cherry picked from commit 362786f14a753d8a5256ef97d7c10ed576d6572b)
----
- net/checksum.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/net/checksum.c b/net/checksum.c
-index 14c0855..0942437 100644
---- a/net/checksum.c
-+++ b/net/checksum.c
-@@ -59,6 +59,11 @@ void net_checksum_calculate(uint8_t *data, int length)
- int hlen, plen, proto, csum_offset;
- uint16_t csum;
-
-+ /* Ensure data has complete L2 & L3 headers. */
-+ if (length < 14 + 20) {
-+ return;
-+ }
-+
- if ((data[14] & 0xf0) != 0x40)
- return; /* not IPv4 */
- hlen = (data[14] & 0x0f) * 4;
-@@ -76,8 +81,9 @@ void net_checksum_calculate(uint8_t *data, int length)
- return;
- }
-
-- if (plen < csum_offset+2)
-- return;
-+ if (plen < csum_offset + 2 || 14 + hlen + plen > length) {
-+ return;
-+ }
-
- data[14+hlen+csum_offset] = 0;
- data[14+hlen+csum_offset+1] = 0;
diff --git a/0107-usb-check-USB-configuration-descriptor-object.patch b/0107-usb-check-USB-configuration-descriptor-object.patch
deleted file mode 100644
index b5aeb24..0000000
--- a/0107-usb-check-USB-configuration-descriptor-object.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From: Prasad J Pandit <pjp@fedoraproject.org>
-Date: Thu, 11 Feb 2016 16:31:20 +0530
-Subject: [PATCH] usb: check USB configuration descriptor object
-
-When processing remote NDIS control message packets, the USB Net
-device emulator checks to see if the USB configuration descriptor
-object is of RNDIS type(2). But it does not check if it is null,
-which leads to a null dereference error. Add check to avoid it.
-
-Reported-by: Qinghao Tang <luodalongde@gmail.com>
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Message-id: 1455188480-14688-1-git-send-email-ppandit@redhat.com
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 80eecda8e5d09c442c24307f340840a5b70ea3b9)
----
- hw/usb/dev-network.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
-index ba3c7a7..180adce 100644
---- a/hw/usb/dev-network.c
-+++ b/hw/usb/dev-network.c
-@@ -653,7 +653,8 @@ typedef struct USBNetState {
-
- static int is_rndis(USBNetState *s)
- {
-- return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE;
-+ return s->dev.config ?
-+ s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE : 0;
- }
-
- static int ndis_query(USBNetState *s, uint32_t oid,
diff --git a/0108-block-set-device_list.tqe_prev-to-NULL-on-BDS-remova.patch b/0108-block-set-device_list.tqe_prev-to-NULL-on-BDS-remova.patch
deleted file mode 100644
index d675dc2..0000000
--- a/0108-block-set-device_list.tqe_prev-to-NULL-on-BDS-remova.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From: Jeff Cody <jcody@redhat.com>
-Date: Mon, 1 Feb 2016 20:33:10 -0500
-Subject: [PATCH] block: set device_list.tqe_prev to NULL on BDS removal
-
-This fixes a regression introduced with commit 3f09bfbc7. Multiple
-bugs arise in conjunction with live snapshots and mirroring operations
-(which include active layer commit).
-
-After a live snapshot occurs, the active layer and the base layer both
-have a non-NULL tqe_prev field in the device_list, although the base
-node's tqe_prev field points to a NULL entry. This non-NULL tqe_prev
-field occurs after the bdrv_append() in the external snapshot calls
-change_parent_backing_link().
-
-In change_parent_backing_link(), when the previous active layer is
-removed from device_list, the device_list.tqe_prev pointer is not
-set to NULL.
-
-The operating scheme in the block layer is to indicate that a BDS belongs
-in the bdrv_states device_list iff the device_list.tqe_prev pointer
-is non-NULL.
-
-This patch does two things:
-
-1.) Introduces a new block layer helper bdrv_device_remove() to remove a
- BDS from the device_list, and
-2.) uses that new API, which also fixes the regression once used in
- change_parent_backing_link().
-
-Signed-off-by: Jeff Cody <jcody@redhat.com>
-Message-id: 0cd51e11c0666c04ddb7c05293fe94afeb551e89.1454376655.git.jcody@redhat.com
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-(cherry picked from commit f8aa905a4fec89863c82de4186352447d851871e)
----
- block.c | 24 ++++++++++++++----------
- blockdev.c | 3 +--
- include/block/block.h | 1 +
- 3 files changed, 16 insertions(+), 12 deletions(-)
-
-diff --git a/block.c b/block.c
-index 3a7324b..3c172dd 100644
---- a/block.c
-+++ b/block.c
-@@ -1976,21 +1976,25 @@ void bdrv_close_all(void)
- }
- }
-
-+/* Note that bs->device_list.tqe_prev is initially null,
-+ * and gets set to non-null by QTAILQ_INSERT_TAIL(). Establish
-+ * the useful invariant "bs in bdrv_states iff bs->tqe_prev" by
-+ * resetting it to null on remove. */
-+void bdrv_device_remove(BlockDriverState *bs)
-+{
-+ QTAILQ_REMOVE(&bdrv_states, bs, device_list);
-+ bs->device_list.tqe_prev = NULL;
-+}
-+
- /* make a BlockDriverState anonymous by removing from bdrv_state and
- * graph_bdrv_state list.
- Also, NULL terminate the device_name to prevent double remove */
- void bdrv_make_anon(BlockDriverState *bs)
- {
-- /*
-- * Take care to remove bs from bdrv_states only when it's actually
-- * in it. Note that bs->device_list.tqe_prev is initially null,
-- * and gets set to non-null by QTAILQ_INSERT_TAIL(). Establish
-- * the useful invariant "bs in bdrv_states iff bs->tqe_prev" by
-- * resetting it to null on remove.
-- */
-+ /* Take care to remove bs from bdrv_states only when it's actually
-+ * in it. */
- if (bs->device_list.tqe_prev) {
-- QTAILQ_REMOVE(&bdrv_states, bs, device_list);
-- bs->device_list.tqe_prev = NULL;
-+ bdrv_device_remove(bs);
- }
- if (bs->node_name[0] != '\0') {
- QTAILQ_REMOVE(&graph_bdrv_states, bs, node_list);
-@@ -2031,7 +2035,7 @@ static void change_parent_backing_link(BlockDriverState *from,
- if (!to->device_list.tqe_prev) {
- QTAILQ_INSERT_BEFORE(from, to, device_list);
- }
-- QTAILQ_REMOVE(&bdrv_states, from, device_list);
-+ bdrv_device_remove(from);
- }
- }
-
-diff --git a/blockdev.c b/blockdev.c
-index 80932e8..c236126 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -2384,8 +2384,7 @@ void qmp_x_blockdev_remove_medium(const char *device, Error **errp)
-
- /* This follows the convention established by bdrv_make_anon() */
- if (bs->device_list.tqe_prev) {
-- QTAILQ_REMOVE(&bdrv_states, bs, device_list);
-- bs->device_list.tqe_prev = NULL;
-+ bdrv_device_remove(bs);
- }
-
- blk_remove_bs(blk);
-diff --git a/include/block/block.h b/include/block/block.h
-index 3477328..d83d420 100644
---- a/include/block/block.h
-+++ b/include/block/block.h
-@@ -196,6 +196,7 @@ int bdrv_create(BlockDriver *drv, const char* filename,
- int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp);
- BlockDriverState *bdrv_new_root(void);
- BlockDriverState *bdrv_new(void);
-+void bdrv_device_remove(BlockDriverState *bs);
- void bdrv_make_anon(BlockDriverState *bs);
- void bdrv_swap(BlockDriverState *bs_new, BlockDriverState *bs_old);
- void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top);
diff --git a/qemu.spec b/qemu.spec
index 37a6347..c32b5ec 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -38,17 +38,23 @@
%global have_xen 1
%endif
+# Release candidate version tracking
+%global rcver rc1
+%if 0%{?rcver:1}
+%global rcstr -%{rcver}
+%endif
+
Summary: QEMU is a FAST! processor emulator
Name: qemu
-Version: 2.5.0
-Release: 11%{?dist}
+Version: 2.6.0
+Release: 0.1.%{rcver}%{?dist}
Epoch: 2
License: GPLv2+ and LGPLv2+ and BSD
Group: Development/Tools
URL: http://www.qemu.org/
-Source0: http://wiki.qemu-project.org/download/%{name}-%{version}.tar.bz2
+Source0: http://wiki.qemu-project.org/download/%{name}-%{version}%{?rcstr}.tar.bz2
Source1: qemu.binfmt
@@ -73,55 +79,6 @@ Source13: qemu-kvm.sh
# For modprobe.d
Source20: kvm.conf
-# Fix virtio 9p thread pool usage
-Patch0001: 0001-virtio-9p-use-accessor-to-get-thread_pool.patch
-# CVE-2015-8558: DoS by infinite loop in ehci_advance_state (bz #1291309)
-Patch0002: 0002-ehci-make-idt-processing-more-robust.patch
-# CVE-2015-8567: net: vmxnet3: host memory leakage (bz #1289818)
-Patch0003: 0003-net-vmxnet3-avoid-memory-leakage-in-activate_device.patch
-# CVE-2016-1922: i386: avoid null pointer dereference (bz #1292766)
-Patch0004: 0004-i386-avoid-null-pointer-dereference.patch
-# CVE-2015-8613: buffer overflow in megasas_ctrl_get_info (bz #1284008)
-Patch0005: 0005-scsi-initialise-info-object-with-appropriate-size.patch
-# CVE-2015-8701: Buffer overflow in tx_consume in rocker.c (bz #1293720)
-Patch0006: 0006-net-rocker-fix-an-incorrect-array-bounds-check.patch
-# CVE-2015-8743: ne2000: OOB memory access in ioport r/w functions (bz
-# #1294787)
-Patch0007: 0007-net-ne2000-fix-bounds-check-in-ioport-operations.patch
-# CVE-2016-1568: Use-after-free vulnerability in ahci (bz #1297023)
-Patch0008: 0008-ide-ahci-reset-ncq-object-to-unused-on-error.patch
-# CVE-2015-8619: Fix sendkey out of bounds (bz #1292757)
-Patch0009: 0009-hmp-fix-sendkey-out-of-bounds-write-CVE-2015-8619.patch
-# CVE-2016-1981: infinite loop in e1000 (bz #1299995)
-Patch0010: 0010-e1000-eliminate-infinite-loops-on-out-of-bounds-tran.patch
-# Fix Out-of-bounds read in usb-ehci (bz #1300234, bz #1299455)
-Patch0011: 0011-usb-check-page-select-value-while-processing-iTD.patch
-# CVE-2016-2197: ahci: null pointer dereference (bz #1302952)
-Patch0012: 0012-ahci-Do-not-unmap-NULL-addresses.patch
-# Fix gdbstub for VSX registers for ppc64 (bz #1304377)
-Patch0013: 0013-target-ppc-rename-and-export-maybe_bswap_register.patch
-Patch0014: 0014-target-ppc-gdbstub-fix-float-registers-for-little-en.patch
-Patch0015: 0015-target-ppc-gdbstub-introduce-avr_need_swap.patch
-Patch0016: 0016-target-ppc-gdbstub-fix-altivec-registers-for-little-.patch
-Patch0017: 0017-target-ppc-gdbstub-fix-spe-registers-for-little-endi.patch
-Patch0018: 0018-target-ppc-gdbstub-Add-VSX-support.patch
-Patch0019: 0019-target-ppc-kvm-fix-floating-point-registers-sync-on-.patch
-
-# Fix qemu-img vmdk images to work with VMware (bz #1299185)
-Patch0101: 0101-vmdk-Create-streamOptimized-as-version-3.patch
-Patch0102: 0102-vmdk-Fix-converting-to-streamOptimized.patch
-# CVE-2016-2538: Integer overflow in usb module (bz #1305815)
-Patch0103: 0103-usb-check-RNDIS-message-length.patch
-Patch0104: 0104-usb-check-RNDIS-buffer-offsets-length.patch
-# CVE-2016-2841: ne2000: infinite loop (bz #1304047)
-Patch0105: 0105-net-ne2000-check-ring-buffer-control-registers.patch
-# CVE-2016-2857: net: out of bounds read (bz #1309564)
-Patch0106: 0106-net-check-packet-payload-length.patch
-# CVE-2016-2392: usb: null pointer dereference (bz #1307115)
-Patch0107: 0107-usb-check-USB-configuration-descriptor-object.patch
-# Fix external snapshot any more after active committing (bz #1300209)
-Patch0108: 0108-block-set-device_list.tqe_prev-to-NULL-on-BDS-remova.patch
-
BuildRequires: SDL2-devel
BuildRequires: zlib-devel
BuildRequires: which
@@ -135,6 +92,9 @@ BuildRequires: rsync
BuildRequires: pciutils-devel
BuildRequires: pulseaudio-libs-devel
BuildRequires: libiscsi-devel
+BuildRequires: libnfs-devel
+BuildRequires: snappy-devel
+BuildRequires: lzo-devel
BuildRequires: ncurses-devel
BuildRequires: libattr-devel
BuildRequires: usbredir-devel >= 0.5.2
@@ -568,7 +528,7 @@ This package provides the system emulator for Tricore.
%prep
-%setup -q -n qemu-%{version}
+%setup -q -n qemu-%{version}%{?rcstr}
%autopatch -p1
@@ -1136,7 +1096,6 @@ getent passwd qemu >/dev/null || \
%{_bindir}/qemu-system-s390x
%{_datadir}/systemtap/tapset/qemu-system-s390x*.stp
%{_mandir}/man1/qemu-system-s390x.1*
-%{_datadir}/%{name}/s390-zipl.rom
%{_datadir}/%{name}/s390-ccw.img
%ifarch s390x
%{?kvm_files:}
@@ -1214,6 +1173,9 @@ getent passwd qemu >/dev/null || \
%changelog
+* Thu Apr 07 2016 Cole Robinson <crobinso@redhat.com> - 2:2.6.0-0.1.rc1
+- Rebased to version 2.6.0-rc1
+
* Thu Mar 17 2016 Cole Robinson <crobinso@redhat.com> - 2:2.5.0-11
- CVE-2016-2857: net: out of bounds read (bz #1309564)
- CVE-2016-2392: usb: null pointer dereference (bz #1307115)