fix-CVE-2020-7039-and-CVE-2020-8608-qemu-AtomGit

M9pfs-local-Fix-possible-memory-leak-in-local_link.patch+20-3

	@@ -1,16 +1,30 @@
		1	+From 841b8d099c462cd4282c4ced8c2a6512899fd8d9 Mon Sep 17 00:00:00 2001
		2	+From: Jiajun Chen <chenjiajun8@huawei.com>
		3	+Date: Mon, 20 Jan 2020 15:11:39 +0100
		4	+Subject: [PATCH] 9pfs: local: Fix possible memory leak in local_link()
		5	+MIME-Version: 1.0
		6	+Content-Type: text/plain; charset=UTF-8
		7	+Content-Transfer-Encoding: 8bit
		8	+
1	There is a possible memory leak while local_link return -1 without free	9	There is a possible memory leak while local_link return -1 without free
2	odirpath and oname.	10	odirpath and oname.
3		11
4	Reported-by: Euler Robot <euler.robot@huawei.com>	12	Reported-by: Euler Robot <euler.robot@huawei.com>
5	-Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
6	Signed-off-by: Jaijun Chen <chenjiajun8@huawei.com>	13	Signed-off-by: Jaijun Chen <chenjiajun8@huawei.com>
7	Signed-off-by: Xiang Zheng <zhengxiang9@huawei.com>	14	Signed-off-by: Xiang Zheng <zhengxiang9@huawei.com>
		15	+Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
		16	+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
		17	+Signed-off-by: Greg Kurz <groug@kaod.org>
		18	+(cherry picked from commit 841b8d099c462cd4282c4ced8c2a6512899fd8d9)
		19	+---
		20	+ hw/9pfs/9p-local.c \| 2 +-
		21	+ 1 file changed, 1 insertion(+), 1 deletion(-)
8		22
9	diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c	23	diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
10	-index 4708c0bd89..491b08aee8 100644	24	+index ca64139..d0592c3 100644
11	--- a/hw/9pfs/9p-local.c	25	--- a/hw/9pfs/9p-local.c
12	+++ b/hw/9pfs/9p-local.c	26	+++ b/hw/9pfs/9p-local.c
13	-@@ -947,7 +947,7 @@ static int local_link(FsContext ctx, V9fsPath oldpath,	27	+@@ -947,7 +947,7 @@ static int local_link(FsContext ctx, V9fsPath oldpath,
14	if (ctx->export_flags & V9FS_SM_MAPPED_FILE &&	28	if (ctx->export_flags & V9FS_SM_MAPPED_FILE &&
15	local_is_mapped_file_metadata(ctx, name)) {	29	local_is_mapped_file_metadata(ctx, name)) {
16	errno = EINVAL;	30	errno = EINVAL;
	@@ -19,3 +33,6 @@ index 4708c0bd89..491b08aee8 100644
19	}	33	}
20		34
21	odirfd = local_opendir_nofollow(ctx, odirpath);	35	odirfd = local_opendir_nofollow(ctx, odirpath);
		36	+--
		37	+1.8.3.1
		38	+

DRevert-Enable-build-and-install-of-our-rST-docs.patch+0-1306

Dblock-Fix-AioContext-switch-for-bs-drv-NULL.patch+0-107

	@@ -1,107 +0,0 @@
1	-From 1bffe1ae7a7b707c3a14ea2ccd00d3609d3ce4d8 Mon Sep 17 00:00:00 2001
2	-From: Kevin Wolf <kwolf@redhat.com>
3	-Date: Wed, 17 Apr 2019 17:15:25 +0200
4	-Subject: [PATCH] block: Fix AioContext switch for bs->drv == NULL
5	-
6	-Even for block nodes with bs->drv == NULL, we can't just ignore a
7	-bdrv_set_aio_context() call. Leaving the node in its old context can
8	-mean that it's still in an iothread context in bdrv_close_all() during
9	-shutdown, resulting in an attempted unlock of the AioContext lock which
10	-we don't hold.
11	-
12	-This is an example stack trace of a related crash:
13	-
14	- #0 0x00007ffff59da57f in raise () at /lib64/libc.so.6
15	- #1 0x00007ffff59c4895 in abort () at /lib64/libc.so.6
16	- #2 0x0000555555b97b1e in error_exit (err=<optimized out>, msg=msg@entry=0x555555d386d0 <__func__.19059> "qemu_mutex_unlock_impl") at util/qemu-thread-posix.c:36
17	- #3 0x0000555555b97f7f in qemu_mutex_unlock_impl (mutex=mutex@entry=0x5555568002f0, file=file@entry=0x555555d378df "util/async.c", line=line@entry=507) at util/qemu-thread-posix.c:97
18	- #4 0x0000555555b92f55 in aio_context_release (ctx=ctx@entry=0x555556800290) at util/async.c:507
19	- #5 0x0000555555b05cf8 in bdrv_prwv_co (child=child@entry=0x7fffc80012f0, offset=offset@entry=131072, qiov=qiov@entry=0x7fffffffd4f0, is_write=is_write@entry=true, flags=flags@entry=0)
20	- at block/io.c:833
21	- #6 0x0000555555b060a9 in bdrv_pwritev (qiov=0x7fffffffd4f0, offset=131072, child=0x7fffc80012f0) at block/io.c:990
22	- #7 0x0000555555b060a9 in bdrv_pwrite (child=0x7fffc80012f0, offset=131072, buf=<optimized out>, bytes=<optimized out>) at block/io.c:990
23	- #8 0x0000555555ae172b in qcow2_cache_entry_flush (bs=bs@entry=0x555556810680, c=c@entry=0x5555568cc740, i=i@entry=0) at block/qcow2-cache.c:51
24	- #9 0x0000555555ae18dd in qcow2_cache_write (bs=bs@entry=0x555556810680, c=0x5555568cc740) at block/qcow2-cache.c:248
25	- #10 0x0000555555ae15de in qcow2_cache_flush (bs=0x555556810680, c=<optimized out>) at block/qcow2-cache.c:259
26	- #11 0x0000555555ae16b1 in qcow2_cache_flush_dependency (c=0x5555568a1700, c=0x5555568a1700, bs=0x555556810680) at block/qcow2-cache.c:194
27	- #12 0x0000555555ae16b1 in qcow2_cache_entry_flush (bs=bs@entry=0x555556810680, c=c@entry=0x5555568a1700, i=i@entry=0) at block/qcow2-cache.c:194
28	- #13 0x0000555555ae18dd in qcow2_cache_write (bs=bs@entry=0x555556810680, c=0x5555568a1700) at block/qcow2-cache.c:248
29	- #14 0x0000555555ae15de in qcow2_cache_flush (bs=bs@entry=0x555556810680, c=<optimized out>) at block/qcow2-cache.c:259
30	- #15 0x0000555555ad242c in qcow2_inactivate (bs=bs@entry=0x555556810680) at block/qcow2.c:2124
31	- #16 0x0000555555ad2590 in qcow2_close (bs=0x555556810680) at block/qcow2.c:2153
32	- #17 0x0000555555ab0c62 in bdrv_close (bs=0x555556810680) at block.c:3358
33	- #18 0x0000555555ab0c62 in bdrv_delete (bs=0x555556810680) at block.c:3542
34	- #19 0x0000555555ab0c62 in bdrv_unref (bs=0x555556810680) at block.c:4598
35	- #20 0x0000555555af4d72 in blk_remove_bs (blk=blk@entry=0x5555568103d0) at block/block-backend.c:785
36	- #21 0x0000555555af4dbb in blk_remove_all_bs () at block/block-backend.c:483
37	- #22 0x0000555555aae02f in bdrv_close_all () at block.c:3412
38	- #23 0x00005555557f9796 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4776
39	-
40	-The reproducer I used is a qcow2 image on gluster volume, where the
41	-virtual disk size (4 GB) is larger than the gluster volume size (64M),
42	-so we can easily trigger an ENOSPC. This backend is assigned to a
43	-virtio-blk device using an iothread, and then from the guest a
44	-'dd if=/dev/zero of=/dev/vda bs=1G count=1' causes the VM to stop
45	-because of an I/O error. qemu_gluster_co_flush_to_disk() sets
46	-bs->drv = NULL on error, so when virtio-blk stops the dataplane, the
47	-block nodes stay in the iothread AioContext. A 'quit' monitor command
48	-issued from this paused state crashes the process.
49	-
50	-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1631227
51	-Cc: qemu-stable@nongnu.org
52	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
53	-Reviewed-by: Eric Blake <eblake@redhat.com>
54	-Reviewed-by: Max Reitz <mreitz@redhat.com>
55	-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
56	-(cherry-picked from commit 1bffe1ae7a7b707c3a14ea2ccd00d3609d3ce4d8)
57	----
58	- block.c \| 12 ++----------
59	- 1 file changed, 2 insertions(+), 10 deletions(-)
60	-
61	-diff --git a/block.c b/block.c
62	-index 16615bc876..9ae5c0ed2f 100644
63	---- a/block.c
64	-+++ b/block.c
65	-@@ -5672,10 +5672,6 @@ void bdrv_detach_aio_context(BlockDriverState *bs)
66	- BdrvAioNotifier baf, baf_tmp;
67	- BdrvChild *child;
68	-
69	-- if (!bs->drv) {
70	-- return;
71	-- }
72	--
73	- assert(!bs->walking_aio_notifiers);
74	- bs->walking_aio_notifiers = true;
75	- QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
76	-@@ -5690,7 +5686,7 @@ void bdrv_detach_aio_context(BlockDriverState *bs)
77	- */
78	- bs->walking_aio_notifiers = false;
79	-
80	-- if (bs->drv->bdrv_detach_aio_context) {
81	-+ if (bs->drv && bs->drv->bdrv_detach_aio_context) {
82	- bs->drv->bdrv_detach_aio_context(bs);
83	- }
84	- QLIST_FOREACH(child, &bs->children, next) {
85	-@@ -5709,10 +5705,6 @@ void bdrv_attach_aio_context(BlockDriverState *bs,
86	- BdrvAioNotifier ban, ban_tmp;
87	- BdrvChild *child;
88	-
89	-- if (!bs->drv) {
90	-- return;
91	-- }
92	--
93	- if (bs->quiesce_counter) {
94	- aio_disable_external(new_context);
95	- }
96	-@@ -5722,7 +5714,7 @@ void bdrv_attach_aio_context(BlockDriverState *bs,
97	- QLIST_FOREACH(child, &bs->children, next) {
98	- bdrv_attach_aio_context(child->bs, new_context);
99	- }
100	-- if (bs->drv->bdrv_attach_aio_context) {
101	-+ if (bs->drv && bs->drv->bdrv_attach_aio_context) {
102	- bs->drv->bdrv_attach_aio_context(bs, new_context);
103	- }
104	-
105	---
106	-2.19.1
107	-

Dblock-create-Do-not-abort-if-a-block-driver-is-not-available.patch+0-96

	@@ -1,96 +0,0 @@
1	-From c24d971c130d889d4d001d2ae2cb02b9a34d51b6 Mon Sep 17 00:00:00 2001
2	-From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
3	-Date: Thu, 12 Sep 2019 00:08:49 +0200
4	-Subject: [PATCH] block/create: Do not abort if a block driver is not available
5	-MIME-Version: 1.0
6	-Content-Type: text/plain; charset=UTF-8
7	-Content-Transfer-Encoding: 8bit
8	-
9	-The 'blockdev-create' QMP command was introduced as experimental
10	-feature in commit b0292b851b8, using the assert() debug call.
11	-It got promoted to 'stable' command in 3fb588a0f2c, but the
12	-assert call was not removed.
13	-
14	-Some block drivers are optional, and bdrv_find_format() might
15	-return a NULL value, triggering the assertion.
16	-
17	-Stable code is not expected to abort, so return an error instead.
18	-
19	-This is easily reproducible when libnfs is not installed:
20	-
21	- ./configure
22	- [...]
23	- module support no
24	- Block whitelist (rw)
25	- Block whitelist (ro)
26	- libiscsi support yes
27	- libnfs support no
28	- [...]
29	-
30	-Start QEMU:
31	-
32	- $ qemu-system-x86_64 -S -qmp unix:/tmp/qemu.qmp,server,nowait
33	-
34	-Send the 'blockdev-create' with the 'nfs' driver:
35	-
36	- $ ( cat << 'EOF'
37	- {'execute': 'qmp_capabilities'}
38	- {'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
39	- EOF
40	- ) \| socat STDIO UNIX:/tmp/qemu.qmp
41	- {"QMP": {"version": {"qemu": {"micro": 50, "minor": 1, "major": 4}, "package": "v4.1.0-733-g89ea03a7dc"}, "capabilities": ["oob"]}}
42	- {"return": {}}
43	-
44	-QEMU crashes:
45	-
46	- $ gdb qemu-system-x86_64 core
47	- Program received signal SIGSEGV, Segmentation fault.
48	- (gdb) bt
49	- #0 0x00007ffff510957f in raise () at /lib64/libc.so.6
50	- #1 0x00007ffff50f3895 in abort () at /lib64/libc.so.6
51	- #2 0x00007ffff50f3769 in _nl_load_domain.cold.0 () at /lib64/libc.so.6
52	- #3 0x00007ffff5101a26 in .annobin_assert.c_end () at /lib64/libc.so.6
53	- #4 0x0000555555d7e1f1 in qmp_blockdev_create (job_id=0x555556baee40 "x", options=0x555557666610, errp=0x7fffffffc770) at block/create.c:69
54	- #5 0x0000555555c96b52 in qmp_marshal_blockdev_create (args=0x7fffdc003830, ret=0x7fffffffc7f8, errp=0x7fffffffc7f0) at qapi/qapi-commands-block-core.c:1314
55	- #6 0x0000555555deb0a0 in do_qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false, errp=0x7fffffffc898) at qapi/qmp-dispatch.c:131
56	- #7 0x0000555555deb2a1 in qmp_dispatch (cmds=0x55555645de70 <qmp_commands>, request=0x7fffdc005c70, allow_oob=false) at qapi/qmp-dispatch.c:174
57	-
58	-With this patch applied, QEMU returns a QMP error:
59	-
60	- {'execute': 'blockdev-create', 'arguments': {'job-id': 'x', 'options': {'size': 0, 'driver': 'nfs', 'location': {'path': '/', 'server': {'host': '::1', 'type': 'inet'}}}}, 'id': 'x'}
61	- {"id": "x", "error": {"class": "GenericError", "desc": "Block driver 'nfs' not found or not supported"}}
62	-
63	-Cc: qemu-stable@nongnu.org
64	-Reported-by: Xu Tian <xutian@redhat.com>
65	-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
66	-Reviewed-by: Eric Blake <eblake@redhat.com>
67	-Reviewed-by: John Snow <jsnow@redhat.com>
68	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
69	-(cherry picked from commit d90d5cae2b10efc0e8d0b3cc91ff16201853d3ba)
70	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
71	----
72	- block/create.c \| 6 +++++-
73	- 1 file changed, 5 insertions(+), 1 deletion(-)
74	-
75	-diff --git a/block/create.c b/block/create.c
76	-index 95341219ef..de5e97bb18 100644
77	---- a/block/create.c
78	-+++ b/block/create.c
79	-@@ -63,9 +63,13 @@ void qmp_blockdev_create(const char job_id, BlockdevCreateOptions options,
80	- const char *fmt = BlockdevDriver_str(options->driver);
81	- BlockDriver *drv = bdrv_find_format(fmt);
82	-
83	-+ if (!drv) {
84	-+ error_setg(errp, "Block driver '%s' not found or not supported", fmt);
85	-+ return;
86	-+ }
87	-+
88	- /* If the driver is in the schema, we know that it exists. But it may not
89	- * be whitelisted. */
90	-- assert(drv);
91	- if (bdrv_uses_whitelist() && !bdrv_is_whitelisted(drv, false)) {
92	- error_setg(errp, "Driver is not whitelisted");
93	- return;
94	---
95	-2.19.1
96	-

Dblock-file-posix-Unaligned-O_DIRECT-block-status.patch+0-87

	@@ -1,87 +0,0 @@
1	-From 9c3db310ff0b7473272ae8dce5e04e2f8a825390 Mon Sep 17 00:00:00 2001
2	-From: Max Reitz <mreitz@redhat.com>
3	-Date: Wed, 15 May 2019 06:15:40 +0200
4	-Subject: [PATCH] block/file-posix: Unaligned O_DIRECT block-status
5	-
6	-Currently, qemu crashes whenever someone queries the block status of an
7	-unaligned image tail of an O_DIRECT image:
8	-$ echo > foo
9	-$ qemu-img map --image-opts driver=file,filename=foo,cache.direct=on
10	-Offset Length Mapped to File
11	-qemu-img: block/io.c:2093: bdrv_co_block_status: Assertion `*pnum &&
12	-QEMU_IS_ALIGNED(*pnum, align) && align > offset - aligned_offset'
13	-failed.
14	-
15	-This is because bdrv_co_block_status() checks that the result returned
16	-by the driver's implementation is aligned to the request_alignment, but
17	-file-posix can fail to do so, which is actually mentioned in a comment
18	-there: "[...] possibly including a partial sector at EOF".
19	-
20	-Fix this by rounding up those partial sectors.
21	-
22	-There are two possible alternative fixes:
23	-(1) We could refuse to open unaligned image files with O_DIRECT
24	- altogether. That sounds reasonable until you realize that qcow2
25	- does necessarily not fill up its metadata clusters, and that nobody
26	- runs qemu-img create with O_DIRECT. Therefore, unpreallocated qcow2
27	- files usually have an unaligned image tail.
28	-
29	-(2) bdrv_co_block_status() could ignore unaligned tails. It actually
30	- throws away everything past the EOF already, so that sounds
31	- reasonable.
32	- Unfortunately, the block layer knows file lengths only with a
33	- granularity of BDRV_SECTOR_SIZE, so bdrv_co_block_status() usually
34	- would have to guess whether its file length information is inexact
35	- or whether the driver is broken.
36	-
37	-Fixing what raw_co_block_status() returns is the safest thing to do.
38	-
39	-There seems to be no other block driver that sets request_alignment and
40	-does not make sure that it always returns aligned values.
41	-
42	-Cc: qemu-stable@nongnu.org
43	-Signed-off-by: Max Reitz <mreitz@redhat.com>
44	-Reviewed-by: Eric Blake <eblake@redhat.com>
45	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
46	-(cherry-picked from commit 9c3db310ff0b7473272ae8dce5e04e2f8a825390)
47	----
48	- block/file-posix.c \| 16 ++++++++++++++++
49	- 1 file changed, 16 insertions(+)
50	-
51	-diff --git a/block/file-posix.c b/block/file-posix.c
52	-index e09e15bbf8..d018429672 100644
53	---- a/block/file-posix.c
54	-+++ b/block/file-posix.c
55	-@@ -2488,6 +2488,8 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
56	- off_t data = 0, hole = 0;
57	- int ret;
58	-
59	-+ assert(QEMU_IS_ALIGNED(offset \| bytes, bs->bl.request_alignment));
60	-+
61	- ret = fd_open(bs);
62	- if (ret < 0) {
63	- return ret;
64	-@@ -2513,6 +2515,20 @@ static int coroutine_fn raw_co_block_status(BlockDriverState *bs,
65	- /* On a data extent, compute bytes to the end of the extent,
66	- * possibly including a partial sector at EOF. */
67	- *pnum = MIN(bytes, hole - offset);
68	-+
69	-+ /*
70	-+ * We are not allowed to return partial sectors, though, so
71	-+ * round up if necessary.
72	-+ */
73	-+ if (!QEMU_IS_ALIGNED(*pnum, bs->bl.request_alignment)) {
74	-+ int64_t file_length = raw_getlength(bs);
75	-+ if (file_length > 0) {
76	-+ /* Ignore errors, this is just a safeguard */
77	-+ assert(hole == file_length);
78	-+ }
79	-+ pnum = ROUND_UP(pnum, bs->bl.request_alignment);
80	-+ }
81	-+
82	- ret = BDRV_BLOCK_DATA;
83	- } else {
84	- /* On a hole, compute bytes to the beginning of the next extent. */
85	---
86	-2.19.1
87	-

Dblock-nfs-tear-down-aio-before-nfs_close.patch+0-42

	@@ -1,42 +0,0 @@
1	-From 6cb3e9e4f17c182c43ded773a04b1072c881aa78 Mon Sep 17 00:00:00 2001
2	-From: Peter Lieven <pl@kamp.de>
3	-Date: Tue, 10 Sep 2019 17:41:09 +0200
4	-Subject: [PATCH] block/nfs: tear down aio before nfs_close
5	-
6	-nfs_close is a sync call from libnfs and has its own event
7	-handler polling on the nfs FD. Avoid that both QEMU and libnfs
8	-are intefering here.
9	-
10	-CC: qemu-stable@nongnu.org
11	-Signed-off-by: Peter Lieven <pl@kamp.de>
12	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
13	-(cherry picked from commit 601dc6559725f7a614b6f893611e17ff0908e914)
14	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
15	----
16	- block/nfs.c \| 6 ++++--
17	- 1 file changed, 4 insertions(+), 2 deletions(-)
18	-
19	-diff --git a/block/nfs.c b/block/nfs.c
20	-index 531903610b..f04f675c63 100644
21	---- a/block/nfs.c
22	-+++ b/block/nfs.c
23	-@@ -389,12 +389,14 @@ static void nfs_attach_aio_context(BlockDriverState *bs,
24	- static void nfs_client_close(NFSClient *client)
25	- {
26	- if (client->context) {
27	-+ qemu_mutex_lock(&client->mutex);
28	-+ aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),
29	-+ false, NULL, NULL, NULL, NULL);
30	-+ qemu_mutex_unlock(&client->mutex);
31	- if (client->fh) {
32	- nfs_close(client->context, client->fh);
33	- client->fh = NULL;
34	- }
35	-- aio_set_fd_handler(client->aio_context, nfs_get_fd(client->context),
36	-- false, NULL, NULL, NULL, NULL);
37	- nfs_destroy_context(client->context);
38	- client->context = NULL;
39	- }
40	---
41	-2.19.1
42	-

Dblockdev-backup-don-t-check-aio_context-too-early.patch+0-53

	@@ -1,53 +0,0 @@
1	-From 2429dc4eea91b381ff67a4d25ea9f6bbfe87c784 Mon Sep 17 00:00:00 2001
2	-From: John Snow <jsnow@redhat.com>
3	-Date: Thu, 23 May 2019 13:06:39 -0400
4	-Subject: [PATCH] blockdev-backup: don't check aio_context too early
5	-
6	-in blockdev_backup_prepare, we check to make sure that the target is
7	-associated with a compatible aio context. However, do_blockdev_backup is
8	-called later and has some logic to move the target to a compatible
9	-aio_context. The transaction version will fail certain commands
10	-needlessly early as a result.
11	-
12	-Allow blockdev_backup_prepare to simply call do_blockdev_backup, which
13	-will ultimately decide if the contexts are compatible or not.
14	-
15	-Note: the transaction version has always disallowed this operation since
16	-its initial commit bd8baecd (2014), whereas the version of
17	-qmp_blockdev_backup at the time, from commit c29c1dd312f, tried to
18	-enforce the aio_context switch instead. It's not clear, and I can't see
19	-from the mailing list archives at the time, why the two functions take a
20	-different approach. It wasn't until later in efd7556708b (2016) that the
21	-standalone version tried to determine if it could set the context or
22	-not.
23	-
24	-Reported-by: aihua liang <aliang@redhat.com>
25	-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1683498
26	-Signed-off-by: John Snow <jsnow@redhat.com>
27	-Message-id: 20190523170643.20794-2-jsnow@redhat.com
28	-Reviewed-by: Max Reitz <mreitz@redhat.com>
29	-Signed-off-by: Max Reitz <mreitz@redhat.com>
30	-(cherry picked from commit d81e1efbea7d19c2f142d300df56538c73800590)
31	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
32	----
33	- blockdev.c \| 4 ----
34	- 1 file changed, 4 deletions(-)
35	-
36	-diff --git a/blockdev.c b/blockdev.c
37	-index 4775a07d93..d358169995 100644
38	---- a/blockdev.c
39	-+++ b/blockdev.c
40	-@@ -1871,10 +1871,6 @@ static void blockdev_backup_prepare(BlkActionState common, Error *errp)
41	- }
42	-
43	- aio_context = bdrv_get_aio_context(bs);
44	-- if (aio_context != bdrv_get_aio_context(target)) {
45	-- error_setg(errp, "Backup between two IO threads is not implemented");
46	-- return;
47	-- }
48	- aio_context_acquire(aio_context);
49	- state->bs = bs;
50	-
51	---
52	-2.19.1
53	-

Dblockjob-update-nodes-head-while-removing-all-bdrv.patch+0-62

	@@ -1,62 +0,0 @@
1	-From b9405afb0956fe2c293a94bdc4440579e5c0efee Mon Sep 17 00:00:00 2001
2	-From: Sergio Lopez <slp@redhat.com>
3	-Date: Wed, 11 Sep 2019 12:03:16 +0200
4	-Subject: [PATCH] blockjob: update nodes head while removing all bdrv
5	-
6	-block_job_remove_all_bdrv() iterates through job->nodes, calling
7	-bdrv_root_unref_child() for each entry. The call to the latter may
8	-reach child_job_[can_]set_aio_ctx(), which will also attempt to
9	-traverse job->nodes, potentially finding entries that where freed
10	-on previous iterations.
11	-
12	-To avoid this situation, update job->nodes head on each iteration to
13	-ensure that already freed entries are no longer linked to the list.
14	-
15	-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1746631
16	-Signed-off-by: Sergio Lopez <slp@redhat.com>
17	-Cc: qemu-stable@nongnu.org
18	-Signed-off-by: Max Reitz <mreitz@redhat.com>
19	-Message-id: 20190911100316.32282-1-mreitz@redhat.com
20	-Reviewed-by: Sergio Lopez <slp@redhat.com>
21	-Signed-off-by: Max Reitz <mreitz@redhat.com>
22	-(cherry picked from commit d876bf676f5e7c6aa9ac64555e48cba8734ecb2f)
23	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
24	----
25	- blockjob.c \| 17 +++++++++++++----
26	- 1 file changed, 13 insertions(+), 4 deletions(-)
27	-
28	-diff --git a/blockjob.c b/blockjob.c
29	-index 730101d282..d770144fd6 100644
30	---- a/blockjob.c
31	-+++ b/blockjob.c
32	-@@ -193,14 +193,23 @@ static const BdrvChildRole child_job = {
33	-
34	- void block_job_remove_all_bdrv(BlockJob *job)
35	- {
36	-- GSList *l;
37	-- for (l = job->nodes; l; l = l->next) {
38	-+ /*
39	-+ * bdrv_root_unref_child() may reach child_job_[can_]set_aio_ctx(),
40	-+ * which will also traverse job->nodes, so consume the list one by
41	-+ * one to make sure that such a concurrent access does not attempt
42	-+ * to process an already freed BdrvChild.
43	-+ */
44	-+ while (job->nodes) {
45	-+ GSList *l = job->nodes;
46	- BdrvChild *c = l->data;
47	-+
48	-+ job->nodes = l->next;
49	-+
50	- bdrv_op_unblock_all(c->bs, job->blocker);
51	- bdrv_root_unref_child(c);
52	-+
53	-+ g_slist_free_1(l);
54	- }
55	-- g_slist_free(job->nodes);
56	-- job->nodes = NULL;
57	- }
58	-
59	- int block_job_add_bdrv(BlockJob job, const char name, BlockDriverState *bs,
60	---
61	-2.19.1
62	-

Dcutils-Fix-size_to_str-on-32-bit-platforms.patch+0-37

	@@ -1,37 +0,0 @@
1	-From 754da86714d550c3f995f11a2587395081362e0a Mon Sep 17 00:00:00 2001
2	-From: Eric Blake <eblake@redhat.com>
3	-Date: Wed, 17 Apr 2019 12:11:00 -0500
4	-Subject: [PATCH] cutils: Fix size_to_str() on 32-bit platforms
5	-
6	-When extracting a human-readable size formatter, we changed 'uint64_t
7	-div' pre-patch to 'unsigned long div' post-patch. Which breaks on
8	-32-bit platforms, resulting in 'inf' instead of intended values larger
9	-than 999GB.
10	-
11	-Fixes: 22951aaa
12	-CC: qemu-stable@nongnu.org
13	-Reported-by: Max Reitz <mreitz@redhat.com>
14	-Signed-off-by: Eric Blake <eblake@redhat.com>
15	-Reviewed-by: Max Reitz <mreitz@redhat.com>
16	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
17	-(cherry-picked from commit 754da86714d550c3f995f11a2587395081362e0a)
18	----
19	- util/cutils.c \| 2 +-
20	- 1 file changed, 1 insertion(+), 1 deletion(-)
21	-
22	-diff --git a/util/cutils.c b/util/cutils.c
23	-index e098debdc0..d682c90901 100644
24	---- a/util/cutils.c
25	-+++ b/util/cutils.c
26	-@@ -825,7 +825,7 @@ const char qemu_ether_ntoa(const MACAddr mac)
27	- char *size_to_str(uint64_t val)
28	- {
29	- static const char *suffixes[] = { "", "Ki", "Mi", "Gi", "Ti", "Pi", "Ei" };
30	-- unsigned long div;
31	-+ uint64_t div;
32	- int i;
33	-
34	- /*
35	---
36	-2.19.1
37	-

Ddma-helpers-ensure-AIO-callback-is-invoked-after-can.patch+0-80

	@@ -1,80 +0,0 @@
1	-From 53c641048e0a8da1d2bed76cbd17f259a35e39a0 Mon Sep 17 00:00:00 2001
2	-From: Paolo Bonzini <pbonzini@redhat.com>
3	-Date: Mon, 29 Jul 2019 23:34:16 +0200
4	-Subject: [PATCH] dma-helpers: ensure AIO callback is invoked after
5	- cancellation
6	-
7	-dma_aio_cancel unschedules the BH if there is one, which corresponds
8	-to the reschedule_dma case of dma_blk_cb. This can stall the DMA
9	-permanently, because dma_complete will never get invoked and therefore
10	-nobody will ever invoke the original AIO callback in dbs->common.cb.
11	-
12	-Fix this by invoking the callback (which is ensured to happen after
13	-a bdrv_aio_cancel_async, or done manually in the dbs->bh case), and
14	-add assertions to check that the DMA state machine is indeed waiting
15	-for dma_complete or reschedule_dma, but never both.
16	-
17	-Reported-by: John Snow <jsnow@redhat.com>
18	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
19	-Message-id: 20190729213416.1972-1-pbonzini@redhat.com
20	-Signed-off-by: John Snow <jsnow@redhat.com>
21	-(cherry picked from commit 539343c0a47e19d5dd64d846d64d084d9793681f)
22	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
23	----
24	- dma-helpers.c \| 13 +++++++++----
25	- 1 file changed, 9 insertions(+), 4 deletions(-)
26	-
27	-diff --git a/dma-helpers.c b/dma-helpers.c
28	-index 2d7e02d35e..d3871dc61e 100644
29	---- a/dma-helpers.c
30	-+++ b/dma-helpers.c
31	-@@ -90,6 +90,7 @@ static void reschedule_dma(void *opaque)
32	- {
33	- DMAAIOCB dbs = (DMAAIOCB )opaque;
34	-
35	-+ assert(!dbs->acb && dbs->bh);
36	- qemu_bh_delete(dbs->bh);
37	- dbs->bh = NULL;
38	- dma_blk_cb(dbs, 0);
39	-@@ -111,15 +112,12 @@ static void dma_complete(DMAAIOCB *dbs, int ret)
40	- {
41	- trace_dma_complete(dbs, ret, dbs->common.cb);
42	-
43	-+ assert(!dbs->acb && !dbs->bh);
44	- dma_blk_unmap(dbs);
45	- if (dbs->common.cb) {
46	- dbs->common.cb(dbs->common.opaque, ret);
47	- }
48	- qemu_iovec_destroy(&dbs->iov);
49	-- if (dbs->bh) {
50	-- qemu_bh_delete(dbs->bh);
51	-- dbs->bh = NULL;
52	-- }
53	- qemu_aio_unref(dbs);
54	- }
55	-
56	-@@ -179,14 +177,21 @@ static void dma_aio_cancel(BlockAIOCB *acb)
57	-
58	- trace_dma_aio_cancel(dbs);
59	-
60	-+ assert(!(dbs->acb && dbs->bh));
61	- if (dbs->acb) {
62	-+ /* This will invoke dma_blk_cb. */
63	- blk_aio_cancel_async(dbs->acb);
64	-+ return;
65	- }
66	-+
67	- if (dbs->bh) {
68	- cpu_unregister_map_client(dbs->bh);
69	- qemu_bh_delete(dbs->bh);
70	- dbs->bh = NULL;
71	- }
72	-+ if (dbs->common.cb) {
73	-+ dbs->common.cb(dbs->common.opaque, -ECANCELED);
74	-+ }
75	- }
76	-
77	- static AioContext dma_get_aio_context(BlockAIOCB acb)
78	---
79	-2.19.1
80	-

Dhw-Nuke-hw_compat_4_0_1-and-pc_compat_4_0_1.patch+0-124

	@@ -1,124 +0,0 @@
1	-From 56deb8f0db72858985ba077cb0f678f2dbc13bba Mon Sep 17 00:00:00 2001
2	-From: Greg Kurz <groug@kaod.org>
3	-Date: Mon, 5 Aug 2019 15:56:58 +0800
4	-Subject: [PATCH] hw: Nuke hw_compat_4_0_1 and pc_compat_4_0_1
5	-
6	-Commit c87759ce876a fixed a regression affecting pc-q35 machines by
7	-introducing a new pc-q35-4.0.1 machine version to be used instead
8	-of pc-q35-4.0. The only purpose was to revert the default behaviour
9	-of not using split irqchip, but the change also introduced the usual
10	-hw_compat and pc_compat bits, and wired them for pc-q35 only.
11	-
12	-This raises questions when it comes to add new compat properties for
13	-4.0* machine versions of any architecture. Where to add them ? In
14	-4.0, 4.0.1 or both ? Error prone. Another possibility would be to teach
15	-all other architectures about 4.0.1. This solution isn't satisfying,
16	-especially since this is a pc-q35 specific issue.
17	-
18	-It turns out that the split irqchip default is handled in the machine
19	-option function and doesn't involve compat lists at all.
20	-
21	-Drop all the 4.0.1 compat lists and use the 4.0 ones instead in the 4.0.1
22	-machine option function.
23	-
24	-Move the compat props that were added to the 4.0.1 since c87759ce876a to
25	-4.0.
26	-
27	-Even if only hw_compat_4_0_1 had an impact on other architectures,
28	-drop pc_compat_4_0_1 as well for consistency.
29	-
30	-Fixes: c87759ce876a "q35: Revert to kernel irqchip"
31	-Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
32	-Signed-off-by: Greg Kurz <groug@kaod.org>
33	-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
34	-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
35	-Message-Id: <156051774276.244890.8660277280145466396.stgit@bahia.lan>
36	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
37	-(cherry-picked from commit 8e8cbed09ad9d577955691b4c061b61b602406d1)
38	----
39	- hw/core/machine.c \| 3 ---
40	- hw/i386/pc.c \| 3 ---
41	- hw/i386/pc_q35.c \| 9 +++++++--
42	- include/hw/boards.h \| 3 ---
43	- include/hw/i386/pc.h \| 3 ---
44	- 5 files changed, 7 insertions(+), 14 deletions(-)
45	-
46	-diff --git a/hw/core/machine.c b/hw/core/machine.c
47	-index e41e6698..5d046a43 100644
48	---- a/hw/core/machine.c
49	-+++ b/hw/core/machine.c
50	-@@ -24,9 +24,6 @@
51	- #include "hw/pci/pci.h"
52	- #include "hw/mem/nvdimm.h"
53	-
54	--GlobalProperty hw_compat_4_0_1[] = {};
55	--const size_t hw_compat_4_0_1_len = G_N_ELEMENTS(hw_compat_4_0_1);
56	--
57	- GlobalProperty hw_compat_4_0[] = {};
58	- const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
59	-
60	-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
61	-index b5311e7e..d98b737b 100644
62	---- a/hw/i386/pc.c
63	-+++ b/hw/i386/pc.c
64	-@@ -115,9 +115,6 @@ struct hpet_fw_config hpet_cfg = {.count = UINT8_MAX};
65	- /* Physical Address of PVH entry point read from kernel ELF NOTE */
66	- static size_t pvh_start_addr;
67	-
68	--GlobalProperty pc_compat_4_0_1[] = {};
69	--const size_t pc_compat_4_0_1_len = G_N_ELEMENTS(pc_compat_4_0_1);
70	--
71	- GlobalProperty pc_compat_4_0[] = {};
72	- const size_t pc_compat_4_0_len = G_N_ELEMENTS(pc_compat_4_0);
73	-
74	-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
75	-index dcddc646..e3498a45 100644
76	---- a/hw/i386/pc_q35.c
77	-+++ b/hw/i386/pc_q35.c
78	-@@ -378,8 +378,13 @@ static void pc_q35_4_0_1_machine_options(MachineClass *m)
79	- {
80	- pc_q35_4_1_machine_options(m);
81	- m->alias = NULL;
82	-- compat_props_add(m->compat_props, hw_compat_4_0_1, hw_compat_4_0_1_len);
83	-- compat_props_add(m->compat_props, pc_compat_4_0_1, pc_compat_4_0_1_len);
84	-+ /*
85	-+ * This is the default machine for the 4.0-stable branch. It is basically
86	-+ * a 4.0 that doesn't use split irqchip by default. It MUST hence apply the
87	-+ * 4.0 compat props.
88	-+ */
89	-+ compat_props_add(m->compat_props, hw_compat_4_0, hw_compat_4_0_len);
90	-+ compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
91	- }
92	-
93	- DEFINE_Q35_MACHINE(v4_0_1, "pc-q35-4.0.1", NULL,
94	-diff --git a/include/hw/boards.h b/include/hw/boards.h
95	-index ad3950d3..fe1885cb 100644
96	---- a/include/hw/boards.h
97	-+++ b/include/hw/boards.h
98	-@@ -293,9 +293,6 @@ struct MachineState {
99	- } \
100	- type_init(machine_initfn##_register_types)
101	-
102	--extern GlobalProperty hw_compat_4_0_1[];
103	--extern const size_t hw_compat_4_0_1_len;
104	--
105	- extern GlobalProperty hw_compat_4_0[];
106	- extern const size_t hw_compat_4_0_len;
107	-
108	-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
109	-index 5d563624..43df7230 100644
110	---- a/include/hw/i386/pc.h
111	-+++ b/include/hw/i386/pc.h
112	-@@ -293,9 +293,6 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
113	- int e820_get_num_entries(void);
114	- bool e820_get_entry(int, uint32_t, uint64_t , uint64_t );
115	-
116	--extern GlobalProperty pc_compat_4_0_1[];
117	--extern const size_t pc_compat_4_0_1_len;
118	--
119	- extern GlobalProperty pc_compat_4_0[];
120	- extern const size_t pc_compat_4_0_len;
121	-
122	---
123	-2.19.1
124	-

Dhw-add-compat-machines-for-4.1.patch+0-232

	@@ -1,232 +0,0 @@
1	-From 9bf2650bc3aab126b85c034bf86e27d564f9a1aa Mon Sep 17 00:00:00 2001
2	-From: Cornelia Huck <cohuck@redhat.com>
3	-Date: Thu, 11 Apr 2019 12:20:25 +0200
4	-Subject: [PATCH] hw: add compat machines for 4.1
5	-
6	-Add 4.1 machine types for arm/i440fx/q35/s390x/spapr.
7	-
8	-Signed-off-by: Cornelia Huck <cohuck@redhat.com>
9	-Message-Id: <20190411102025.22559-1-cohuck@redhat.com>
10	-Acked-by: Greg Kurz <groug@kaod.org>
11	-Acked-by: David Gibson <david@gibson.dropbear.id.au>
12	-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
13	-(cherry-picked from commit 9bf2650bc3aab126b85c034bf86e27d564f9a1aa)
14	----
15	- hw/arm/virt.c \| 9 ++++++++-
16	- hw/core/machine.c \| 3 +++
17	- hw/i386/pc.c \| 3 +++
18	- hw/i386/pc_piix.c \| 14 +++++++++++++-
19	- hw/i386/pc_q35.c \| 13 ++++++++++++-
20	- hw/ppc/spapr.c \| 15 +++++++++++++--
21	- hw/s390x/s390-virtio-ccw.c \| 14 +++++++++++++-
22	- include/hw/boards.h \| 3 +++
23	- include/hw/i386/pc.h \| 3 +++
24	- 9 files changed, 71 insertions(+), 6 deletions(-)
25	-
26	-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
27	-index ce2664a30b..16ba67f7a7 100644
28	---- a/hw/arm/virt.c
29	-+++ b/hw/arm/virt.c
30	-@@ -1978,10 +1978,17 @@ static void machvirt_machine_init(void)
31	- }
32	- type_init(machvirt_machine_init);
33	-
34	-+static void virt_machine_4_1_options(MachineClass *mc)
35	-+{
36	-+}
37	-+DEFINE_VIRT_MACHINE_AS_LATEST(4, 1)
38	-+
39	- static void virt_machine_4_0_options(MachineClass *mc)
40	- {
41	-+ virt_machine_4_1_options(mc);
42	-+ compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
43	- }
44	--DEFINE_VIRT_MACHINE_AS_LATEST(4, 0)
45	-+DEFINE_VIRT_MACHINE(4, 0)
46	-
47	- static void virt_machine_3_1_options(MachineClass *mc)
48	- {
49	-diff --git a/hw/core/machine.c b/hw/core/machine.c
50	-index 743fef2898..5d046a43e3 100644
51	---- a/hw/core/machine.c
52	-+++ b/hw/core/machine.c
53	-@@ -24,6 +24,9 @@
54	- #include "hw/pci/pci.h"
55	- #include "hw/mem/nvdimm.h"
56	-
57	-+GlobalProperty hw_compat_4_0[] = {};
58	-+const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
59	-+
60	- GlobalProperty hw_compat_3_1[] = {
61	- { "pcie-root-port", "x-speed", "2_5" },
62	- { "pcie-root-port", "x-width", "1" },
63	-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
64	-index f2c15bf1f2..d98b737b8f 100644
65	---- a/hw/i386/pc.c
66	-+++ b/hw/i386/pc.c
67	-@@ -115,6 +115,9 @@ struct hpet_fw_config hpet_cfg = {.count = UINT8_MAX};
68	- /* Physical Address of PVH entry point read from kernel ELF NOTE */
69	- static size_t pvh_start_addr;
70	-
71	-+GlobalProperty pc_compat_4_0[] = {};
72	-+const size_t pc_compat_4_0_len = G_N_ELEMENTS(pc_compat_4_0);
73	-+
74	- GlobalProperty pc_compat_3_1[] = {
75	- { "intel-iommu", "dma-drain", "off" },
76	- { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
77	-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
78	-index 8ad8e885c6..2a7700b564 100644
79	---- a/hw/i386/pc_piix.c
80	-+++ b/hw/i386/pc_piix.c
81	-@@ -428,13 +428,25 @@ static void pc_i440fx_machine_options(MachineClass *m)
82	- machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
83	- }
84	-
85	--static void pc_i440fx_4_0_machine_options(MachineClass *m)
86	-+static void pc_i440fx_4_1_machine_options(MachineClass *m)
87	- {
88	- pc_i440fx_machine_options(m);
89	- m->alias = "pc";
90	- m->is_default = 1;
91	- }
92	-
93	-+DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
94	-+ pc_i440fx_4_1_machine_options);
95	-+
96	-+static void pc_i440fx_4_0_machine_options(MachineClass *m)
97	-+{
98	-+ pc_i440fx_4_1_machine_options(m);
99	-+ m->alias = NULL;
100	-+ m->is_default = 0;
101	-+ compat_props_add(m->compat_props, hw_compat_4_0, hw_compat_4_0_len);
102	-+ compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
103	-+}
104	-+
105	- DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
106	- pc_i440fx_4_0_machine_options);
107	-
108	-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
109	-index 372c6b73be..37dd350511 100644
110	---- a/hw/i386/pc_q35.c
111	-+++ b/hw/i386/pc_q35.c
112	-@@ -365,12 +365,23 @@ static void pc_q35_machine_options(MachineClass *m)
113	- m->max_cpus = 288;
114	- }
115	-
116	--static void pc_q35_4_0_machine_options(MachineClass *m)
117	-+static void pc_q35_4_1_machine_options(MachineClass *m)
118	- {
119	- pc_q35_machine_options(m);
120	- m->alias = "q35";
121	- }
122	-
123	-+DEFINE_Q35_MACHINE(v4_1, "pc-q35-4.1", NULL,
124	-+ pc_q35_4_1_machine_options);
125	-+
126	-+static void pc_q35_4_0_machine_options(MachineClass *m)
127	-+{
128	-+ pc_q35_4_1_machine_options(m);
129	-+ m->alias = NULL;
130	-+ compat_props_add(m->compat_props, hw_compat_4_0, hw_compat_4_0_len);
131	-+ compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
132	-+}
133	-+
134	- DEFINE_Q35_MACHINE(v4_0, "pc-q35-4.0", NULL,
135	- pc_q35_4_0_machine_options);
136	-
137	-diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
138	-index b52b82d298..8438741ec2 100644
139	---- a/hw/ppc/spapr.c
140	-+++ b/hw/ppc/spapr.c
141	-@@ -4344,15 +4344,26 @@ static const TypeInfo spapr_machine_info = {
142	- } \
143	- type_init(spapr_machine_register_##suffix)
144	-
145	-+/*
146	-+ * pseries-4.1
147	-+ */
148	-+static void spapr_machine_4_1_class_options(MachineClass *mc)
149	-+{
150	-+ /* Defaults for the latest behaviour inherited from the base class */
151	-+}
152	-+
153	-+DEFINE_SPAPR_MACHINE(4_1, "4.1", true);
154	-+
155	- /*
156	- * pseries-4.0
157	- */
158	- static void spapr_machine_4_0_class_options(MachineClass *mc)
159	- {
160	-- /* Defaults for the latest behaviour inherited from the base class */
161	-+ spapr_machine_4_1_class_options(mc);
162	-+ compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
163	- }
164	-
165	--DEFINE_SPAPR_MACHINE(4_0, "4.0", true);
166	-+DEFINE_SPAPR_MACHINE(4_0, "4.0", false);
167	-
168	- /*
169	- * pseries-3.1
170	-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
171	-index d11069b860..02470e78c7 100644
172	---- a/hw/s390x/s390-virtio-ccw.c
173	-+++ b/hw/s390x/s390-virtio-ccw.c
174	-@@ -646,14 +646,26 @@ bool css_migration_enabled(void)
175	- } \
176	- type_init(ccw_machine_register_##suffix)
177	-
178	-+static void ccw_machine_4_1_instance_options(MachineState *machine)
179	-+{
180	-+}
181	-+
182	-+static void ccw_machine_4_1_class_options(MachineClass *mc)
183	-+{
184	-+}
185	-+DEFINE_CCW_MACHINE(4_1, "4.1", true);
186	-+
187	- static void ccw_machine_4_0_instance_options(MachineState *machine)
188	- {
189	-+ ccw_machine_4_1_instance_options(machine);
190	- }
191	-
192	- static void ccw_machine_4_0_class_options(MachineClass *mc)
193	- {
194	-+ ccw_machine_4_1_class_options(mc);
195	-+ compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
196	- }
197	--DEFINE_CCW_MACHINE(4_0, "4.0", true);
198	-+DEFINE_CCW_MACHINE(4_0, "4.0", false);
199	-
200	- static void ccw_machine_3_1_instance_options(MachineState *machine)
201	- {
202	-diff --git a/include/hw/boards.h b/include/hw/boards.h
203	-index e231860666..fe1885cbff 100644
204	---- a/include/hw/boards.h
205	-+++ b/include/hw/boards.h
206	-@@ -293,6 +293,9 @@ struct MachineState {
207	- } \
208	- type_init(machine_initfn##_register_types)
209	-
210	-+extern GlobalProperty hw_compat_4_0[];
211	-+extern const size_t hw_compat_4_0_len;
212	-+
213	- extern GlobalProperty hw_compat_3_1[];
214	- extern const size_t hw_compat_3_1_len;
215	-
216	-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
217	-index ca65ef18af..43df7230a2 100644
218	---- a/include/hw/i386/pc.h
219	-+++ b/include/hw/i386/pc.h
220	-@@ -293,6 +293,9 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
221	- int e820_get_num_entries(void);
222	- bool e820_get_entry(int, uint32_t, uint64_t , uint64_t );
223	-
224	-+extern GlobalProperty pc_compat_4_0[];
225	-+extern const size_t pc_compat_4_0_len;
226	-+
227	- extern GlobalProperty pc_compat_3_1[];
228	- extern const size_t pc_compat_3_1_len;
229	-
230	---
231	-2.19.1
232	-

Dhw-core-loader-Fix-possible-crash-in-rom_copy.patch+0-46

	@@ -1,46 +0,0 @@
1	-From 4f1c6cb2f9afafda05eab150fd2bd284edce6676 Mon Sep 17 00:00:00 2001
2	-From: Thomas Huth <thuth@redhat.com>
3	-Date: Wed, 25 Sep 2019 14:16:43 +0200
4	-Subject: [PATCH] hw/core/loader: Fix possible crash in rom_copy()
5	-
6	-Both, "rom->addr" and "addr" are derived from the binary image
7	-that can be loaded with the "-kernel" paramer. The code in
8	-rom_copy() then calculates:
9	-
10	- d = dest + (rom->addr - addr);
11	-
12	-and uses "d" as destination in a memcpy() some lines later. Now with
13	-bad kernel images, it is possible that rom->addr is smaller than addr,
14	-thus "rom->addr - addr" gets negative and the memcpy() then tries to
15	-copy contents from the image to a bad memory location. This could
16	-maybe be used to inject code from a kernel image into the QEMU binary,
17	-so we better fix it with an additional sanity check here.
18	-
19	-Cc: qemu-stable@nongnu.org
20	-Reported-by: Guangming Liu
21	-Buglink: https://bugs.launchpad.net/qemu/+bug/1844635
22	-Message-Id: <20190925130331.27825-1-thuth@redhat.com>
23	-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
24	-Signed-off-by: Thomas Huth <thuth@redhat.com>
25	-(cherry picked from commit e423455c4f23a1a828901c78fe6d03b7dde79319)
26	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
27	----
28	- hw/core/loader.c \| 2 +-
29	- 1 file changed, 1 insertion(+), 1 deletion(-)
30	-
31	-diff --git a/hw/core/loader.c b/hw/core/loader.c
32	-index fe5cb24122..4ef2095247 100644
33	---- a/hw/core/loader.c
34	-+++ b/hw/core/loader.c
35	-@@ -1240,7 +1240,7 @@ int rom_copy(uint8_t *dest, hwaddr addr, size_t size)
36	- if (rom->addr + rom->romsize < addr) {
37	- continue;
38	- }
39	-- if (rom->addr > end) {
40	-+ if (rom->addr > end \|\| rom->addr < addr) {
41	- break;
42	- }
43	-
44	---
45	-2.19.1
46	-

Di386-acpi-fix-gint-overflow-in-crs_range_compare.patch+0-54

	@@ -1,54 +0,0 @@
1	-From 21e2acd583126db94f6d881005cd58e835160582 Mon Sep 17 00:00:00 2001
2	-From: Evgeny Yakovlev <wrfsh@yandex-team.ru>
3	-Date: Thu, 18 Jul 2019 19:14:23 +0300
4	-Subject: [PATCH] i386/acpi: fix gint overflow in crs_range_compare
5	-
6	-When very large regions (32GB sized in our case, PCI pass-through of GPUs)
7	-are compared substraction result does not fit into gint.
8	-
9	-As a result crs_replace_with_free_ranges does not get sorted ranges and
10	-incorrectly computes PCI64 free space regions. Which then makes linux
11	-guest complain about device and PCI64 hole intersection and device
12	-becomes unusable.
13	-
14	-Fix that by returning exactly fitting ranges.
15	-
16	-Also fix indentation of an entire crs_replace_with_free_ranges to make
17	-checkpatch happy.
18	-
19	-Cc: qemu-stable@nongnu.org
20	-Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
21	-Message-Id: <1563466463-26012-1-git-send-email-wrfsh@yandex-team.ru>
22	-Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
23	-(cherry-picked from commit 21e2acd583126db94f6d881005cd58e835160582)
24	----
25	- hw/i386/acpi-build.c \| 12 +++++++++---
26	- 1 file changed, 9 insertions(+), 3 deletions(-)
27	-
28	-diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
29	-index d281ffa89e..e7b756b51b 100644
30	---- a/hw/i386/acpi-build.c
31	-+++ b/hw/i386/acpi-build.c
32	-@@ -755,10 +755,16 @@ static void crs_range_set_free(CrsRangeSet *range_set)
33	-
34	- static gint crs_range_compare(gconstpointer a, gconstpointer b)
35	- {
36	-- CrsRangeEntry entry_a = (CrsRangeEntry **)a;
37	-- CrsRangeEntry entry_b = (CrsRangeEntry **)b;
38	-+ CrsRangeEntry entry_a = (CrsRangeEntry **)a;
39	-+ CrsRangeEntry entry_b = (CrsRangeEntry **)b;
40	-
41	-- return (int64_t)entry_a->base - (int64_t)entry_b->base;
42	-+ if (entry_a->base < entry_b->base) {
43	-+ return -1;
44	-+ } else if (entry_a->base > entry_b->base) {
45	-+ return 1;
46	-+ } else {
47	-+ return 0;
48	-+ }
49	- }
50	-
51	- /*
52	---
53	-2.19.1
54	-

Di386-acpi-show-PCI-Express-bus-on-pxb-pcie-expanders.patch+0-40

	@@ -1,40 +0,0 @@
1	-From ee4b0c8686f781987879508d7c6dd605b5435bac Mon Sep 17 00:00:00 2001
2	-From: Evgeny Yakovlev <wrfsh@yandex-team.ru>
3	-Date: Fri, 19 Jul 2019 11:54:29 +0300
4	-Subject: [PATCH] i386/acpi: show PCI Express bus on pxb-pcie expanders
5	-
6	-Show PCIe host bridge PNP id with PCI host bridge as a compatible id
7	-when expanding a pcie bus.
8	-
9	-Cc: qemu-stable@nongnu.org
10	-Signed-off-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
11	-Message-Id: <1563526469-15588-1-git-send-email-wrfsh@yandex-team.ru>
12	-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
13	-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
14	-(cherry-picked from commit ee4b0c8686f781987879508d7c6dd605b5435bac)
15	----
16	- hw/i386/acpi-build.c \| 5 ++++-
17	- 1 file changed, 4 insertions(+), 1 deletion(-)
18	-
19	-diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
20	-index e7b756b51b..f3fdfefcd5 100644
21	---- a/hw/i386/acpi-build.c
22	-+++ b/hw/i386/acpi-build.c
23	-@@ -1914,10 +1914,13 @@ build_dsdt(GArray table_data, BIOSLinker linker,
24	- scope = aml_scope("\\_SB");
25	- dev = aml_device("PC%.02X", bus_num);
26	- aml_append(dev, aml_name_decl("_UID", aml_int(bus_num)));
27	-- aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
28	- aml_append(dev, aml_name_decl("_BBN", aml_int(bus_num)));
29	- if (pci_bus_is_express(bus)) {
30	-+ aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
31	-+ aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
32	- aml_append(dev, build_q35_osc_method());
33	-+ } else {
34	-+ aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
35	- }
36	-
37	- if (numa_node != NUMA_NODE_UNASSIGNED) {
38	---
39	-2.19.1
40	-

Dioapic-kvm-Skip-route-updates-for-masked-pins.patch+0-46

	@@ -1,46 +0,0 @@
1	-From be1927c97e564346cbd409cb17fe611df74b84e5 Mon Sep 17 00:00:00 2001
2	-From: Jan Kiszka <jan.kiszka@siemens.com>
3	-Date: Sun, 2 Jun 2019 13:42:13 +0200
4	-Subject: [PATCH] ioapic: kvm: Skip route updates for masked pins
5	-
6	-Masked entries will not generate interrupt messages, thus do no need to
7	-be routed by KVM. This is a cosmetic cleanup, just avoiding warnings of
8	-the kind
9	-
10	-qemu-system-x86_64: vtd_irte_get: detected non-present IRTE (index=0, high=0xff00, low=0x100)
11	-
12	-if the masked entry happens to reference a non-present IRTE.
13	-
14	-Cc: qemu-stable@nongnu.org
15	-Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
16	-Message-Id: <a84b7e03-f9a8-b577-be27-4d93d1caa1c9@siemens.com>
17	-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
18	-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
19	-Reviewed-by: Peter Xu <peterx@redhat.com>
20	-(cherry-picked from commit be1927c97e564346cbd409cb17fe611df74b84e5)
21	----
22	- hw/intc/ioapic.c \| 8 +++++---
23	- 1 file changed, 5 insertions(+), 3 deletions(-)
24	-
25	-diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
26	-index c408749876..e99c37cceb 100644
27	---- a/hw/intc/ioapic.c
28	-+++ b/hw/intc/ioapic.c
29	-@@ -197,9 +197,11 @@ static void ioapic_update_kvm_routes(IOAPICCommonState *s)
30	- MSIMessage msg;
31	- struct ioapic_entry_info info;
32	- ioapic_entry_parse(s->ioredtbl[i], &info);
33	-- msg.address = info.addr;
34	-- msg.data = info.data;
35	-- kvm_irqchip_update_msi_route(kvm_state, i, msg, NULL);
36	-+ if (!info.masked) {
37	-+ msg.address = info.addr;
38	-+ msg.data = info.data;
39	-+ kvm_irqchip_update_msi_route(kvm_state, i, msg, NULL);
40	-+ }
41	- }
42	- kvm_irqchip_commit_routes(kvm_state);
43	- }
44	---
45	-2.19.1
46	-

Aiscsi-Cap-block-count-from-GET-LBA-STATUS-CVE-2020-1.patch+58-0

@@ -0,0 +1,58 @@
	1	+From 693fd2acdf14dd86c0bf852610f1c2cca80a74dc Mon Sep 17 00:00:00 2001
	2	+From: Felipe Franciosi <felipe@nutanix.com>
	3	+Date: Thu, 23 Jan 2020 12:44:59 +0000
	4	+Subject: [PATCH] iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
	5	+
	6	+When querying an iSCSI server for the provisioning status of blocks (via
	7	+GET LBA STATUS), Qemu only validates that the response descriptor zero's
	8	+LBA matches the one requested. Given the SCSI spec allows servers to
	9	+respond with the status of blocks beyond the end of the LUN, Qemu may
	10	+have its heap corrupted by clearing/setting too many bits at the end of
	11	+its allocmap for the LUN.
	12	+
	13	+A malicious guest in control of the iSCSI server could carefully program
	14	+Qemu's heap (by selectively setting the bitmap) and then smash it.
	15	+
	16	+This limits the number of bits that iscsi_co_block_status() will try to
	17	+update in the allocmap so it can't overflow the bitmap.
	18	+
	19	+Fixes: CVE-2020-1711
	20	+Cc: qemu-stable@nongnu.org
	21	+Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
	22	+Signed-off-by: Peter Turschmid <peter.turschm@nutanix.com>
	23	+Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
	24	+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
	25	+
	26	+diff --git a/block/iscsi.c b/block/iscsi.c
	27	+index 2aea7e3f13..cbd57294ab 100644
	28	+--- a/block/iscsi.c
	29	++++ b/block/iscsi.c
	30	+@@ -701,7 +701,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
	31	+ struct scsi_get_lba_status *lbas = NULL;
	32	+ struct scsi_lba_status_descriptor *lbasd = NULL;
	33	+ struct IscsiTask iTask;
	34	+- uint64_t lba;
	35	++ uint64_t lba, max_bytes;
	36	+ int ret;
	37	+
	38	+ iscsi_co_init_iscsitask(iscsilun, &iTask);
	39	+@@ -721,6 +721,7 @@ static int coroutine_fn iscsi_co_block_status(BlockDriverState *bs,
	40	+ }
	41	+
	42	+ lba = offset / iscsilun->block_size;
	43	++ max_bytes = (iscsilun->num_blocks - lba) * iscsilun->block_size;
	44	+
	45	+ qemu_mutex_lock(&iscsilun->mutex);
	46	+ retry:
	47	+@@ -764,7 +765,7 @@ retry:
	48	+ goto out_unlock;
	49	+ }
	50	+
	51	+- pnum = (int64_t) lbasd->num_blocks iscsilun->block_size;
	52	++ pnum = MIN((int64_t) lbasd->num_blocks iscsilun->block_size, max_bytes);
	53	+
	54	+ if (lbasd->provisioning == SCSI_PROVISIONING_TYPE_DEALLOCATED \|\|
	55	+ lbasd->provisioning == SCSI_PROVISIONING_TYPE_ANCHORED) {
	56	+--
	57	+2.21.1 (Apple Git-122.3)
	58	+

Dkbd-state-fix-autorepeat-handling.patch+0-40

	@@ -1,40 +0,0 @@
1	-From 5fff13f245cddd3bc260dfe6ebe1b1f05b72116f Mon Sep 17 00:00:00 2001
2	-From: Gerd Hoffmann <kraxel@redhat.com>
3	-Date: Tue, 14 May 2019 06:24:43 +0200
4	-Subject: [PATCH] kbd-state: fix autorepeat handling
5	-
6	-When allowing multiple down-events in a row (key autorepeat) we can't
7	-use change_bit() any more to update the state, because autorepeat events
8	-don't change the key state. We have to explicitly use set_bit() and
9	-clear_bit() instead.
10	-
11	-Cc: qemu-stable@nongnu.org
12	-Fixes: 35921860156e kbd-state: don't block auto-repeat events
13	-Buglink: https://bugs.launchpad.net/qemu/+bug/1828272
14	-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
15	-Message-id: 20190514042443.10735-1-kraxel@redhat.com
16	-(cherry-picked from commit 5fff13f245cddd3bc260dfe6ebe1b1f05b72116f)
17	----
18	- ui/kbd-state.c \| 6 +++++-
19	- 1 file changed, 5 insertions(+), 1 deletion(-)
20	-
21	-diff --git a/ui/kbd-state.c b/ui/kbd-state.c
22	-index f3ab2d7a66..1668d17dda 100644
23	---- a/ui/kbd-state.c
24	-+++ b/ui/kbd-state.c
25	-@@ -59,7 +59,11 @@ void qkbd_state_key_event(QKbdState *kbd, QKeyCode qcode, bool down)
26	- }
27	-
28	- /* update key and modifier state */
29	-- change_bit(qcode, kbd->keys);
30	-+ if (down) {
31	-+ set_bit(qcode, kbd->keys);
32	-+ } else {
33	-+ clear_bit(qcode, kbd->keys);
34	-+ }
35	- switch (qcode) {
36	- case Q_KEY_CODE_SHIFT:
37	- case Q_KEY_CODE_SHIFT_R:
38	---
39	-2.19.1
40	-

Dmegasas-fix-mapped-frame-size.patch+0-35

	@@ -1,35 +0,0 @@
1	-From 2e56fbc87f6ec3cd56c37b01d313abd502b80d61 Mon Sep 17 00:00:00 2001
2	-From: Peter Lieven <pl@kamp.de>
3	-Date: Thu, 4 Apr 2019 14:10:15 +0200
4	-Subject: [PATCH] megasas: fix mapped frame size
5	-
6	-the current value of 1024 bytes (16 * MFI_FRAME_SIZE) we map is not enough to hold
7	-the maximum number of scatter gather elements we advertise. We actually need a
8	-maximum of 2048 bytes. This is 128 max sg elements * 16 bytes (sizeof (union mfi_sgl)).
9	-
10	-Cc: qemu-stable@nongnu.org
11	-Signed-off-by: Peter Lieven <pl@kamp.de>
12	-Message-Id: <20190404121015.28634-1-pl@kamp.de>
13	-Reviewed-by: Hannes Reinecke <hare@suse.com>
14	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
15	-(cherry-picked from commit 2e56fbc87f6ec3cd56c37b01d313abd502b80d61)
16	----
17	- hw/scsi/megasas.c \| 2 +-
18	- 1 file changed, 1 insertion(+), 1 deletion(-)
19	-
20	-diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
21	-index a56317e026..5ad762de23 100644
22	---- a/hw/scsi/megasas.c
23	-+++ b/hw/scsi/megasas.c
24	-@@ -477,7 +477,7 @@ static MegasasCmd megasas_enqueue_frame(MegasasState s,
25	- {
26	- PCIDevice *pcid = PCI_DEVICE(s);
27	- MegasasCmd *cmd = NULL;
28	-- int frame_size = MFI_FRAME_SIZE * 16;
29	-+ int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl);
30	- hwaddr frame_size_p = frame_size;
31	- unsigned long index;
32	-
33	---
34	-2.19.1
35	-

Dmigration-Fix-use-after-free-during-process-exit.patch+0-205

	@@ -1,205 +0,0 @@
1	-From 35d6458d6a100b2f15a7e079558a4570742c6e5a Mon Sep 17 00:00:00 2001
2	-From: Yury Kotov <yury-kotov@yandex-team.ru>
3	-Date: Mon, 8 Apr 2019 14:33:43 +0300
4	-Subject: [PATCH] migration: Fix use-after-free during process exit
5	-
6	-It fixes heap-use-after-free which was found by clang's ASAN.
7	-
8	-Control flow of this use-after-free:
9	-main_thread:
10	- * Got SIGTERM and completes main loop
11	- * Calls migration_shutdown
12	- - migrate_fd_cancel (so, migration_thread begins to complete)
13	- - object_unref(OBJECT(current_migration));
14	-
15	-migration_thread:
16	- * migration_iteration_finish -> schedule cleanup bh
17	- * object_unref(OBJECT(s)); (Now, current_migration is freed)
18	- * exits
19	-
20	-main_thread:
21	- * Calls vm_shutdown -> drain bdrvs -> main loop
22	- -> cleanup_bh -> use after free
23	-
24	-If you want to reproduce, these couple of sleeps will help:
25	-vl.c:4613:
26	- migration_shutdown();
27	-+ sleep(2);
28	-migration.c:3269:
29	-+ sleep(1);
30	- trace_migration_thread_after_loop();
31	- migration_iteration_finish(s);
32	-
33	-Original output:
34	-qemu-system-x86_64: terminating on signal 15 from pid 31980 (<unknown process>)
35	-=================================================================
36	-==31958==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900001d210
37	- at pc 0x555558a535ca bp 0x7fffffffb190 sp 0x7fffffffb188
38	-READ of size 8 at 0x61900001d210 thread T0 (qemu-vm-0)
39	- #0 0x555558a535c9 in migrate_fd_cleanup migration/migration.c:1502:23
40	- #1 0x5555594fde0a in aio_bh_call util/async.c:90:5
41	- #2 0x5555594fe522 in aio_bh_poll util/async.c:118:13
42	- #3 0x555559524783 in aio_poll util/aio-posix.c:725:17
43	- #4 0x555559504fb3 in aio_wait_bh_oneshot util/aio-wait.c:71:5
44	- #5 0x5555573bddf6 in virtio_blk_data_plane_stop
45	- hw/block/dataplane/virtio-blk.c:282:5
46	- #6 0x5555589d5c09 in virtio_bus_stop_ioeventfd hw/virtio/virtio-bus.c:246:9
47	- #7 0x5555589e9917 in virtio_pci_stop_ioeventfd hw/virtio/virtio-pci.c:287:5
48	- #8 0x5555589e22bf in virtio_pci_vmstate_change hw/virtio/virtio-pci.c:1072:9
49	- #9 0x555557628931 in virtio_vmstate_change hw/virtio/virtio.c:2257:9
50	- #10 0x555557c36713 in vm_state_notify vl.c:1605:9
51	- #11 0x55555716ef53 in do_vm_stop cpus.c:1074:9
52	- #12 0x55555716eeff in vm_shutdown cpus.c:1092:12
53	- #13 0x555557c4283e in main vl.c:4617:5
54	- #14 0x7fffdfdb482f in __libc_start_main
55	- (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
56	- #15 0x555556ecb118 in _start (x86_64-softmmu/qemu-system-x86_64+0x1977118)
57	-
58	-0x61900001d210 is located 144 bytes inside of 952-byte region
59	- [0x61900001d180,0x61900001d538)
60	-freed by thread T6 (live_migration) here:
61	- #0 0x555556f76782 in __interceptor_free
62	- /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
63	- #1 0x555558d5fa94 in object_finalize qom/object.c:618:9
64	- #2 0x555558d57651 in object_unref qom/object.c:1068:9
65	- #3 0x555558a55588 in migration_thread migration/migration.c:3272:5
66	- #4 0x5555595393f2 in qemu_thread_start util/qemu-thread-posix.c:502:9
67	- #5 0x7fffe057f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
68	-
69	-previously allocated by thread T0 (qemu-vm-0) here:
70	- #0 0x555556f76b03 in __interceptor_malloc
71	- /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146:3
72	- #1 0x7ffff6ee37b8 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f7b8)
73	- #2 0x555558d58031 in object_new qom/object.c:640:12
74	- #3 0x555558a31f21 in migration_object_init migration/migration.c:139:25
75	- #4 0x555557c41398 in main vl.c:4320:5
76	- #5 0x7fffdfdb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
77	-
78	-Thread T6 (live_migration) created by T0 (qemu-vm-0) here:
79	- #0 0x555556f5f0dd in pthread_create
80	- /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
81	- #1 0x555559538cf9 in qemu_thread_create util/qemu-thread-posix.c:539:11
82	- #2 0x555558a53304 in migrate_fd_connect migration/migration.c:3332:5
83	- #3 0x555558a72bd8 in migration_channel_connect migration/channel.c:92:5
84	- #4 0x555558a6ef87 in exec_start_outgoing_migration migration/exec.c:42:5
85	- #5 0x555558a4f3c2 in qmp_migrate migration/migration.c:1922:9
86	- #6 0x555558bb4f6a in qmp_marshal_migrate qapi/qapi-commands-migration.c:607:5
87	- #7 0x555559363738 in do_qmp_dispatch qapi/qmp-dispatch.c:131:5
88	- #8 0x555559362a15 in qmp_dispatch qapi/qmp-dispatch.c:174:11
89	- #9 0x5555571bac15 in monitor_qmp_dispatch monitor.c:4124:11
90	- #10 0x55555719a22d in monitor_qmp_bh_dispatcher monitor.c:4207:9
91	- #11 0x5555594fde0a in aio_bh_call util/async.c:90:5
92	- #12 0x5555594fe522 in aio_bh_poll util/async.c:118:13
93	- #13 0x5555595201e0 in aio_dispatch util/aio-posix.c:460:5
94	- #14 0x555559503553 in aio_ctx_dispatch util/async.c:261:5
95	- #15 0x7ffff6ede196 in g_main_context_dispatch
96	- (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a196)
97	-
98	-SUMMARY: AddressSanitizer: heap-use-after-free migration/migration.c:1502:23
99	- in migrate_fd_cleanup
100	-Shadow bytes around the buggy address:
101	- 0x0c327fffb9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
102	- 0x0c327fffba00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
103	- 0x0c327fffba10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
104	- 0x0c327fffba20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
105	- 0x0c327fffba30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
106	-=>0x0c327fffba40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
107	- 0x0c327fffba50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
108	- 0x0c327fffba60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
109	- 0x0c327fffba70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
110	- 0x0c327fffba80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
111	- 0x0c327fffba90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
112	-Shadow byte legend (one shadow byte represents 8 application bytes):
113	- Addressable: 00
114	- Partially addressable: 01 02 03 04 05 06 07
115	- Heap left redzone: fa
116	- Freed heap region: fd
117	- Stack left redzone: f1
118	- Stack mid redzone: f2
119	- Stack right redzone: f3
120	- Stack after return: f5
121	- Stack use after scope: f8
122	- Global redzone: f9
123	- Global init order: f6
124	- Poisoned by user: f7
125	- Container overflow: fc
126	- Array cookie: ac
127	- Intra object redzone: bb
128	- ASan internal: fe
129	- Left alloca redzone: ca
130	- Right alloca redzone: cb
131	- Shadow gap: cc
132	-==31958==ABORTING
133	-
134	-Signed-off-by: Yury Kotov <yury-kotov@yandex-team.ru>
135	-Message-Id: <20190408113343.2370-1-yury-kotov@yandex-team.ru>
136	-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
137	-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
138	- Fixed up comment formatting
139	-(cherry picked from commit fd392cfa8e6fb0dc34bd0327fc356dfbf6edf1fd)
140	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
141	----
142	- migration/migration.c \| 25 ++++++++++++++++++++-----
143	- 1 file changed, 20 insertions(+), 5 deletions(-)
144	-
145	-diff --git a/migration/migration.c b/migration/migration.c
146	-index 609e0df5d0..2f617b9dba 100644
147	---- a/migration/migration.c
148	-+++ b/migration/migration.c
149	-@@ -1495,10 +1495,8 @@ static void block_cleanup_parameters(MigrationState *s)
150	- }
151	- }
152	-
153	--static void migrate_fd_cleanup(void *opaque)
154	-+static void migrate_fd_cleanup(MigrationState *s)
155	- {
156	-- MigrationState *s = opaque;
157	--
158	- qemu_bh_delete(s->cleanup_bh);
159	- s->cleanup_bh = NULL;
160	-
161	-@@ -1543,6 +1541,23 @@ static void migrate_fd_cleanup(void *opaque)
162	- block_cleanup_parameters(s);
163	- }
164	-
165	-+static void migrate_fd_cleanup_schedule(MigrationState *s)
166	-+{
167	-+ /*
168	-+ * Ref the state for bh, because it may be called when
169	-+ * there're already no other refs
170	-+ */
171	-+ object_ref(OBJECT(s));
172	-+ qemu_bh_schedule(s->cleanup_bh);
173	-+}
174	-+
175	-+static void migrate_fd_cleanup_bh(void *opaque)
176	-+{
177	-+ MigrationState *s = opaque;
178	-+ migrate_fd_cleanup(s);
179	-+ object_unref(OBJECT(s));
180	-+}
181	-+
182	- void migrate_set_error(MigrationState s, const Error error)
183	- {
184	- qemu_mutex_lock(&s->error_mutex);
185	-@@ -3144,7 +3159,7 @@ static void migration_iteration_finish(MigrationState *s)
186	- error_report("%s: Unknown ending state %d", __func__, s->state);
187	- break;
188	- }
189	-- qemu_bh_schedule(s->cleanup_bh);
190	-+ migrate_fd_cleanup_schedule(s);
191	- qemu_mutex_unlock_iothread();
192	- }
193	-
194	-@@ -3279,7 +3294,7 @@ void migrate_fd_connect(MigrationState s, Error error_in)
195	- bool resume = s->state == MIGRATION_STATUS_POSTCOPY_PAUSED;
196	-
197	- s->expected_downtime = s->parameters.downtime_limit;
198	-- s->cleanup_bh = qemu_bh_new(migrate_fd_cleanup, s);
199	-+ s->cleanup_bh = qemu_bh_new(migrate_fd_cleanup_bh, s);
200	- if (error_in) {
201	- migrate_fd_error(s, error_in);
202	- migrate_fd_cleanup(s);
203	---
204	-2.19.1
205	-

Dmigration-dirty-bitmaps-change-bitmap-enumeration-method.patch+0-83

	@@ -1,83 +0,0 @@
1	-From 3a87d07722d4be717a97b59cfbc7b2ba27ca30b0 Mon Sep 17 00:00:00 2001
2	-From: John Snow <jsnow@redhat.com>
3	-Date: Tue, 28 May 2019 19:33:31 -0400
4	-Subject: [PATCH] migration/dirty-bitmaps: change bitmap enumeration method
5	-MIME-Version: 1.0
6	-Content-Type: text/plain; charset=UTF-8
7	-Content-Transfer-Encoding: 8bit
8	-
9	-Shift from looking at every root BDS to every BDS. This will migrate
10	-bitmaps that are attached to blockdev created nodes instead of just ones
11	-attached to emulated storage devices.
12	-
13	-Note that this will not migrate anonymous or internal-use bitmaps, as
14	-those are defined as having no name.
15	-
16	-This will also fix the Coverity issues Peter Maydell has been asking
17	-about for the past several releases, as well as fixing a real bug.
18	-
19	-Reported-by: Peter Maydell <peter.maydell@linaro.org>
20	-Reported-by: Coverity 😅
21	-Reported-by: aihua liang <aliang@redhat.com>
22	-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
23	-Signed-off-by: John Snow <jsnow@redhat.com>
24	-Message-id: 20190514201926.10407-1-jsnow@redhat.com
25	-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1652490
26	-Fixes: Coverity CID 1390625
27	-CC: Stefan Hajnoczi <stefanha@redhat.com>
28	-Signed-off-by: John Snow <jsnow@redhat.com>
29	-(cherry picked from commit 592203e7cfbd1ad261178431fcf390adfe8b16df)
30	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
31	----
32	- migration/block-dirty-bitmap.c \| 14 ++++----------
33	- 1 file changed, 4 insertions(+), 10 deletions(-)
34	-
35	-diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
36	-index d1bb863cb6..4a896a09eb 100644
37	---- a/migration/block-dirty-bitmap.c
38	-+++ b/migration/block-dirty-bitmap.c
39	-@@ -273,7 +273,6 @@ static int init_dirty_bitmap_migration(void)
40	- BlockDriverState *bs;
41	- BdrvDirtyBitmap *bitmap;
42	- DirtyBitmapMigBitmapState *dbms;
43	-- BdrvNextIterator it;
44	- Error *local_err = NULL;
45	-
46	- dirty_bitmap_mig_state.bulk_completed = false;
47	-@@ -281,13 +280,8 @@ static int init_dirty_bitmap_migration(void)
48	- dirty_bitmap_mig_state.prev_bitmap = NULL;
49	- dirty_bitmap_mig_state.no_bitmaps = false;
50	-
51	-- for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
52	-- const char *drive_name = bdrv_get_device_or_node_name(bs);
53	--
54	-- /* skip automatically inserted nodes */
55	-- while (bs && bs->drv && bs->implicit) {
56	-- bs = backing_bs(bs);
57	-- }
58	-+ for (bs = bdrv_next_all_states(NULL); bs; bs = bdrv_next_all_states(bs)) {
59	-+ const char *name = bdrv_get_device_or_node_name(bs);
60	-
61	- for (bitmap = bdrv_dirty_bitmap_next(bs, NULL); bitmap;
62	- bitmap = bdrv_dirty_bitmap_next(bs, bitmap))
63	-@@ -296,7 +290,7 @@ static int init_dirty_bitmap_migration(void)
64	- continue;
65	- }
66	-
67	-- if (drive_name == NULL) {
68	-+ if (!name \|\| strcmp(name, "") == 0) {
69	- error_report("Found bitmap '%s' in unnamed node %p. It can't "
70	- "be migrated", bdrv_dirty_bitmap_name(bitmap), bs);
71	- goto fail;
72	-@@ -313,7 +307,7 @@ static int init_dirty_bitmap_migration(void)
73	-
74	- dbms = g_new0(DirtyBitmapMigBitmapState, 1);
75	- dbms->bs = bs;
76	-- dbms->node_name = drive_name;
77	-+ dbms->node_name = name;
78	- dbms->bitmap = bitmap;
79	- dbms->total_sectors = bdrv_nb_sectors(bs);
80	- dbms->sectors_per_chunk = CHUNK_SIZE * 8 *
81	---
82	-2.19.1
83	-

Dmirror-Only-mirror-granularity-aligned-chunks.patch+0-84

	@@ -1,84 +0,0 @@
1	-From d65d02614b6b0f6bcc64cd2a737b5204c0fc5304 Mon Sep 17 00:00:00 2001
2	-From: Max Reitz <mreitz@redhat.com>
3	-Date: Mon, 5 Aug 2019 17:33:08 +0200
4	-Subject: [PATCH] mirror: Only mirror granularity-aligned chunks
5	-
6	-In write-blocking mode, all writes to the top node directly go to the
7	-target. We must only mirror chunks of data that are aligned to the
8	-job's granularity, because that is how the dirty bitmap works.
9	-Therefore, the request alignment for writes must be the job's
10	-granularity (in write-blocking mode).
11	-
12	-Unfortunately, this forces all reads and writes to have the same
13	-granularity (we only need this alignment for writes to the target, not
14	-the source), but that is something to be fixed another time.
15	-
16	-Cc: qemu-stable@nongnu.org
17	-Signed-off-by: Max Reitz <mreitz@redhat.com>
18	-Message-id: 20190805153308.2657-1-mreitz@redhat.com
19	-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
20	-Fixes: d06107ade0ce74dc39739bac80de84b51ec18546
21	-Signed-off-by: Max Reitz <mreitz@redhat.com>
22	-(cherry picked from commit 9adc1cb49af8d4e54f57980b1eed5c0a4b2dafa6)
23	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
24	----
25	- block/mirror.c \| 29 +++++++++++++++++++++++++++++
26	- 1 file changed, 29 insertions(+)
27	-
28	-diff --git a/block/mirror.c b/block/mirror.c
29	-index ff15cfb197..062dc42867 100644
30	---- a/block/mirror.c
31	-+++ b/block/mirror.c
32	-@@ -1477,6 +1477,15 @@ static void bdrv_mirror_top_child_perm(BlockDriverState bs, BdrvChild c,
33	- *nshared = BLK_PERM_ALL;
34	- }
35	-
36	-+static void bdrv_mirror_top_refresh_limits(BlockDriverState bs, Error *errp)
37	-+{
38	-+ MirrorBDSOpaque *s = bs->opaque;
39	-+
40	-+ if (s && s->job && s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING) {
41	-+ bs->bl.request_alignment = s->job->granularity;
42	-+ }
43	-+}
44	-+
45	- /* Dummy node that provides consistent read to its users without requiring it
46	- * from its backing file and that allows writes on the backing file chain. */
47	- static BlockDriver bdrv_mirror_top = {
48	-@@ -1489,6 +1498,7 @@ static BlockDriver bdrv_mirror_top = {
49	- .bdrv_co_block_status = bdrv_co_block_status_from_backing,
50	- .bdrv_refresh_filename = bdrv_mirror_top_refresh_filename,
51	- .bdrv_child_perm = bdrv_mirror_top_child_perm,
52	-+ .bdrv_refresh_limits = bdrv_mirror_top_refresh_limits,
53	- };
54	-
55	- static void mirror_start_job(const char job_id, BlockDriverState bs,
56	-@@ -1627,6 +1637,25 @@ static void mirror_start_job(const char job_id, BlockDriverState bs,
57	- s->should_complete = true;
58	- }
59	-
60	-+ /*
61	-+ * Must be called before we start tracking writes, but after
62	-+ *
63	-+ * ((MirrorBlockJob *)
64	-+ * ((MirrorBDSOpaque *)
65	-+ * mirror_top_bs->opaque
66	-+ * )->job
67	-+ * )->copy_mode
68	-+ *
69	-+ * has the correct value.
70	-+ * (We start tracking writes as of the following
71	-+ * bdrv_create_dirty_bitmap() call.)
72	-+ */
73	-+ bdrv_refresh_limits(mirror_top_bs, &local_err);
74	-+ if (local_err) {
75	-+ error_propagate(errp, local_err);
76	-+ goto fail;
77	-+ }
78	-+
79	- s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, NULL, errp);
80	- if (!s->dirty_bitmap) {
81	- goto fail;
82	---
83	-2.19.1
84	-

Dpr-manager-Fix-invalid-g_free-crash-bug.patch+0-40

	@@ -1,40 +0,0 @@
1	-From 83f9b84c8bcb24265e25cd7f22e971e81cacebc6 Mon Sep 17 00:00:00 2001
2	-From: Markus Armbruster <armbru@redhat.com>
3	-Date: Thu, 22 Aug 2019 15:38:46 +0200
4	-Subject: [PATCH] pr-manager: Fix invalid g_free() crash bug
5	-MIME-Version: 1.0
6	-Content-Type: text/plain; charset=UTF-8
7	-Content-Transfer-Encoding: 8bit
8	-
9	-pr_manager_worker() passes its @opaque argument to g_free(). Wrong;
10	-it points to pr_manager_worker()'s automatic @data. Broken when
11	-commit 2f3a7ab39be converted @data from heap- to stack-allocated. Fix
12	-by deleting the g_free().
13	-
14	-Fixes: 2f3a7ab39bec4ba8022dc4d42ea641165b004e3e
15	-Cc: qemu-stable@nongnu.org
16	-Signed-off-by: Markus Armbruster <armbru@redhat.com>
17	-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
18	-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
19	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
20	-(cherry picked from commit 6b9d62c2a9e83bbad73fb61406f0ff69b46ff6f3)
21	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
22	----
23	- scsi/pr-manager.c \| 1 -
24	- 1 file changed, 1 deletion(-)
25	-
26	-diff --git a/scsi/pr-manager.c b/scsi/pr-manager.c
27	-index d9f4e8c3ad..227bdfaad2 100644
28	---- a/scsi/pr-manager.c
29	-+++ b/scsi/pr-manager.c
30	-@@ -38,7 +38,6 @@ static int pr_manager_worker(void *opaque)
31	- int fd = data->fd;
32	- int r;
33	-
34	-- g_free(data);
35	- trace_pr_manager_run(fd, hdr->cmdp[0], hdr->cmdp[1]);
36	-
37	- /* The reference was taken in pr_manager_execute. */
38	---
39	-2.19.1
40	-

Dq35-Revert-to-kernel-irqchip.patch+0-132

	@@ -1,132 +0,0 @@
1	-From c87759ce876a7a0b17c2bf4f0b964bd51f0ee871 Mon Sep 17 00:00:00 2001
2	-From: Alex Williamson <alex.williamson@redhat.com>
3	-Date: Tue, 14 May 2019 14:14:41 -0600
4	-Subject: [PATCH] q35: Revert to kernel irqchip
5	-
6	-Commit b2fc91db8447 ("q35: set split kernel irqchip as default") changed
7	-the default for the pc-q35-4.0 machine type to use split irqchip, which
8	-turned out to have disasterous effects on vfio-pci INTx support. KVM
9	-resampling irqfds are registered for handling these interrupts, but
10	-these are non-functional in split irqchip mode. We can't simply test
11	-for split irqchip in QEMU as userspace handling of this interrupt is a
12	-significant performance regression versus KVM handling (GeForce GPUs
13	-assigned to Windows VMs are non-functional without forcing MSI mode or
14	-re-enabling kernel irqchip).
15	-
16	-The resolution is to revert the change in default irqchip mode in the
17	-pc-q35-4.1 machine and create a pc-q35-4.0.1 machine for the 4.0-stable
18	-branch. The qemu-q35-4.0 machine type should not be used in vfio-pci
19	-configurations for devices requiring legacy INTx support without
20	-explicitly modifying the VM configuration to use kernel irqchip.
21	-
22	-Link: https://bugs.launchpad.net/qemu/+bug/1826422
23	-Fixes: b2fc91db8447 ("q35: set split kernel irqchip as default")
24	-Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
25	-Reviewed-by: Peter Xu <peterx@redhat.com>
26	-Message-Id: <155786484688.13873.6037015630912983760.stgit@gimli.home>
27	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
28	-(cherry-picked from commit c87759ce876a7a0b17c2bf4f0b964bd51f0ee871)
29	----
30	- hw/core/machine.c \| 3 +++
31	- hw/i386/pc.c \| 3 +++
32	- hw/i386/pc_q35.c \| 16 ++++++++++++++--
33	- include/hw/boards.h \| 3 +++
34	- include/hw/i386/pc.h \| 3 +++
35	- 5 files changed, 26 insertions(+), 2 deletions(-)
36	-
37	-diff --git a/hw/core/machine.c b/hw/core/machine.c
38	-index 16ba667434..f1a0f45f9c 100644
39	---- a/hw/core/machine.c
40	-+++ b/hw/core/machine.c
41	-@@ -24,6 +24,9 @@
42	- #include "hw/pci/pci.h"
43	- #include "hw/mem/nvdimm.h"
44	-
45	-+GlobalProperty hw_compat_4_0_1[] = {};
46	-+const size_t hw_compat_4_0_1_len = G_N_ELEMENTS(hw_compat_4_0_1);
47	-+
48	- GlobalProperty hw_compat_4_0[] = {};
49	- const size_t hw_compat_4_0_len = G_N_ELEMENTS(hw_compat_4_0);
50	-
51	-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
52	-index 2632b73f80..edc240bcbf 100644
53	---- a/hw/i386/pc.c
54	-+++ b/hw/i386/pc.c
55	-@@ -110,6 +110,9 @@ struct hpet_fw_config hpet_cfg = {.count = UINT8_MAX};
56	- /* Physical Address of PVH entry point read from kernel ELF NOTE */
57	- static size_t pvh_start_addr;
58	-
59	-+GlobalProperty pc_compat_4_0_1[] = {};
60	-+const size_t pc_compat_4_0_1_len = G_N_ELEMENTS(pc_compat_4_0_1);
61	-+
62	- GlobalProperty pc_compat_4_0[] = {};
63	- const size_t pc_compat_4_0_len = G_N_ELEMENTS(pc_compat_4_0);
64	-
65	-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
66	-index 37dd350511..dcddc64662 100644
67	---- a/hw/i386/pc_q35.c
68	-+++ b/hw/i386/pc_q35.c
69	-@@ -357,7 +357,7 @@ static void pc_q35_machine_options(MachineClass *m)
70	- m->units_per_default_bus = 1;
71	- m->default_machine_opts = "firmware=bios-256k.bin";
72	- m->default_display = "std";
73	-- m->default_kernel_irqchip_split = true;
74	-+ m->default_kernel_irqchip_split = false;
75	- m->no_floppy = 1;
76	- machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
77	- machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
78	-@@ -374,10 +374,22 @@ static void pc_q35_4_1_machine_options(MachineClass *m)
79	- DEFINE_Q35_MACHINE(v4_1, "pc-q35-4.1", NULL,
80	- pc_q35_4_1_machine_options);
81	-
82	--static void pc_q35_4_0_machine_options(MachineClass *m)
83	-+static void pc_q35_4_0_1_machine_options(MachineClass *m)
84	- {
85	- pc_q35_4_1_machine_options(m);
86	- m->alias = NULL;
87	-+ compat_props_add(m->compat_props, hw_compat_4_0_1, hw_compat_4_0_1_len);
88	-+ compat_props_add(m->compat_props, pc_compat_4_0_1, pc_compat_4_0_1_len);
89	-+}
90	-+
91	-+DEFINE_Q35_MACHINE(v4_0_1, "pc-q35-4.0.1", NULL,
92	-+ pc_q35_4_0_1_machine_options);
93	-+
94	-+static void pc_q35_4_0_machine_options(MachineClass *m)
95	-+{
96	-+ pc_q35_4_0_1_machine_options(m);
97	-+ m->default_kernel_irqchip_split = true;
98	-+ m->alias = NULL;
99	- compat_props_add(m->compat_props, hw_compat_4_0, hw_compat_4_0_len);
100	- compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
101	- }
102	-diff --git a/include/hw/boards.h b/include/hw/boards.h
103	-index 6f7916f88f..6ff02bf3e4 100644
104	---- a/include/hw/boards.h
105	-+++ b/include/hw/boards.h
106	-@@ -292,6 +292,9 @@ struct MachineState {
107	- } \
108	- type_init(machine_initfn##_register_types)
109	-
110	-+extern GlobalProperty hw_compat_4_0_1[];
111	-+extern const size_t hw_compat_4_0_1_len;
112	-+
113	- extern GlobalProperty hw_compat_4_0[];
114	- extern const size_t hw_compat_4_0_len;
115	-
116	-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
117	-index 43df7230a2..5d5636241e 100644
118	---- a/include/hw/i386/pc.h
119	-+++ b/include/hw/i386/pc.h
120	-@@ -293,6 +293,9 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
121	- int e820_get_num_entries(void);
122	- bool e820_get_entry(int, uint32_t, uint64_t , uint64_t );
123	-
124	-+extern GlobalProperty pc_compat_4_0_1[];
125	-+extern const size_t pc_compat_4_0_1_len;
126	-+
127	- extern GlobalProperty pc_compat_4_0[];
128	- extern const size_t pc_compat_4_0_len;
129	-
130	---
131	-2.19.1
132	-

Dqcow2-Add-errp-to-preallocate_co.patch+0-79

	@@ -1,79 +0,0 @@
1	-From 360bd07471dfd1830246e8403ffdc9ba9d82f9d4 Mon Sep 17 00:00:00 2001
2	-From: Kevin Wolf <kwolf@redhat.com>
3	-Date: Mon, 15 Apr 2019 16:56:07 +0200
4	-Subject: [PATCH] qcow2: Add errp to preallocate_co()
5	-
6	-We'll add a bdrv_co_truncate() call in the next patch which can return
7	-an Error that we don't want to discard. So add an errp parameter to
8	-preallocate_co().
9	-
10	-Cc: qemu-stable@nongnu.org
11	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
12	-Reviewed-by: Eric Blake <eblake@redhat.com>
13	-(cherry-picked from commit 360bd07471dfd1830246e8403ffdc9ba9d82f9d4)
14	----
15	- block/qcow2.c \| 11 ++++++-----
16	- 1 file changed, 6 insertions(+), 5 deletions(-)
17	-
18	-diff --git a/block/qcow2.c b/block/qcow2.c
19	-index dfac74c264..b4f9f5a240 100644
20	---- a/block/qcow2.c
21	-+++ b/block/qcow2.c
22	-@@ -2721,7 +2721,7 @@ static int qcow2_set_up_encryption(BlockDriverState *bs,
23	- * Returns: 0 on success, -errno on failure.
24	- */
25	- static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
26	-- uint64_t new_length)
27	-+ uint64_t new_length, Error **errp)
28	- {
29	- BDRVQcow2State *s = bs->opaque;
30	- uint64_t bytes;
31	-@@ -2738,6 +2738,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
32	- ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
33	- &host_offset, &meta);
34	- if (ret < 0) {
35	-+ error_setg_errno(errp, -ret, "Allocating clusters failed");
36	- return ret;
37	- }
38	-
39	-@@ -2746,6 +2747,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
40	-
41	- ret = qcow2_alloc_cluster_link_l2(bs, meta);
42	- if (ret < 0) {
43	-+ error_setg_errno(errp, -ret, "Mapping clusters failed");
44	- qcow2_free_any_clusters(bs, meta->alloc_offset,
45	- meta->nb_clusters, QCOW2_DISCARD_NEVER);
46	- return ret;
47	-@@ -2775,6 +2777,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
48	- ret = bdrv_pwrite(s->data_file, (host_offset + cur_bytes) - 1,
49	- &data, 1);
50	- if (ret < 0) {
51	-+ error_setg_errno(errp, -ret, "Writing to EOF failed");
52	- return ret;
53	- }
54	- }
55	-@@ -3748,9 +3751,8 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
56	- break;
57	-
58	- case PREALLOC_MODE_METADATA:
59	-- ret = preallocate_co(bs, old_length, offset);
60	-+ ret = preallocate_co(bs, old_length, offset, errp);
61	- if (ret < 0) {
62	-- error_setg_errno(errp, -ret, "Preallocation failed");
63	- goto fail;
64	- }
65	- break;
66	-@@ -3766,9 +3768,8 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
67	- /* With a data file, preallocation means just allocating the metadata
68	- * and forwarding the truncate request to the data file */
69	- if (has_data_file(bs)) {
70	-- ret = preallocate_co(bs, old_length, offset);
71	-+ ret = preallocate_co(bs, old_length, offset, errp);
72	- if (ret < 0) {
73	-- error_setg_errno(errp, -ret, "Preallocation failed");
74	- goto fail;
75	- }
76	- break;
77	---
78	-2.19.1
79	-

Dqcow2-Avoid-COW-during-metadata-preallocation.patch+0-38

	@@ -1,38 +0,0 @@
1	-From f29fbf7c6b1c9a84f6931c1c222716fbe073e6e4 Mon Sep 17 00:00:00 2001
2	-From: Kevin Wolf <kwolf@redhat.com>
3	-Date: Mon, 15 Apr 2019 16:25:01 +0200
4	-Subject: [PATCH] qcow2: Avoid COW during metadata preallocation
5	-
6	-Limiting the allocation to INT_MAX bytes isn't particularly clever
7	-because it means that the final cluster will be a partial cluster which
8	-will be completed through a COW operation. This results in unnecessary
9	-data read and write requests which lead to an unwanted non-sparse
10	-filesystem block for metadata preallocation.
11	-
12	-Align the maximum allocation size down to the cluster size to avoid this
13	-situation.
14	-
15	-Cc: qemu-stable@nongnu.org
16	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
17	-Reviewed-by: Eric Blake <eblake@redhat.com>
18	-(cherry-picked from commit f29fbf7c6b1c9a84f6931c1c222716fbe073e6e4)
19	----
20	- block/qcow2.c \| 2 +-
21	- 1 file changed, 1 insertion(+), 1 deletion(-)
22	-
23	-diff --git a/block/qcow2.c b/block/qcow2.c
24	-index 3ace3b2209..dfac74c264 100644
25	---- a/block/qcow2.c
26	-+++ b/block/qcow2.c
27	-@@ -2734,7 +2734,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
28	- bytes = new_length - offset;
29	-
30	- while (bytes) {
31	-- cur_bytes = MIN(bytes, INT_MAX);
32	-+ cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
33	- ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
34	- &host_offset, &meta);
35	- if (ret < 0) {
36	---
37	-2.19.1
38	-

Dqcow2-Fix-full-preallocation-with-external-data-file.patch+0-116

	@@ -1,116 +0,0 @@
1	-From 718c0fce2f56755a8d8f737607779a98aa6e7cc4 Mon Sep 17 00:00:00 2001
2	-From: Kevin Wolf <kwolf@redhat.com>
3	-Date: Mon, 15 Apr 2019 16:34:30 +0200
4	-Subject: [PATCH] qcow2: Fix full preallocation with external data file
5	-
6	-preallocate_co() already gave the data file the full size without
7	-forwarding the requested preallocation mode to the protocol. When
8	-bdrv_co_truncate() was called later with the preallocation mode, the
9	-file didn't actually grow any more, so the data file stayed unallocated
10	-even if full preallocation was requested.
11	-
12	-Pass the right preallocation mode to preallocate_co() and remove the
13	-second bdrv_co_truncate() to fix this. As a side effect, the ugly
14	-one-byte write in preallocate_co() is replaced with a truncate call,
15	-now leaving the last block unallocated on the protocol level as it
16	-should be.
17	-
18	-Cc: qemu-stable@nongnu.org
19	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
20	-Reviewed-by: Eric Blake <eblake@redhat.com>
21	-(cherry-picked from commit 718c0fce2f56755a8d8f737607779a98aa6e7cc4)
22	----
23	- block/qcow2.c \| 41 +++++++++++++++++++++++------------------
24	- 1 file changed, 23 insertions(+), 18 deletions(-)
25	-
26	-diff --git a/block/qcow2.c b/block/qcow2.c
27	-index b4f9f5a240..7fbef97aab 100644
28	---- a/block/qcow2.c
29	-+++ b/block/qcow2.c
30	-@@ -2721,11 +2721,13 @@ static int qcow2_set_up_encryption(BlockDriverState *bs,
31	- * Returns: 0 on success, -errno on failure.
32	- */
33	- static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
34	-- uint64_t new_length, Error **errp)
35	-+ uint64_t new_length, PreallocMode mode,
36	-+ Error **errp)
37	- {
38	- BDRVQcow2State *s = bs->opaque;
39	- uint64_t bytes;
40	- uint64_t host_offset = 0;
41	-+ int64_t file_length;
42	- unsigned int cur_bytes;
43	- int ret;
44	- QCowL2Meta *meta;
45	-@@ -2772,12 +2774,19 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
46	- * all of the allocated clusters (otherwise we get failing reads after
47	- * EOF). Extend the image to the last allocated sector.
48	- */
49	-- if (host_offset != 0) {
50	-- uint8_t data = 0;
51	-- ret = bdrv_pwrite(s->data_file, (host_offset + cur_bytes) - 1,
52	-- &data, 1);
53	-+ file_length = bdrv_getlength(s->data_file->bs);
54	-+ if (file_length < 0) {
55	-+ error_setg_errno(errp, -file_length, "Could not get file size");
56	-+ return file_length;
57	-+ }
58	-+
59	-+ if (host_offset + cur_bytes > file_length) {
60	-+ if (mode == PREALLOC_MODE_METADATA) {
61	-+ mode = PREALLOC_MODE_OFF;
62	-+ }
63	-+ ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, mode,
64	-+ errp);
65	- if (ret < 0) {
66	-- error_setg_errno(errp, -ret, "Writing to EOF failed");
67	- return ret;
68	- }
69	- }
70	-@@ -3748,10 +3757,16 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
71	-
72	- switch (prealloc) {
73	- case PREALLOC_MODE_OFF:
74	-+ if (has_data_file(bs)) {
75	-+ ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
76	-+ if (ret < 0) {
77	-+ goto fail;
78	-+ }
79	-+ }
80	- break;
81	-
82	- case PREALLOC_MODE_METADATA:
83	-- ret = preallocate_co(bs, old_length, offset, errp);
84	-+ ret = preallocate_co(bs, old_length, offset, prealloc, errp);
85	- if (ret < 0) {
86	- goto fail;
87	- }
88	-@@ -3768,7 +3783,7 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
89	- /* With a data file, preallocation means just allocating the metadata
90	- * and forwarding the truncate request to the data file */
91	- if (has_data_file(bs)) {
92	-- ret = preallocate_co(bs, old_length, offset, errp);
93	-+ ret = preallocate_co(bs, old_length, offset, prealloc, errp);
94	- if (ret < 0) {
95	- goto fail;
96	- }
97	-@@ -3883,16 +3898,6 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
98	-
99	- bs->total_sectors = offset / BDRV_SECTOR_SIZE;
100	-
101	-- if (has_data_file(bs)) {
102	-- if (prealloc == PREALLOC_MODE_METADATA) {
103	-- prealloc = PREALLOC_MODE_OFF;
104	-- }
105	-- ret = bdrv_co_truncate(s->data_file, offset, prealloc, errp);
106	-- if (ret < 0) {
107	-- goto fail;
108	-- }
109	-- }
110	--
111	- /* write updated header.size */
112	- offset = cpu_to_be64(offset);
113	- ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
114	---
115	-2.19.1
116	-

Dqcow2-Fix-qcow2_make_empty-with-external-data-file.patch+0-49

	@@ -1,49 +0,0 @@
1	-From db04524f820582ebf1189223b6378de238511da1 Mon Sep 17 00:00:00 2001
2	-From: Kevin Wolf <kwolf@redhat.com>
3	-Date: Mon, 29 Apr 2019 12:52:21 +0200
4	-Subject: [PATCH] qcow2: Fix qcow2_make_empty() with external data file
5	-
6	-make_completely_empty() is an optimisated path for bdrv_make_empty()
7	-where completely new metadata is created inside the image file instead
8	-of going through all clusters and discarding them. For an external data
9	-file, however, we actually need to do discard operations on the data
10	-file; just overwriting the qcow2 file doesn't get rid of the data.
11	-
12	-The necessary slow path with an explicit discard operation already
13	-exists for other cases. Use it for external data files, too.
14	-
15	-Cc: qemu-stable@nongnu.org
16	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
17	-Reviewed-by: Eric Blake <eblake@redhat.com>
18	-(cherry-picked from commit db04524f820582ebf1189223b6378de238511da1)
19	----
20	- block/qcow2.c \| 7 +++++--
21	- 1 file changed, 5 insertions(+), 2 deletions(-)
22	-
23	-diff --git a/block/qcow2.c b/block/qcow2.c
24	-index 7fbef97aab..840f289a48 100644
25	---- a/block/qcow2.c
26	-+++ b/block/qcow2.c
27	-@@ -4384,14 +4384,17 @@ static int qcow2_make_empty(BlockDriverState *bs)
28	-
29	- if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
30	- 3 + l1_clusters <= s->refcount_block_size &&
31	-- s->crypt_method_header != QCOW_CRYPT_LUKS) {
32	-+ s->crypt_method_header != QCOW_CRYPT_LUKS &&
33	-+ !has_data_file(bs)) {
34	- /* The following function only works for qcow2 v3 images (it
35	- * requires the dirty flag) and only as long as there are no
36	- * features that reserve extra clusters (such as snapshots,
37	- * LUKS header, or persistent bitmaps), because it completely
38	- * empties the image. Furthermore, the L1 table and three
39	- * additional clusters (image header, refcount table, one
40	-- * refcount block) have to fit inside one refcount block. */
41	-+ * refcount block) have to fit inside one refcount block. It
42	-+ * only resets the image file, i.e. does not work with an
43	-+ * external data file. */
44	- return make_completely_empty(bs);
45	- }
46	-
47	---
48	-2.19.1
49	-

Dqcow2-Fix-the-calculation-of-the-maximum-L2-cache-size.patch+0-59

	@@ -1,59 +0,0 @@
1	-From cb7630af20d353cbde66ddfb14d858737ffaf877 Mon Sep 17 00:00:00 2001
2	-From: Alberto Garcia <berto@igalia.com>
3	-Date: Fri, 16 Aug 2019 15:17:42 +0300
4	-Subject: [PATCH] qcow2: Fix the calculation of the maximum L2 cache size
5	-
6	-The size of the qcow2 L2 cache defaults to 32 MB, which can be easily
7	-larger than the maximum amount of L2 metadata that the image can have.
8	-For example: with 64 KB clusters the user would need a qcow2 image
9	-with a virtual size of 256 GB in order to have 32 MB of L2 metadata.
10	-
11	-Because of that, since commit b749562d9822d14ef69c9eaa5f85903010b86c30
12	-we forbid the L2 cache to become larger than the maximum amount of L2
13	-metadata for the image, calculated using this formula:
14	-
15	- uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
16	-
17	-The problem with this formula is that the result should be rounded up
18	-to the cluster size because an L2 table on disk always takes one full
19	-cluster.
20	-
21	-For example, a 1280 MB qcow2 image with 64 KB clusters needs exactly
22	-160 KB of L2 metadata, but we need 192 KB on disk (3 clusters) even if
23	-the last 32 KB of those are not going to be used.
24	-
25	-However QEMU rounds the numbers down and only creates 2 cache tables
26	-(128 KB), which is not enough for the image.
27	-
28	-A quick test doing 4KB random writes on a 1280 MB image gives me
29	-around 500 IOPS, while with the correct cache size I get 16K IOPS.
30	-
31	-Cc: qemu-stable@nongnu.org
32	-Signed-off-by: Alberto Garcia <berto@igalia.com>
33	-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
34	-(cherry picked from commit b70d08205b2e4044c529eefc21df2c8ab61b473b)
35	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
36	----
37	- block/qcow2.c \| 6 +++++-
38	- 1 file changed, 5 insertions(+), 1 deletion(-)
39	-
40	-diff --git a/block/qcow2.c b/block/qcow2.c
41	-index 840f289a48..c80f48a02b 100644
42	---- a/block/qcow2.c
43	-+++ b/block/qcow2.c
44	-@@ -831,7 +831,11 @@ static void read_cache_sizes(BlockDriverState bs, QemuOpts opts,
45	- bool l2_cache_entry_size_set;
46	- int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
47	- uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
48	-- uint64_t max_l2_cache = virtual_disk_size / (s->cluster_size / 8);
49	-+ uint64_t max_l2_entries = DIV_ROUND_UP(virtual_disk_size, s->cluster_size);
50	-+ /* An L2 table is always one cluster in size so the max cache size
51	-+ * should be a multiple of the cluster size. */
52	-+ uint64_t max_l2_cache = ROUND_UP(max_l2_entries * sizeof(uint64_t),
53	-+ s->cluster_size);
54	-
55	- combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
56	- l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
57	---
58	-2.19.1
59	-

Rqemu-4.0.0.tar.xz→qemu-4.0.1.tar.xz+0-0

Binary files do not support preview

Mqemu.spec+50-125

	@@ -1,6 +1,6 @@
1	Name: qemu	1	Name: qemu
2	-Version: 4.0.0	2	+Version: 4.0.1
3	-Release: 6	3	+Release: 8
4	Epoch: 2	4	Epoch: 2
5	Summary: QEMU is a generic and open source machine emulator and virtualizer	5	Summary: QEMU is a generic and open source machine emulator and virtualizer
6	License: GPLv2 and BSD and MIT and CC-BY	6	License: GPLv2 and BSD and MIT and CC-BY
	@@ -11,84 +11,42 @@ Source2: 99-qemu-guest-agent.rules
11	Source3: bridge.conf	11	Source3: bridge.conf
12		12
13	Patch0001: qxl-check-release-info-object.patch	13	Patch0001: qxl-check-release-info-object.patch
14	-Patch0002: target-i386-define-md-clear-bit.patch	14	+Patch0002: ARM64-record-vtimer-tick-when-cpu-is-stopped.patch
15	-Patch0003: Revert-Enable-build-and-install-of-our-rST-docs.patch	15	+Patch0003: pl011-reset-read-FIFO-when-UARTTIMSC-0-UARTICR-0xfff.patch
16	-Patch0004: ARM64-record-vtimer-tick-when-cpu-is-stopped.patch	16	+Patch0004: pl031-support-rtc-timer-property-for-pl031.patch
17	-Patch0005: pl011-reset-read-FIFO-when-UARTTIMSC-0-UARTICR-0xfff.patch	17	+Patch0005: vhost-cancel-migration-when-vhost-user-restarted.patch
18	-Patch0006: pl031-support-rtc-timer-property-for-pl031.patch	18	+Patch0006: qcow2-fix-memory-leak-in-qcow2_read_extensions.patch
19	-Patch0007: vhost-cancel-migration-when-vhost-user-restarted.patch	19	+Patch0007: hw-arm-expose-host-CPU-frequency-info-to-guest.patch
20	-Patch0008: qcow2-fix-memory-leak-in-qcow2_read_extensions.patch	20	+Patch0008: qemu-bridge-helper-restrict-interface-name-to-IFNAMS.patch
21	-Patch0009: hw-arm-expose-host-CPU-frequency-info-to-guest.patch	21	+Patch0009: qemu-bridge-helper-move-repeating-code-in-parse_acl.patch
22	-Patch0010: block-Fix-AioContext-switch-for-bs-drv-NULL.patch	22	+Patch0010: smbios-Add-missing-member-of-type-4-for-smbios-3.0.patch
23	-Patch0011: cutils-Fix-size_to_str-on-32-bit-platforms.patch	23	+Patch0011: hw-arm-virt-Introduce-cpu-topology-support.patch
24	-Patch0012: qcow2-Avoid-COW-during-metadata-preallocation.patch	24	+Patch0012: hw-arm64-add-vcpu-cache-info-support.patch
25	-Patch0013: qcow2-Add-errp-to-preallocate_co.patch	25	+Patch0013: xhci-Fix-memory-leak-in-xhci_address_slot.patch
26	-Patch0014: qcow2-Fix-full-preallocation-with-external-data-file.patch	26	+Patch0014: xhci-Fix-memory-leak-in-xhci_kick_epctx.patch
27	-Patch0015: qcow2-Fix-qcow2_make_empty-with-external-data-file.patch	27	+Patch0015: ehci-fix-queue-dev-null-ptr-dereference.patch
28	-Patch0016: megasas-fix-mapped-frame-size.patch	28	+Patch0016: memory-unref-the-memory-region-in-simplify-flatview.patch
29	-Patch0017: kbd-state-fix-autorepeat-handling.patch	29	+Patch0017: util-async-hold-AioContext-ref-to-prevent-use-after-free.patch
30	-Patch0018: block-file-posix-Unaligned-O_DIRECT-block-status.patch	30	+Patch0018: vhost-user-scsi-prevent-using-uninitialized-vqs.patch
31	-Patch0019: hw-add-compat-machines-for-4.1.patch	31	+Patch0019: cpu-add-Kunpeng-920-cpu-support.patch
32	-Patch0020: usb-tablet-fix-serial-compat-property.patch	32	+Patch0020: cpu-parse-feature-to-avoid-failure.patch
33	-Patch0021: q35-Revert-to-kernel-irqchip.patch	33	+Patch0021: cpu-add-Cortex-A72-processor-kvm-target-support.patch
34	-Patch0022: hw-Nuke-hw_compat_4_0_1-and-pc_compat_4_0_1.patch	34	+Patch0022: vnc-fix-memory-leak-when-vnc-disconnect.patch
35	-Patch0023: vl-Fix-drive-blockdev-persistent-reservation-management.patch	35	+Patch0023: pcie-disable-the-PCI_EXP_LINKSTA_DLLA-cap.patch
36	-Patch0024: vhost-fix-vhost_log-size-overflow-during-migration.patch	36	+Patch0024: linux-headers-update-against-KVM-ARM-Fix-256-vcpus.patch
37	-Patch0025: virtio-pci-fix-missing-device-properties.patch	37	+Patch0025: intc-arm_gic-Support-IRQ-injection-for-more-than-256.patch
38	-Patch0026: i386-acpi-fix-gint-overflow-in-crs_range_compare.patch	38	+Patch0026: ARM-KVM-Check-KVM_CAP_ARM_IRQ_LINE_LAYOUT_2-for-smp_.patch
39	-Patch0027: ioapic-kvm-Skip-route-updates-for-masked-pins.patch	39	+Patch0027: 9pfs-local-Fix-possible-memory-leak-in-local_link.patch
40	-Patch0028: i386-acpi-show-PCI-Express-bus-on-pxb-pcie-expanders.patch	40	+Patch0028: scsi-disk-define-props-in-scsi_block_disk-to-avoid-memleaks.patch
41	-Patch0029: virtio-balloon-fix-QEMU-4.0-config-size-migration-in.patch	41	+Patch0029: arm-translate-a64-fix-uninitialized-variable-warning.patch
42	-Patch0030: virtio-balloon-Fix-wrong-sign-extension-of-PFNs.patch	42	+Patch0030: nbd-fix-uninitialized-variable-warning.patch
43	-Patch0031: virtio-balloon-Fix-QEMU-crashes-on-pagesize-BALLOON_.patch	43	+Patch0031: xhci-Fix-memory-leak-in-xhci_kick_epctx-when-poweroff.patch
44	-Patch0032: virtio-balloon-Simplify-deflate-with-pbp.patch	44	+Patch0032: block-fix-memleaks-in-bdrv_refresh_filename.patch
45	-Patch0033: virtio-balloon-Better-names-for-offset-variables.patch	45	+Patch0033: iscsi-Cap-block-count-from-GET-LBA-STATUS-CVE-2020-1.patch
46	-Patch0034: virtio-balloon-Rework-pbp-tracking-data.patch	46	+Patch0034: tcp_emu-Fix-oob-access.patch
47	-Patch0035: virtio-balloon-Use-temporary-PBP-only.patch	47	+Patch0035: slirp-use-correct-size-while-emulating-IRC-commands.patch
48	-Patch0036: virtio-balloon-don-t-track-subpages-for-the-PBP.patch	48	+Patch0036: slirp-use-correct-size-while-emulating-commands.patch
49	-Patch0037: virtio-balloon-free-pbp-more-aggressively.patch	49	+Patch0037: tcp_emu-fix-unsafe-snprintf-usages.patch
50	-Patch0038: qemu-bridge-helper-restrict-interface-name-to-IFNAMS.patch
51	-Patch0039: qemu-bridge-helper-move-repeating-code-in-parse_acl.patch
52	-Patch0040: smbios-Add-missing-member-of-type-4-for-smbios-3.0.patch
53	-Patch0041: hw-arm-virt-Introduce-cpu-topology-support.patch
54	-Patch0042: hw-arm64-add-vcpu-cache-info-support.patch
55	-Patch0043: xhci-Fix-memory-leak-in-xhci_address_slot.patch
56	-Patch0044: xhci-Fix-memory-leak-in-xhci_kick_epctx.patch
57	-Patch0045: ehci-fix-queue-dev-null-ptr-dereference.patch
58	-Patch0046: memory-unref-the-memory-region-in-simplify-flatview.patch
59	-Patch0047: scsi-lsi-exit-infinite-loop-while-executing-script.patch
60	-Patch0048: util-async-hold-AioContext-ref-to-prevent-use-after-free.patch
61	-Patch0049: vhost-user-scsi-prevent-using-uninitialized-vqs.patch
62	-Patch0050: cpu-add-Kunpeng-920-cpu-support.patch
63	-Patch0051: cpu-parse-feature-to-avoid-failure.patch
64	-Patch0052: cpu-add-Cortex-A72-processor-kvm-target-support.patch
65	-Patch0053: vnc-fix-memory-leak-when-vnc-disconnect.patch
66	-Patch0054: pcie-disable-the-PCI_EXP_LINKSTA_DLLA-cap.patch
67	-Patch0055: blockdev-backup-don-t-check-aio_context-too-early.patch
68	-Patch0056: migration-dirty-bitmaps-change-bitmap-enumeration-method.patch
69	-Patch0057: target-i386-add-MDS-NO-feature.patch
70	-Patch0058: usbredir-fix-buffer-overflow-on-vmload.patch
71	-Patch0059: util-hbitmap-update-orig_size-on-truncate.patch
72	-Patch0060: mirror-Only-mirror-granularity-aligned-chunks.patch
73	-Patch0061: qcow2-Fix-the-calculation-of-the-maximum-L2-cache-size.patch
74	-Patch0062: dma-helpers-ensure-AIO-callback-is-invoked-after-can.patch
75	-Patch0063: pr-manager-Fix-invalid-g_free-crash-bug.patch
76	-Patch0064: block-create-Do-not-abort-if-a-block-driver-is-not-available.patch
77	-Patch0065: block-nfs-tear-down-aio-before-nfs_close.patch
78	-Patch0066: blockjob-update-nodes-head-while-removing-all-bdrv.patch
79	-Patch0067: slirp-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch
80	-Patch0068: slirp-ip_reass-Fix-use-after-free.patch
81	-Patch0069: hw-core-loader-Fix-possible-crash-in-rom_copy.patch
82	-Patch0070: migration-Fix-use-after-free-during-process-exit.patch
83	-Patch0071: linux-headers-update-against-KVM-ARM-Fix-256-vcpus.patch
84	-Patch0072: intc-arm_gic-Support-IRQ-injection-for-more-than-256.patch
85	-Patch0073: ARM-KVM-Check-KVM_CAP_ARM_IRQ_LINE_LAYOUT_2-for-smp_.patch
86	-Patch0074: 9pfs-local-Fix-possible-memory-leak-in-local_link.patch
87	-Patch0075: scsi-disk-define-props-in-scsi_block_disk-to-avoid-memleaks.patch
88	-Patch0076: arm-translate-a64-fix-uninitialized-variable-warning.patch
89	-Patch0077: nbd-fix-uninitialized-variable-warning.patch
90	-Patch0078: xhci-Fix-memory-leak-in-xhci_kick_epctx-when-poweroff.patch
91	-Patch0079: block-fix-memleaks-in-bdrv_refresh_filename.patch
92		50
93	BuildRequires: flex	51	BuildRequires: flex
94	BuildRequires: bison	52	BuildRequires: bison
	@@ -97,6 +55,7 @@ BuildRequires: perl-podlators
97	BuildRequires: kernel	55	BuildRequires: kernel
98	BuildRequires: chrpath	56	BuildRequires: chrpath
99	BuildRequires: gettext	57	BuildRequires: gettext
		58	+BuildRequires: python-sphinx
100		59
101	BuildRequires: zlib-devel	60	BuildRequires: zlib-devel
102	BuildRequires: gtk3-devel	61	BuildRequires: gtk3-devel
	@@ -212,6 +171,7 @@ buildldflags="VL_LDFLAGS=-Wl,--build-id"
212	--interp-prefix=%{_prefix}/qemu-%%M \	171	--interp-prefix=%{_prefix}/qemu-%%M \
213	--firmwarepath=%{_datadir}/%{name} \	172	--firmwarepath=%{_datadir}/%{name} \
214	--with-pkgversion=%{name}-%{version}-%{release} \	173	--with-pkgversion=%{name}-%{version}-%{release} \
		174	+ --python=/usr/bin/python3 \
215	--disable-strip \	175	--disable-strip \
216	--disable-werror \	176	--disable-werror \
217	--disable-slirp \	177	--disable-slirp \
	@@ -388,6 +348,7 @@ getent passwd qemu >/dev/null \|\| \
388	%doc %{qemudocdir}/qemu-ga-ref.txt	348	%doc %{qemudocdir}/qemu-ga-ref.txt
389	%doc %{qemudocdir}/qemu-qmp-ref.html	349	%doc %{qemudocdir}/qemu-qmp-ref.html
390	%doc %{qemudocdir}/qemu-qmp-ref.txt	350	%doc %{qemudocdir}/qemu-qmp-ref.txt
		351	+%doc %{qemudocdir}/interop
391	%doc %{qemudocdir}/README	352	%doc %{qemudocdir}/README
392	%doc %{qemudocdir}/Changelog	353	%doc %{qemudocdir}/Changelog
393	%{_mandir}/man1/qemu.1*	354	%{_mandir}/man1/qemu.1*
	@@ -419,6 +380,15 @@ getent passwd qemu >/dev/null \|\| \
419	%endif	380	%endif
420		381
421	%changelog	382	%changelog
		383	+* Wed Mar 11 2020 backport from qemu upstream
		384	+- tcp_emu: Fix oob access
		385	+- slirp: use correct size while emulating IRC commands
		386	+- slirp: use correct size while emulating commands
		387	+- tcp_emu: fix unsafe snprintf() usages
		388	+
		389	+* Mon Mar 9 2020 backport from qemu upstream
		390	+- iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711)
		391	+
422	* Thu Feb 6 2020 Huawei Technologies Co., Ltd. <zhang.zhanghailiang@huawei.com>	392	* Thu Feb 6 2020 Huawei Technologies Co., Ltd. <zhang.zhanghailiang@huawei.com>
423	- spec: remove fno-inline option for configure	393	- spec: remove fno-inline option for configure
424		394
	@@ -438,24 +408,8 @@ getent passwd qemu >/dev/null \|\| \
438	- ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256	408	- ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256
439		409
440	* Thu Dec 12 2019 backport from qemu upstream v4.0.1 release	410	* Thu Dec 12 2019 backport from qemu upstream v4.0.1 release
441	-- usb-tablet: fix serial compat property
442	-- blockdev-backup: don't check aio_context too early
443	-- migration/dirty-bitmaps: change bitmap enumeration method
444	-- target/i386: add MDS-NO feature
445	-- usbredir: fix buffer-overflow on vmload
446	- tpm: Exit in reset when backend indicates failure	411	- tpm: Exit in reset when backend indicates failure
447	- tpm_emulator: Translate TPM error codes to strings	412	- tpm_emulator: Translate TPM error codes to strings
448	-- util/hbitmap: update orig_size on truncate
449	-- mirror: Only mirror granularity-aligned chunks
450	-- qcow2: Fix the calculation of the maximum L2 cache size
451	-- dma-helpers: ensure AIO callback is invoked after cancellation
452	-- pr-manager: Fix invalid g_free() crash bug
453	-- block/nfs: tear down aio before nfs_close
454	-- blockjob: update nodes head while removing all bdrv
455	-- slirp: Fix heap overflow in ip_reass on big packet input
456	-- slirp: ip_reass: Fix use after free
457	-- hw/core/loader: Fix possible crash in rom_copy()
458	-- migration: Fix use-after-free during process exit
459		413
460	* Thu Oct 17 2019 backport from qemu upstream	414	* Thu Oct 17 2019 backport from qemu upstream
461	- vnc-fix-memory-leak-when-vnc-disconnect.patch	415	- vnc-fix-memory-leak-when-vnc-disconnect.patch
	@@ -463,7 +417,6 @@ getent passwd qemu >/dev/null \|\| \
463	* Mon Sep 9 2019 backport from qemu upstream	417	* Mon Sep 9 2019 backport from qemu upstream
464	- ehci-fix-queue-dev-null-ptr-dereference.patch	418	- ehci-fix-queue-dev-null-ptr-dereference.patch
465	- memory-unref-the-memory-region-in-simplify-flatview.patch	419	- memory-unref-the-memory-region-in-simplify-flatview.patch
466	-- scsi-lsi-exit-infinite-loop-while-executing-script-C.patch
467	- util-async-hold-AioContext-ref-to-prevent-use-after-.patch	420	- util-async-hold-AioContext-ref-to-prevent-use-after-.patch
468	- vhost-user-scsi-prevent-using-uninitialized-vqs.patch	421	- vhost-user-scsi-prevent-using-uninitialized-vqs.patch
469		422
	@@ -486,34 +439,6 @@ getent passwd qemu >/dev/null \|\| \
486	- qemu-bridge-helper: restrict interface name to IFNAMSIZ	439	- qemu-bridge-helper: restrict interface name to IFNAMSIZ
487	- qemu-bridge-helper: move repeating code in parse_acl_file	440	- qemu-bridge-helper: move repeating code in parse_acl_file
488		441
489	-* Wed Jul 31 2019 backport from qemu upstream
490	-- block: Fix AioContext switch for bs->drv == NULL
491	-- cutils: Fix size_to_str() on 32-bit platforms
492	-- qcow2: Avoid COW during metadata preallocation
493	-- qcow2: Add errp to preallocate_co()
494	-- qcow2: qcow2: Fix full preallocation with external data file
495	-- qcow2: Fix qcow2_make_empty() with external data file
496	-- megasas: fix mapped frame size
497	-- kbd-state: fix autorepeat handling
498	-- block/file-posix: Unaligned O_DIRECT block-status
499	-- hw: add compat machines for 4.1
500	-- q35: Revert to kernel irqchip
501	-- hw: Nuke hw_compat_4_0_1 and pc_compat_4_0_1
502	-- vl: Fix -drive / -blockdev persistent reservation management
503	-- vhost: fix vhost_log size overflow during migration
504	-- virtio-pci: fix missing device properties
505	-- i386/acpi: fix gint overflow in crs_range_compare
506	-- ioapic: kvm: Skip route updates for masked pins
507	-- i386/acpi: show PCI Express bus on pxb-pcie expanders
508	-- virtio-balloon: Fix wrong sign extension of PFNs
509	-- virtio-balloon: Fix QEMU crashes on pagesize > BALLOON_PAGE_SIZE
510	-- virtio-balloon: Simplify deflate with pbp
511	-- virtio-balloon: Better names for offset variables in inflate/deflate code
512	-- virtio-balloon: Rework pbp tracking data
513	-- virtio-balloon: Use temporary PBP only
514	-- virtio-balloon: virtio-balloon: don't track subpages for the PBP
515	-- virtio-balloon: free pbp more aggressively
516	-
517	* Tue Jul 30 2019 Huawei Technologies Co., Ltd. <zhang.zhanghailiang@huawei.com	442	* Tue Jul 30 2019 Huawei Technologies Co., Ltd. <zhang.zhanghailiang@huawei.com
518	- qcow2: fix memory leak in qcow2_read_extensions	443	- qcow2: fix memory leak in qcow2_read_extensions
519	- hw/arm: expose host CPU frequency info to guest	444	- hw/arm: expose host CPU frequency info to guest

Dscsi-lsi-exit-infinite-loop-while-executing-script.patch+0-104

	@@ -1,104 +0,0 @@
1	-From dee1c7242e6b11d502728840f36d021ceedce140 Mon Sep 17 00:00:00 2001
2	-From: Paolo Bonzini <pbonzini@redhat.com>
3	-Date: Wed, 14 Aug 2019 17:35:21 +0530
4	-Subject: [PATCH 3/5] scsi: lsi: exit infinite loop while executing script
5	- (CVE-2019-12068)
6	-
7	-When executing script in lsi_execute_script(), the LSI scsi adapter
8	-emulator advances 's->dsp' index to read next opcode. This can lead
9	-to an infinite loop if the next opcode is empty. Move the existing
10	-loop exit after 10k iterations so that it covers no-op opcodes as
11	-well.
12	-
13	-Reported-by: Bugs SysSec <bugs-syssec@rub.de>
14	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
15	-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
16	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
17	-(cherry-picked from commit de594e47659029316bbf9391efb79da0a1a08e08)
18	----
19	- hw/scsi/lsi53c895a.c \| 41 +++++++++++++++++++++++++++--------------
20	- 1 file changed, 27 insertions(+), 14 deletions(-)
21	-
22	-diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
23	-index da7239d..d3380b6 100644
24	---- a/hw/scsi/lsi53c895a.c
25	-+++ b/hw/scsi/lsi53c895a.c
26	-@@ -184,6 +184,9 @@ static const char *names[] = {
27	- /* Flag set if this is a tagged command. */
28	- #define LSI_TAG_VALID (1 << 16)
29	-
30	-+/* Maximum instructions to process. */
31	-+#define LSI_MAX_INSN 10000
32	-+
33	- typedef struct lsi_request {
34	- SCSIRequest *req;
35	- uint32_t tag;
36	-@@ -1131,7 +1134,21 @@ static void lsi_execute_script(LSIState *s)
37	-
38	- s->istat1 \|= LSI_ISTAT1_SRUN;
39	- again:
40	-- insn_processed++;
41	-+ if (++insn_processed > LSI_MAX_INSN) {
42	-+ /* Some windows drivers make the device spin waiting for a memory
43	-+ location to change. If we have been executed a lot of code then
44	-+ assume this is the case and force an unexpected device disconnect.
45	-+ This is apparently sufficient to beat the drivers into submission.
46	-+ */
47	-+ if (!(s->sien0 & LSI_SIST0_UDC)) {
48	-+ qemu_log_mask(LOG_GUEST_ERROR,
49	-+ "lsi_scsi: inf. loop with UDC masked");
50	-+ }
51	-+ lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
52	-+ lsi_disconnect(s);
53	-+ trace_lsi_execute_script_stop();
54	-+ return;
55	-+ }
56	- insn = read_dword(s, s->dsp);
57	- if (!insn) {
58	- /* If we receive an empty opcode increment the DSP by 4 bytes
59	-@@ -1568,19 +1585,7 @@ again:
60	- }
61	- }
62	- }
63	-- if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) {
64	-- /* Some windows drivers make the device spin waiting for a memory
65	-- location to change. If we have been executed a lot of code then
66	-- assume this is the case and force an unexpected device disconnect.
67	-- This is apparently sufficient to beat the drivers into submission.
68	-- */
69	-- if (!(s->sien0 & LSI_SIST0_UDC)) {
70	-- qemu_log_mask(LOG_GUEST_ERROR,
71	-- "lsi_scsi: inf. loop with UDC masked");
72	-- }
73	-- lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
74	-- lsi_disconnect(s);
75	-- } else if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
76	-+ if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
77	- if (s->dcntl & LSI_DCNTL_SSM) {
78	- lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
79	- } else {
80	-@@ -1968,6 +1973,10 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
81	- case 0x2f: /* DSP[24:31] */
82	- s->dsp &= 0x00ffffff;
83	- s->dsp \|= val << 24;
84	-+ /*
85	-+ * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
86	-+ * instruction. Is this correct?
87	-+ */
88	- if ((s->dmode & LSI_DMODE_MAN) == 0
89	- && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
90	- lsi_execute_script(s);
91	-@@ -1986,6 +1995,10 @@ static void lsi_reg_writeb(LSIState *s, int offset, uint8_t val)
92	- break;
93	- case 0x3b: /* DCNTL */
94	- s->dcntl = val & ~(LSI_DCNTL_PFF \| LSI_DCNTL_STD);
95	-+ /*
96	-+ * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
97	-+ * instruction. Is this correct?
98	-+ */
99	- if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
100	- lsi_execute_script(s);
101	- break;
102	---
103	-1.8.3.1
104	-

Dslirp-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch+0-53

	@@ -1,53 +0,0 @@
1	-From c2e03e2aa42d0f4f41deb08c2655503835840afa Mon Sep 17 00:00:00 2001
2	-From: Michael Roth <mdroth@linux.vnet.ibm.com>
3	-Date: Tue, 24 Sep 2019 15:57:59 -0500
4	-Subject: [PATCH] slirp: Fix heap overflow in ip_reass on big packet input
5	-
6	-When the first fragment does not fit in the preallocated buffer, q will
7	-already be pointing to the ext buffer, so we mustn't try to update it.
8	-
9	-Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
10	-(from libslirp.git commit 126c04acbabd7ad32c2b018fe10dfac2a3bc1210)
11	-(from libslirp.git commit e0be80430c390bce181ea04dfcdd6ea3dfa97de1)
12	-*squash in e0be80 (clarifying comments)
13	-Fixes: CVE-2019-14378
14	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
15	----
16	- slirp/src/ip_input.c \| 13 +++++++------
17	- 1 file changed, 7 insertions(+), 6 deletions(-)
18	-
19	-diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
20	-index a714fecd58..68a99de5b5 100644
21	---- a/slirp/src/ip_input.c
22	-+++ b/slirp/src/ip_input.c
23	-@@ -331,6 +331,8 @@ insert:
24	- q = fp->frag_link.next;
25	- m = dtom(slirp, q);
26	-
27	-+ int was_ext = m->m_flags & M_EXT;
28	-+
29	- q = (struct ipasfrag *) q->ipf_next;
30	- while (q != (struct ipasfrag*)&fp->frag_link) {
31	- struct mbuf *t = dtom(slirp, q);
32	-@@ -347,13 +349,12 @@ insert:
33	- q = fp->frag_link.next;
34	-
35	- /*
36	-- * If the fragments concatenated to an mbuf that's
37	-- * bigger than the total size of the fragment, then and
38	-- * m_ext buffer was alloced. But fp->ipq_next points to
39	-- * the old buffer (in the mbuf), so we must point ip
40	-- * into the new buffer.
41	-+ * If the fragments concatenated to an mbuf that's bigger than the total
42	-+ * size of the fragment and the mbuf was not already using an m_ext buffer,
43	-+ * then an m_ext buffer was alloced. But fp->ipq_next points to the old
44	-+ * buffer (in the mbuf), so we must point ip into the new buffer.
45	- */
46	-- if (m->m_flags & M_EXT) {
47	-+ if (!was_ext && m->m_flags & M_EXT) {
48	- int delta = (char *)q - m->m_dat;
49	- q = (struct ipasfrag *)(m->m_ext + delta);
50	- }
51	---
52	-2.19.1
53	-

Dslirp-ip_reass-Fix-use-after-free.patch+0-47

	@@ -1,47 +0,0 @@
1	-From b27192be13da3fb59f51185d9a1f944b3474b2fc Mon Sep 17 00:00:00 2001
2	-From: Michael Roth <mdroth@linux.vnet.ibm.com>
3	-Date: Tue, 24 Sep 2019 16:04:04 -0500
4	-Subject: [PATCH] slirp: ip_reass: Fix use after free
5	-
6	-Using ip_deq after m_free might read pointers from an allocation reuse.
7	-
8	-This would be difficult to exploit, but that is still related with
9	-CVE-2019-14378 which generates fragmented IP packets that would trigger this
10	-issue and at least produce a DoS.
11	-
12	-Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
13	-(from libslirp.git commit c59279437eda91841b9d26079c70b8a540d41204)
14	-Fixes: CVE-2019-15890
15	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
16	----
17	- slirp/src/ip_input.c \| 6 ++++--
18	- 1 file changed, 4 insertions(+), 2 deletions(-)
19	-
20	-diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
21	-index 68a99de5b5..89ae04e0c1 100644
22	---- a/slirp/src/ip_input.c
23	-+++ b/slirp/src/ip_input.c
24	-@@ -297,6 +297,7 @@ ip_reass(Slirp slirp, struct ip ip, struct ipq *fp)
25	- */
26	- while (q != (struct ipasfrag*)&fp->frag_link &&
27	- ip->ip_off + ip->ip_len > q->ipf_off) {
28	-+ struct ipasfrag *prev;
29	- i = (ip->ip_off + ip->ip_len) - q->ipf_off;
30	- if (i < q->ipf_len) {
31	- q->ipf_len -= i;
32	-@@ -304,9 +305,10 @@ ip_reass(Slirp slirp, struct ip ip, struct ipq *fp)
33	- m_adj(dtom(slirp, q), i);
34	- break;
35	- }
36	-+ prev = q;
37	- q = q->ipf_next;
38	-- m_free(dtom(slirp, q->ipf_prev));
39	-- ip_deq(q->ipf_prev);
40	-+ ip_deq(prev);
41	-+ m_free(dtom(slirp, prev));
42	- }
43	-
44	- insert:
45	---
46	-2.19.1
47	-

Aslirp-use-correct-size-while-emulating-IRC-commands.patch+52-0

@@ -0,0 +1,52 @@
	1	+From 882149fd8401f8ff667ea384bb68008354fd110f Mon Sep 17 00:00:00 2001
	2	+From: Prasad J Pandit <pjp@fedoraproject.org>
	3	+Date: Wed, 11 Mar 2020 18:19:36 +0800
	4	+Subject: [PATCH] slirp: use correct size while emulating IRC commands
	5	+
	6	+While emulating IRC DCC commands, tcp_emu() uses 'mbuf' size
	7	+'m->m_size' to write DCC commands via snprintf(3). This may
	8	+lead to OOB write access, because 'bptr' points somewhere in
	9	+the middle of 'mbuf' buffer, not at the start. Use M_FREEROOM(m)
	10	+size to avoid OOB access.
	11	+Reported-by: default avatarVishnu Dev TJ <vishnudevtj@gmail.com>
	12	+Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
	13	+Reviewed-by: Samuel Thibault's avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
	14	+Message-Id: <20200109094228.79764-2-ppandit@redhat.com>
	15	+---
	16	+ slirp/src/tcp_subr.c \| 6 +++---
	17	+ 1 file changed, 3 insertions(+), 3 deletions(-)
	18	+
	19	+diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
	20	+index 4608942f..2053b11b 100644
	21	+--- a/slirp/src/tcp_subr.c
	22	++++ b/slirp/src/tcp_subr.c
	23	+@@ -786,7 +786,7 @@ tcp_emu(struct socket so, struct mbuf m)
	24	+ return 1;
	25	+ }
	26	+ m->m_len = bptr - m->m_data; /* Adjust length */
	27	+- m->m_len += snprintf(bptr, m->m_size,
	28	++ m->m_len += snprintf(bptr, M_FREEROOM(m),
	29	+ "DCC CHAT chat %lu %u%c\n",
	30	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	31	+ ntohs(so->so_fport), 1);
	32	+@@ -797,7 +797,7 @@ tcp_emu(struct socket so, struct mbuf m)
	33	+ return 1;
	34	+ }
	35	+ m->m_len = bptr - m->m_data; /* Adjust length */
	36	+- m->m_len += snprintf(bptr, m->m_size,
	37	++ m->m_len += snprintf(bptr, M_FREEROOM(m),
	38	+ "DCC SEND %s %lu %u %u%c\n", buff,
	39	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	40	+ ntohs(so->so_fport), n1, 1);
	41	+@@ -808,7 +808,7 @@ tcp_emu(struct socket so, struct mbuf m)
	42	+ return 1;
	43	+ }
	44	+ m->m_len = bptr - m->m_data; /* Adjust length */
	45	+- m->m_len += snprintf(bptr, m->m_size,
	46	++ m->m_len += snprintf(bptr, M_FREEROOM(m),
	47	+ "DCC MOVE %s %lu %u %u%c\n", buff,
	48	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	49	+ ntohs(so->so_fport), n1, 1);
	50	+--
	51	+2.21.1 (Apple Git-122.3)
	52	+

Aslirp-use-correct-size-while-emulating-commands.patch+51-0

@@ -0,0 +1,51 @@
	1	+From 66e2f47a01ffcaafe11acae0a191efd1805f86c6 Mon Sep 17 00:00:00 2001
	2	+From: Prasad J Pandit <pjp@fedoraproject.org>
	3	+Date: Wed, 11 Mar 2020 18:27:22 +0800
	4	+Subject: [PATCH] slirp: use correct size while emulating commands
	5	+
	6	+While emulating services in tcp_emu(), it uses 'mbuf' size
	7	+'m->m_size' to write commands via snprintf(3). Use M_FREEROOM(m)
	8	+size to avoid possible OOB access.
	9	+Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
	10	+Signed-off-by: Samuel Thibault's avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
	11	+Message-Id: <20200109094228.79764-3-ppandit@redhat.com>
	12	+---
	13	+ slirp/src/tcp_subr.c \| 8 ++++----
	14	+ 1 file changed, 4 insertions(+), 4 deletions(-)
	15	+
	16	+diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
	17	+index 2053b11b..e898fd03 100644
	18	+--- a/slirp/src/tcp_subr.c
	19	++++ b/slirp/src/tcp_subr.c
	20	+@@ -707,7 +707,7 @@ tcp_emu(struct socket so, struct mbuf m)
	21	+ n4 = (laddr & 0xff);
	22	+
	23	+ m->m_len = bptr - m->m_data; /* Adjust length */
	24	+- m->m_len += snprintf(bptr, m->m_size - m->m_len,
	25	++ m->m_len += snprintf(bptr, M_FREEROOM(m),
	26	+ "ORT %d,%d,%d,%d,%d,%d\r\n%s",
	27	+ n1, n2, n3, n4, n5, n6, x==7?buff:"");
	28	+ return 1;
	29	+@@ -740,7 +740,7 @@ tcp_emu(struct socket so, struct mbuf m)
	30	+ n4 = (laddr & 0xff);
	31	+
	32	+ m->m_len = bptr - m->m_data; /* Adjust length */
	33	+- m->m_len += snprintf(bptr, m->m_size - m->m_len,
	34	++ m->m_len += snprintf(bptr, M_FREEROOM(m),
	35	+ "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
	36	+ n1, n2, n3, n4, n5, n6, x==7?buff:"");
	37	+
	38	+@@ -766,8 +766,8 @@ tcp_emu(struct socket so, struct mbuf m)
	39	+ if (m->m_data[m->m_len-1] == '\0' && lport != 0 &&
	40	+ (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
	41	+ htons(lport), SS_FACCEPTONCE)) != NULL)
	42	+- m->m_len = snprintf(m->m_data, m->m_size, "%d",
	43	+- ntohs(so->so_fport)) + 1;
	44	++ m->m_len = snprintf(m->m_data, M_ROOM(m),
	45	++ "%d", ntohs(so->so_fport)) + 1;
	46	+ return 1;
	47	+
	48	+ case EMU_IRC:
	49	+--
	50	+2.21.1 (Apple Git-122.3)
	51	+

Dtarget-i386-add-MDS-NO-feature.patch+0-39

	@@ -1,39 +0,0 @@
1	-From 41e1564fb50515d7902628d25c0c8421a8516cc1 Mon Sep 17 00:00:00 2001
2	-From: Paolo Bonzini <pbonzini@redhat.com>
3	-Date: Thu, 6 Jun 2019 16:12:03 +0200
4	-Subject: [PATCH] target/i386: add MDS-NO feature
5	-
6	-Microarchitectural Data Sampling is a hardware vulnerability which allows
7	-unprivileged speculative access to data which is available in various CPU
8	-internal buffers.
9	-
10	-Some Intel processors use the ARCH_CAP_MDS_NO bit in the
11	-IA32_ARCH_CAPABILITIES
12	-MSR to report that they are not vulnerable, make it available to guests.
13	-
14	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
15	-Message-Id: <20190516185320.28340-1-pbonzini@redhat.com>
16	-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
17	-(cherry picked from commit 20140a82c67467f53814ca197403d5e1b561a5e5)
18	-Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
19	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
20	----
21	- target/i386/cpu.c \| 2 +-
22	- 1 file changed, 1 insertion(+), 1 deletion(-)
23	-
24	-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
25	-index d6bb57d210..ee4b8b47e2 100644
26	---- a/target/i386/cpu.c
27	-+++ b/target/i386/cpu.c
28	-@@ -1183,7 +1183,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
29	- .type = MSR_FEATURE_WORD,
30	- .feat_names = {
31	- "rdctl-no", "ibrs-all", "rsba", "skip-l1dfl-vmentry",
32	-- "ssb-no", NULL, NULL, NULL,
33	-+ "ssb-no", "mds-no", NULL, NULL,
34	- NULL, NULL, NULL, NULL,
35	- NULL, NULL, NULL, NULL,
36	- NULL, NULL, NULL, NULL,
37	---
38	-2.19.1
39	-

Dtarget-i386-define-md-clear-bit.patch+0-29

	@@ -1,29 +0,0 @@
1	-From: Paolo Bonzini <pbonzini@redhat.com>
2	-Date: Wed, 15 May 2019 15:10:10 +0100
3	-Subject: [PATCH] target/i386: define md-clear bit
4	-
5	-md-clear is a new CPUID bit which is set when microcode provides the
6	-mechanism to invoke a flush of various exploitable CPU buffers by invoking
7	-the VERW instruction.
8	-
9	-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
10	-Message-Id: <20190515141011.5315-2-berrange@redhat.com>
11	-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
12	-(cherry picked from commit b2ae52101fca7f9547ac2f388085dbc58f8fe1c0)
13	----
14	- target/i386/cpu.c \| 2 +-
15	- 1 file changed, 1 insertion(+), 1 deletion(-)
16	-
17	-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
18	-index d6bb57d210..4ea78a4939 100644
19	---- a/target/i386/cpu.c
20	-+++ b/target/i386/cpu.c
21	-@@ -1076,7 +1076,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
22	- .feat_names = {
23	- NULL, NULL, "avx512-4vnniw", "avx512-4fmaps",
24	- NULL, NULL, NULL, NULL,
25	-- NULL, NULL, NULL, NULL,
26	-+ NULL, NULL, "md-clear", NULL,
27	- NULL, NULL, NULL, NULL,
28	- NULL, NULL, NULL, NULL,
29	- NULL, NULL, NULL, NULL,

Atcp_emu-Fix-oob-access.patch+38-0

@@ -0,0 +1,38 @@
	1	+From 0f7224535cdfec549cd43a5ae4ccde936f50ee95 Mon Sep 17 00:00:00 2001
	2	+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
	3	+Date: Wed, 11 Mar 2020 17:33:46 +0800
	4	+Subject: [PATCH] tcp_emu: Fix oob access
	5	+
	6	+The main loop only checks for one available byte, while we sometimes
	7	+need two bytes.
	8	+---
	9	+ slirp/src/tcp_subr.c \| 6 ++++++
	10	+ 1 file changed, 6 insertions(+)
	11	+
	12	+diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
	13	+index fde9207b..4608942f 100644
	14	+--- a/slirp/src/tcp_subr.c
	15	++++ b/slirp/src/tcp_subr.c
	16	+@@ -895,6 +895,9 @@ tcp_emu(struct socket so, struct mbuf m)
	17	+ break;
	18	+
	19	+ case 5:
	20	++ if (bptr == m->m_data + m->m_len - 1)
	21	++ return 1; /* We need two bytes */
	22	++
	23	+ /*
	24	+ * The difference between versions 1.0 and
	25	+ * 2.0 is here. For future versions of
	26	+@@ -910,6 +913,9 @@ tcp_emu(struct socket so, struct mbuf m)
	27	+ /* This is the field containing the port
	28	+ * number that RA-player is listening to.
	29	+ */
	30	++ if (bptr == m->m_data + m->m_len - 1)
	31	++ return 1; /* We need two bytes */
	32	++
	33	+ lport = (((uint8_t*)bptr)[0] << 8)
	34	+ + ((uint8_t *)bptr)[1];
	35	+ if (lport < 6970)
	36	+--
	37	+2.21.1 (Apple Git-122.3)
	38	+

Atcp_emu-fix-unsafe-snprintf-usages.patch+94-0

@@ -0,0 +1,94 @@
	1	+From 1db8bcc0ec91bb4374b3ffdd03da3c4ede381fb5 Mon Sep 17 00:00:00 2001
	2	+From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
	3	+Date: Wed, 11 Mar 2020 18:52:07 +0800
	4	+Subject: [PATCH] tcp_emu: fix unsafe snprintf() usages
	5	+MIME-Version: 1.0
	6	+Content-Type: text/plain; charset=UTF-8
	7	+Content-Transfer-Encoding: 8bit
	8	+
	9	+Various calls to snprintf() assume that snprintf() returns "only" the
	10	+number of bytes written (excluding terminating NUL).
	11	+
	12	+https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
	13	+
	14	+"Upon successful completion, the snprintf() function shall return the
	15	+number of bytes that would be written to s had n been sufficiently
	16	+large excluding the terminating null byte."
	17	+
	18	+Before patch ce131029, if there isn't enough room in "m_data" for the
	19	+"DCC ..." message, we overflow "m_data".
	20	+
	21	+After the patch, if there isn't enough room for the same, we don't
	22	+overflow "m_data", but we set "m_len" out-of-bounds. The next time an
	23	+access is bounded by "m_len", we'll have a buffer overflow then.
	24	+
	25	+Use slirp_fmt*() to fix potential OOB memory access.
	26	+Reported-by: default avatarLaszlo Ersek <lersek@redhat.com>
	27	+Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
	28	+Reviewed-by: Samuel Thibault's avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
	29	+Message-Id: <20200127092414.169796-7-marcandre.lureau@redhat.com>
	30	+---
	31	+ slirp/src/tcp_subr.c \| 12 ++++++------
	32	+ 1 file changed, 6 insertions(+), 6 deletions(-)
	33	+
	34	+diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
	35	+index e898fd03..88dadc76 100644
	36	+--- a/slirp/src/tcp_subr.c
	37	++++ b/slirp/src/tcp_subr.c
	38	+@@ -707,7 +707,7 @@ tcp_emu(struct socket so, struct mbuf m)
	39	+ n4 = (laddr & 0xff);
	40	+
	41	+ m->m_len = bptr - m->m_data; /* Adjust length */
	42	+- m->m_len += snprintf(bptr, M_FREEROOM(m),
	43	++ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
	44	+ "ORT %d,%d,%d,%d,%d,%d\r\n%s",
	45	+ n1, n2, n3, n4, n5, n6, x==7?buff:"");
	46	+ return 1;
	47	+@@ -740,7 +740,7 @@ tcp_emu(struct socket so, struct mbuf m)
	48	+ n4 = (laddr & 0xff);
	49	+
	50	+ m->m_len = bptr - m->m_data; /* Adjust length */
	51	+- m->m_len += snprintf(bptr, M_FREEROOM(m),
	52	++ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
	53	+ "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
	54	+ n1, n2, n3, n4, n5, n6, x==7?buff:"");
	55	+
	56	+@@ -766,7 +766,7 @@ tcp_emu(struct socket so, struct mbuf m)
	57	+ if (m->m_data[m->m_len-1] == '\0' && lport != 0 &&
	58	+ (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
	59	+ htons(lport), SS_FACCEPTONCE)) != NULL)
	60	+- m->m_len = snprintf(m->m_data, M_ROOM(m),
	61	++ m->m_len = slirp_fmt0(m->m_data, M_ROOM(m),
	62	+ "%d", ntohs(so->so_fport)) + 1;
	63	+ return 1;
	64	+
	65	+@@ -786,7 +786,7 @@ tcp_emu(struct socket so, struct mbuf m)
	66	+ return 1;
	67	+ }
	68	+ m->m_len = bptr - m->m_data; /* Adjust length */
	69	+- m->m_len += snprintf(bptr, M_FREEROOM(m),
	70	++ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
	71	+ "DCC CHAT chat %lu %u%c\n",
	72	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	73	+ ntohs(so->so_fport), 1);
	74	+@@ -797,7 +797,7 @@ tcp_emu(struct socket so, struct mbuf m)
	75	+ return 1;
	76	+ }
	77	+ m->m_len = bptr - m->m_data; /* Adjust length */
	78	+- m->m_len += snprintf(bptr, M_FREEROOM(m),
	79	++ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
	80	+ "DCC SEND %s %lu %u %u%c\n", buff,
	81	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	82	+ ntohs(so->so_fport), n1, 1);
	83	+@@ -808,7 +808,7 @@ tcp_emu(struct socket so, struct mbuf m)
	84	+ return 1;
	85	+ }
	86	+ m->m_len = bptr - m->m_data; /* Adjust length */
	87	+- m->m_len += snprintf(bptr, M_FREEROOM(m),
	88	++ m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
	89	+ "DCC MOVE %s %lu %u %u%c\n", buff,
	90	+ (unsigned long)ntohl(so->so_faddr.s_addr),
	91	+ ntohs(so->so_fport), n1, 1);
	92	+--
	93	+2.21.1 (Apple Git-122.3)
	94	+

Dusb-tablet-fix-serial-compat-property.patch+0-39

	@@ -1,39 +0,0 @@
1	-From 665218cc085c5c1ec871d8af6986903313638fbf Mon Sep 17 00:00:00 2001
2	-From: Gerd Hoffmann <kraxel@redhat.com>
3	-Date: Mon, 20 May 2019 10:18:05 +0200
4	-Subject: [PATCH] usb-tablet: fix serial compat property
5	-MIME-Version: 1.0
6	-Content-Type: text/plain; charset=UTF-8
7	-Content-Transfer-Encoding: 8bit
8	-
9	-s/kbd/tablet/, fixes cut+paste bug.
10	-
11	-Cc: qemu-stable@nongnu.org
12	-Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
13	-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
14	-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
15	-Reviewed-by: Laurent Vivier <lvivier@redhat.com>
16	-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
17	-Message-id: 20190520081805.15019-1-kraxel@redhat.com
18	-(cherry picked from commit 442bac16a6cd708a9f87adb0a263f9d833f03ed5)
19	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
20	----
21	- hw/core/machine.c \| 2 +-
22	- 1 file changed, 1 insertion(+), 1 deletion(-)
23	-
24	-diff --git a/hw/core/machine.c b/hw/core/machine.c
25	-index 743fef2898..b6766632d9 100644
26	---- a/hw/core/machine.c
27	-+++ b/hw/core/machine.c
28	-@@ -33,7 +33,7 @@ GlobalProperty hw_compat_3_1[] = {
29	- { "tpm-tis", "ppi", "false" },
30	- { "usb-kbd", "serial", "42" },
31	- { "usb-mouse", "serial", "42" },
32	-- { "usb-kbd", "serial", "42" },
33	-+ { "usb-tablet", "serial", "42" },
34	- { "virtio-blk-device", "discard", "false" },
35	- { "virtio-blk-device", "write-zeroes", "false" },
36	- };
37	---
38	-2.19.1
39	-

Dusbredir-fix-buffer-overflow-on-vmload.patch+0-55

	@@ -1,55 +0,0 @@
1	-From e86e620656becb37890a6d91e0148c74f3e43f3d Mon Sep 17 00:00:00 2001
2	-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
3	-Date: Wed, 7 Aug 2019 12:40:48 +0400
4	-Subject: [PATCH] usbredir: fix buffer-overflow on vmload
5	-MIME-Version: 1.0
6	-Content-Type: text/plain; charset=UTF-8
7	-Content-Transfer-Encoding: 8bit
8	-
9	-If interface_count is NO_INTERFACE_INFO, let's not access the arrays
10	-out-of-bounds.
11	-
12	-==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40
13	-READ of size 1 at 0x625000243930 thread T0
14	- #0 0x5642068086a7 in usbredir_check_bulk_receiving /home/elmarco/src/qemu/hw/usb/redirect.c:1503
15	- #1 0x56420681301c in usbredir_post_load /home/elmarco/src/qemu/hw/usb/redirect.c:2154
16	- #2 0x5642068a56c2 in vmstate_load_state /home/elmarco/src/qemu/migration/vmstate.c:168
17	- #3 0x56420688e2ac in vmstate_load /home/elmarco/src/qemu/migration/savevm.c:829
18	- #4 0x5642068980cb in qemu_loadvm_section_start_full /home/elmarco/src/qemu/migration/savevm.c:2211
19	- #5 0x564206899645 in qemu_loadvm_state_main /home/elmarco/src/qemu/migration/savevm.c:2395
20	- #6 0x5642068998cf in qemu_loadvm_state /home/elmarco/src/qemu/migration/savevm.c:2467
21	- #7 0x56420685f3e9 in process_incoming_migration_co /home/elmarco/src/qemu/migration/migration.c:449
22	- #8 0x564207106c47 in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:115
23	- #9 0x7f0c0604e37f (/lib64/libc.so.6+0x4d37f)
24	-
25	-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
26	-Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
27	-Reviewed-by: Li Qiang <liq3ea@gmail.com>
28	-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
29	-Message-id: 20190807084048.4258-1-marcandre.lureau@redhat.com
30	-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
31	-(cherry picked from commit 7b84b90966568da0e05655ecaa78c209300aae6e)
32	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
33	----
34	- hw/usb/redirect.c \| 5 +++++
35	- 1 file changed, 5 insertions(+)
36	-
37	-diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
38	-index 7cb6b120d4..586c7db025 100644
39	---- a/hw/usb/redirect.c
40	-+++ b/hw/usb/redirect.c
41	-@@ -1494,6 +1494,11 @@ static void usbredir_check_bulk_receiving(USBRedirDevice *dev)
42	- for (i = EP2I(USB_DIR_IN); i < MAX_ENDPOINTS; i++) {
43	- dev->endpoint[i].bulk_receiving_enabled = 0;
44	- }
45	-+
46	-+ if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
47	-+ return;
48	-+ }
49	-+
50	- for (i = 0; i < dev->interface_info.interface_count; i++) {
51	- quirks = usb_get_quirks(dev->device_info.vendor_id,
52	- dev->device_info.product_id,
53	---
54	-2.19.1
55	-

Dutil-hbitmap-update-orig_size-on-truncate.patch+0-48

	@@ -1,48 +0,0 @@
1	-From fc5c701636127a0b90cd7ab564da0354d06809dc Mon Sep 17 00:00:00 2001
2	-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
3	-Date: Mon, 5 Aug 2019 15:01:20 +0300
4	-Subject: [PATCH] util/hbitmap: update orig_size on truncate
5	-
6	-Without this, hbitmap_next_zero and hbitmap_next_dirty_area are broken
7	-after truncate. So, orig_size is broken since it's introduction in
8	-76d570dc495c56bb.
9	-
10	-Fixes: 76d570dc495c56bb
11	-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
12	-Message-id: 20190805120120.23585-1-vsementsov@virtuozzo.com
13	-Reviewed-by: Max Reitz <mreitz@redhat.com>
14	-Cc: qemu-stable@nongnu.org
15	-Signed-off-by: Max Reitz <mreitz@redhat.com>
16	-(cherry picked from commit 4e4de222799634d8159ee7b9303b9e1b45c6be2c)
17	-Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
18	----
19	- util/hbitmap.c \| 6 +++++-
20	- 1 file changed, 5 insertions(+), 1 deletion(-)
21	-
22	-diff --git a/util/hbitmap.c b/util/hbitmap.c
23	-index 7905212a8b..bcc0acdc6a 100644
24	---- a/util/hbitmap.c
25	-+++ b/util/hbitmap.c
26	-@@ -53,7 +53,9 @@
27	- */
28	-
29	- struct HBitmap {
30	-- /* Size of the bitmap, as requested in hbitmap_alloc. */
31	-+ /*
32	-+ * Size of the bitmap, as requested in hbitmap_alloc or in hbitmap_truncate.
33	-+ */
34	- uint64_t orig_size;
35	-
36	- /* Number of total bits in the bottom level. */
37	-@@ -732,6 +734,8 @@ void hbitmap_truncate(HBitmap *hb, uint64_t size)
38	- uint64_t num_elements = size;
39	- uint64_t old;
40	-
41	-+ hb->orig_size = size;
42	-+
43	- /* Size comes in as logical elements, adjust for granularity. */
44	- size = (size + (1ULL << hb->granularity) - 1) >> hb->granularity;
45	- assert(size <= ((uint64_t)1 << HBITMAP_LOG_MAX_SIZE));
46	---
47	-2.19.1
48	-

Dvhost-fix-vhost_log-size-overflow-during-migration.patch+0-69

Dvirtio-balloon-Better-names-for-offset-variables.patch+0-113

Dvirtio-balloon-Fix-QEMU-crashes-on-pagesize-BALLOON_.patch+0-64

Dvirtio-balloon-Fix-wrong-sign-extension-of-PFNs.patch+0-41

Dvirtio-balloon-Rework-pbp-tracking-data.patch+0-144

Dvirtio-balloon-Simplify-deflate-with-pbp.patch+0-67

Dvirtio-balloon-Use-temporary-PBP-only.patch+0-136

Dvirtio-balloon-don-t-track-subpages-for-the-PBP.patch+0-62

Dvirtio-balloon-fix-QEMU-4.0-config-size-migration-in.patch+0-148

Dvirtio-balloon-free-pbp-more-aggressively.patch+0-130

Dvirtio-pci-fix-missing-device-properties.patch+0-101

Dvl-Fix-drive-blockdev-persistent-reservation-management.patch+0-55