# changelog

author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 1.4.0 release for OL7 which includes the following fixed CVEs:
    {CVE-2019-14584} {CVE-2019-14562} {CVE-2019-11098} {CVE-2019-14559} {CVE-2019-14575} {CVE-2019-14559} {CVE-2019-14587} {CVE-2019-14558} {CVE-2019-14586} {CVE-2019-14563}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 1.5.0 release for OL7 which includes the following fixed CVEs:
    {CVE-2021-23840} {CVE-2021-23841}


author: Aaron Young <aaron.young@oracle.com>
changelog:
  - Create new 1.5.0 release for OL7 which includes the following fixed CVEs:
    {CVE-2021-23840} {CVE-2021-23841} {CVE-2021-38575}


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.1.1-2.el7
changelog:
  - Document CVE-2020-13765 as fixed (Karl Heubaum)  [Orabug: 31463250]  {CVE-2020-13765}
  - kvm: Reallocate dirty_bmap when we change a slot (Dr. David Alan Gilbert)  [Orabug: 31076399] 
  - kvm: split too big memory section on several memslots (Igor Mammedov)  [Orabug: 31076399] 
  - target/i386: do not set unsupported VMX secondary execution controls (Vitaly Kuznetsov)  [Orabug: 31463710] 
  - target/i386: add VMX definitions (Paolo Bonzini)  [Orabug: 31463710] 
  - ati-vga: check mm_index before recursive call (CVE-2020-13800) (Prasad J Pandit)  [Orabug: 31452206]  {CVE-2020-13800}
  - es1370: check total frame count against current frame (Prasad J Pandit)  [Orabug: 31463235]  {CVE-2020-13361}
  - ati-vga: Fix checks in ati_2d_blt() to avoid crash (BALATON Zoltan)  [Orabug: 31238432]  {CVE-2020-11869}
  - libslirp: Update to stable-4.2 to fix CVE-2020-1983 (Karl Heubaum)  [Orabug: 31241227]  {CVE-2020-1983}
  - Document CVEs as fixed (Karl Heubaum)   {CVE-2019-12068} {CVE-2019-15034}
  - libslirp: Update to version 4.2.0 to fix CVEs (Karl Heubaum)  [Orabug: 30274592] [Orabug: 30869830]  {CVE-2019-15890} {CVE-2020-8608}
  - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini)  [Orabug: 31124041] 
  - qemu-img: Add --target-is-zero to convert (David Edmondson)  
  - vnc: fix memory leak when vnc disconnect (Li Qiang)  [Orabug: 30996427]  {CVE-2019-20382}
  - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 31124035]  {CVE-2020-1711}
  - qemu.spec: Remove "BuildRequires: kernel" (Karl Heubaum)  [Orabug: 31124047]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.1.1-3.el7
changelog:
  - buildrpm/spec files: Don't package elf2dmp (Karl Heubaum)  [Orabug: 31657424] 
  - qemu-kvm.spec: Enable the block-curl package (Karl Heubaum)  [Orabug: 31657424] 
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 31657424]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:4.2.1-1.el7
changelog:
  - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Update coding style to make checkpatch.pl happy (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daudé)  [Orabug: 31414336]  {CVE-2020-13253}
  - hw/sd/sdcard: Simplify realize() a bit (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - hw/sd/sdcard: Restrict Class 6 commands to SCSD cards (Philippe Mathieu-Daudé)  [Orabug: 31414336] 
  - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
  - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890} {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361} {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
  - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126} {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378} {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
  - qemu-kvm.spec: Add .spec file for OL8 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu.spec: Add .spec file for OL7 (Karl Heubaum)  [Orabug: 30618035] 
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30618035] 
  - vhost.conf: Initial vhost.conf (Karl Heubaum)  [Orabug: 30618035] 
  - parfait: Add buildrpm/parfait-qemu.conf (Karl Heubaum)  [Orabug: 30618035] 
  - virtio: Set PCI subsystem vendor ID to Oracle (Karl Heubaum)  [Orabug: 30618035] 
  - qemu_regdump.py: Initial qemu_regdump.py (Karl Heubaum)  [Orabug: 30618035] 
  - qmp-regdump: Initial qmp-regdump (Karl Heubaum)  [Orabug: 30618035] 
  - bridge.conf: Initial bridge.conf (Karl Heubaum)  [Orabug: 30618035] 
  - kvm.conf: Initial kvm.conf (Karl Heubaum)  [Orabug: 30618035] 
  - 80-kvm.rules: Initial 80-kvm.rules (Karl Heubaum)  [Orabug: 30618035] 
  - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
  - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]  {CVE-2020-13362}
  - memory: Revert "memory: accept mismatching sizes in memory_region_access_valid" (Michael S. Tsirkin)  [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-2.el7
changelog:
  - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella)  [Orabug: 31667649]  {CVE-2020-15863}
  - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella)  [Orabug: 31737809]  {CVE-2020-16092}
  - migration: fix memory leak in qmp_migrate_set_parameters (Zheng Chuan)  [Orabug: 31806256] 
  - virtio-net: fix removal of failover device (Juan Quintela)  [Orabug: 31806255] 
  - pvpanic: implement crashloaded event handling (Zhenwei Pi)  [Orabug: 31677154] 
  - pvpanic: introduce crashloaded for pvpanic (Zhenwei Pi)  [Orabug: 31677154]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-3.el7
changelog:
  - qemu-kvm.spec: Install block storage module RPMs by default (Karl Heubaum)  [Orabug: 31943789] 
  - qemu-kvm.spec: Enable block-ssh module RPM (Karl Heubaum)  [Orabug: 31943763] 
  - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit)  [Orabug: 31901690]  {CVE-2020-25625}
  - hw: ehci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - hw: xhci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
  - qemu.spec: Enable '-Werror' for OL7 builds (Mark Kanda)  [Orabug: 31922718] 
  - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann)  [Orabug: 31848849]  {CVE-2020-14364}
  - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda)  [Orabug: 31855502] [Orabug: 31855427]  {CVE-2020-12829} {CVE-2020-14415}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-4.el7
changelog:
  - Document CVE-2020-25723 as fixed (Mark Kanda)  [Orabug: 32222397]  {CVE-2020-25084} {CVE-2020-25723}
  - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit)  [Orabug: 32217517]  {CVE-2020-28916}
  - i386: Add 2nd Generation AMD EPYC processors (Moger, Babu)  [Orabug: 32217570] 
  - libslirp: Update version to include CVE fixes (Mark Kanda)  [Orabug: 32208456] [Orabug: 32208462]  {CVE-2020-29129} {CVE-2020-29130}
  - Document CVE-2020-25624 as fixed (Mark Kanda)  [Orabug: 32212527]  {CVE-2020-25624} {CVE-2020-25625}
  - pvpanic: Advertise the PVPANIC_CRASHLOADED event support (Paolo Bonzini)  [Orabug: 32102853] 
  - ati: check x y display parameter values (Prasad J Pandit)  [Orabug: 32108251]  {CVE-2020-27616}
  - Add AArch64 support for QMP regdump tool and sosreport plugin (Mark Kanda)  [Orabug: 32080658] 
  - Add qemu_regdump sosreport plugin support for '-mon' QMP sockets (Mark Kanda)  
  - migration/dirtyrate: present dirty rate only when querying the rate has completed (Chuan Zheng)  
  - migration/dirtyrate: record start_time and calc_time while at the measuring state (Chuan Zheng)  
  - migration/dirtyrate: Add trace_calls to make it easier to debug (Chuan Zheng)  
  - migration/dirtyrate: Implement qmp_cal_dirty_rate()/qmp_get_dirty_rate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement calculate_dirtyrate() function (Chuan Zheng)  
  - migration/dirtyrate: Implement set_sample_page_period() and is_sample_period_valid() (Chuan Zheng)  
  - migration/dirtyrate: skip sampling ramblock with size below MIN_RAMBLOCK_SIZE (Chuan Zheng)  
  - migration/dirtyrate: Compare page hash results for recorded sampled page (Chuan Zheng)  
  - migration/dirtyrate: Record hash results for each sampled page (Chuan Zheng)  
  - migration/dirtyrate: move RAMBLOCK_FOREACH_MIGRATABLE into ram.h (Chuan Zheng)  
  - migration/dirtyrate: Add dirtyrate statistics series functions (Chuan Zheng)  
  - migration/dirtyrate: Add RamblockDirtyInfo to store sampled page info (Chuan Zheng)  
  - migration/dirtyrate: add DirtyRateStatus to denote calculation status (Chuan Zheng)  
  - migration/dirtyrate: setup up query-dirtyrate framwork (Chuan Zheng)  
  - ram_addr: Split RAMBlock definition (Juan Quintela)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-5.el7
changelog:
  - qemu.spec: use --tls-priority=NORMAL for OL7 (Elena Ufimtseva)  
  - hostmem: fix default "prealloc-threads" count (Mark Kanda)  [Orabug: 32472127] 
  - hostmem: introduce "prealloc-threads" property (Igor Mammedov)  
  - qom: introduce object_register_sugar_prop (Paolo Bonzini)  
  - migration/multifd: Do error_free after migrate_set_error to avoid memleaks (Pan Nengyuan)  
  - multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling migration (Chuan Zheng)  
  - migration/multifd: fix hangup with TLS-Multifd due to blocking handshake (Chuan Zheng)  
  - migration/tls: add trace points for multifd-tls (Chuan Zheng)  
  - migration/tls: add support for multifd tls-handshake (Chuan Zheng)  
  - migration/tls: extract cleanup function for common-use (Chuan Zheng)  
  - migration/multifd: fix memleaks in multifd_new_send_channel_async (Pan Nengyuan)  
  - migration/multifd: fix nullptr access in multifd_send_terminate_threads (Zhimin Feng)  
  - migration/tls: add tls_hostname into MultiFDSendParams (Chuan Zheng)  
  - migration/tls: extract migration_tls_client_create for common-use (Chuan Zheng)  
  - migration/tls: save hostname into MigrationState (Chuan Zheng)  
  - tests/qtest: add a test case for pvpanic-pci (Mihai Carabas)  
  - pvpanic : update pvpanic spec document (Mihai Carabas)  
  - hw/misc/pvpanic: add PCI interface support (Mihai Carabas)  
  - hw/misc/pvpanic: split-out generic and bus dependent code (Mihai Carabas)  
  - 9pfs: Fully restart unreclaim loop (CVE-2021-20181) (Greg Kurz)  [Orabug: 32441198]  {CVE-2021-20181}
  - ide: atapi: check logical block address and read size (CVE-2020-29443) (Prasad J Pandit)  [Orabug: 32393835]  {CVE-2020-29443}
  - Document CVE-2019-20808 as fixed (Mark Kanda)  [Orabug: 32339196]  {CVE-2019-20808}
  - block/iscsi:fix heap-buffer-overflow in iscsi_aio_ioctl_cb (Chen Qun)  [Orabug: 32339207]  {CVE-2020-11947}
  - net: remove an assert call in eth_get_gso_type (Prasad J Pandit)  [Orabug: 32102583]  {CVE-2020-27617}
  - nvdimm: honor -object memory-backend-file, readonly=on option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - hostmem-file: add readonly=on|off option (Stefan Hajnoczi)  [Orabug: 32265408] 
  - memory: add readonly support to memory_region_init_ram_from_file() (Stefan Hajnoczi)  [Orabug: 32265408]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-6.el7
changelog:
  - i386/pc: Keep PCI 64-bit hole within usable IOVA space (Joao Martins)  
  - pc/cmos: Adjust CMOS above 4G memory size according to 1Tb boundary (Joao Martins)  
  - i386/pc: Round up the hotpluggable memory within valid IOVA ranges (Joao Martins)  
  - i386/pc: Account IOVA reserved ranges above 4G boundary (Joao Martins)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-7.el7
changelog:
  - arm/virt: Add memory hot remove support (Mihai Carabas)  [Orabug: 32643506] 
  - i386/pc: consolidate usable iova iteration (Joao Martins)  
  - i386/acpi: fix SRAT ranges in accordance to usable IOVA (Joao Martins)  
  - migration: increase listening socket backlog (Elena Ufimtseva)  [Orabug: 32792545] 
  - multifd: Make multifd_save_setup() get an Error parameter (Juan Quintela)  
  - multifd: Make multifd_load_setup() get an Error parameter (Juan Quintela)  
  - migration: fix maybe-uninitialized warning (Marc-André Lureau)  
  - migration: Fix the re-run check of the migrate-incoming command (Yury Kotov)  
  - multifd: Initialize local variable (Juan Quintela)  
  - multifd: Be consistent about using uint64_t (Juan Quintela)  
  - Bug #1829242 correction. (Alexey Romko)  
  - migration/multifd: fix destroyed mutex access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: fix nullptr access in terminating multifd threads (Jiahui Cen)  
  - migration/multifd: not use multifd during postcopy (Wei Yang)  
  - migration/multifd: clean pages after filling packet (Wei Yang)  
  - migration: Make sure that we don't call write() in case of error (Juan Quintela)  
  - migration: fix multifd_send_pages() next channel (Laurent Vivier)  
  - migration/multifd: bypass uuid check for initial packet (Elena Ufimtseva)  [Orabug: 32610480] 
  - migration/tls: add error handling in multifd_tls_handshake_thread (Hao Wang)  
  - migration/tls: fix inverted semantics in multifd_channel_connect (Hao Wang)  
  - migration/multifd: do not access uninitialized multifd_recv_state (Elena Ufimtseva)  [Orabug: 32795384] 
  - io/channel-tls.c: make qio_channel_tls_shutdown thread-safe (Lukas Straub)  
  - qemu.spec: Enable qemu-guest-agent RPM for OL7 (Karl Heubaum)  [Orabug: 32415543] 
  - virtio-net: Set mac address to hardware if the peer is vdpa (Cindy Lu)  
  - net: Add vhost-vdpa in show_netdevs() (Cindy Lu)  
  - vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup (Cindy Lu)  
  - hw/virtio/vhost-vdpa: Fix Coverity CID 1432864 (Philippe Mathieu-Daudé)  
  - vhost-vdpa: negotiate VIRTIO_NET_F_STATUS with driver (Si-Wei Liu)  
  - configure: Fix build dependencies with vhost-vdpa. (Laurent Vivier)  
  - configure: simplify vhost condition with Kconfig (Marc-André Lureau)  
  - vhost-vdpa: add trace-events (Laurent Vivier)  
  - dma/pl330: Fix qemu_hexdump() usage in pl330.c (Mark Kanda)  
  - util/hexdump: introduce qemu_hexdump_line() (Laurent Vivier)  
  - util/hexdump: Reorder qemu_hexdump() arguments (Philippe Mathieu-Daudé)  
  - util/hexdump: Convert to take a void pointer argument (Philippe Mathieu-Daudé)  
  - net/colo-compare.c: Only hexdump packets if tracing is enabled (Lukas Straub)  
  - vhost-vdpa: batch updating IOTLB mappings (Jason Wang)  
  - vhost: switch to use IOTLB v2 format (Jason Wang)  
  - vhost-vdpa: remove useless variable (Laurent Vivier)  
  - virtio: vdpa: omit check return of g_malloc (Li Qiang)  
  - vhost-vdpa: fix indentation in vdpa_ops (Stefano Garzarella)  
  - virtio-net: check the existence of peer before accessing vDPA config (Jason Wang)  
  - virtio-pci: fix wrong index in virtio_pci_queue_enabled (Yuri Benditovich)  
  - virtio-pci: fix virtio_pci_queue_enabled() (Laurent Vivier)  
  - vhost-vdpa :Fix Coverity CID 1430270 / CID 1420267 (Cindy Lu)  
  - vhost-vdpa: fix the compile issue without kvm (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa net client (Cindy Lu)  
  - vhost-vdpa: introduce vhost-vdpa backend (Cindy Lu)  
  - linux headers: sync to 5.9-rc4 (Jason Wang)  
  - Linux headers: update (Cornelia Huck)  
  - virtio-net: fix rsc_ext compat handling (Cornelia Huck)  
  - linux-headers: update against Linux 5.7-rc3 (Cornelia Huck)  
  - virtiofsd: Pull in kernel's fuse.h (Dr. David Alan Gilbert)  
  - linux-headers: Update (Bharata B Rao)  
  - vhost_net: introduce set_config & get_config (Cindy Lu)  
  - vhost: implement vhost_force_iommu method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_force_iommu (Cindy Lu)  
  - vhost: implement vhost_vq_get_addr method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_vq_get_addr (Cindy Lu)  
  - vhost: implement vhost_dev_start method (Cindy Lu)  
  - vhost: introduce new VhostOps vhost_dev_start (Cindy Lu)  
  - vhost: check the existence of vhost_set_iotlb_callback (Jason Wang)  
  - virtio-pci: implement queue_enabled method (Jason Wang)  
  - virtio-bus: introduce queue_enabled method (Jason Wang)  
  - vhost_net: use the function qemu_get_peer (Cindy Lu)  
  - net: introduce qemu_get_peer (Cindy Lu)  
  - vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM (Jason Wang)  
  - imx7-ccm: add digprog mmio write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - tz-ppc: add dummy read/write methods (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - spapr_pci: add spapr msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - nvram: add nrf51_soc flash read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - prep: add ppc-parity write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - vfio: add quirk device write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - pci-host: designware: add pcie-msi read method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - hw/pci-host: add pci-intack write method (Prasad J Pandit)  [Orabug: 31576552]  {CVE-2020-15469}
  - oslib-posix: initialize backend memory objects in parallel (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: refactor memory prealloc threads (Mark Kanda)  [Orabug: 32555402] 
  - oslib-posix: take lock before qemu_cond_broadcast (Bauerchen)  [Orabug: 32555402] 
  - oslib-posix: initialize mutex and condition variable (Paolo Bonzini)  [Orabug: 32555402] 
  - mem-prealloc: optimize large guest startup (bauerchen)  [Orabug: 32555402] 
  - i386: Add the support for AMD EPYC 3rd generation processors (Babu Moger)  
  - acpi: cpuhp: document CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: add CPHP_GET_CPU_ID_CMD command (Igor Mammedov)  
  - acpi: cpuhp: spec: add typical usecases (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify store into 'Command data' when 'Command field' == 0 (Igor Mammedov)  
  - acpi: cpuhp: spec: fix 'Command data' description (Igor Mammedov)  
  - acpi: cpuhp: spec: clarify 'CPU selector' register usage and endianness (Igor Mammedov)  
  - acpi: cpuhp: introduce 'Command data 2' field (Igor Mammedov)  
  - x86: ich9: let firmware negotiate 'CPU hot-unplug with SMI' feature (Igor Mammedov)  
  - x86: ich9: factor out "guest_cpu_hotplug_features" (Igor Mammedov)  
  - x86: acpi: let the firmware handle pending "CPU remove" events in SMM (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpu_unplug (Igor Mammedov)  
  - acpi: cpuhp: introduce 'firmware performs eject' status/control bits (Igor Mammedov)  
  - x68: acpi: trigger SMI before sending hotplug Notify event to OSPM (Igor Mammedov)  
  - x86: acpi: introduce the PCI0.SMI0 ACPI device (Igor Mammedov)  
  - x86: acpi: introduce AcpiPmInfo::smi_on_cpuhp (Igor Mammedov)  
  - x86: ich9: expose "smi_negotiated_features" as a QOM property (Igor Mammedov)  
  - tests: acpi: mark to be changed tables in bios-tables-test-allowed-diff (Igor Mammedov)  
  - acpi: add aml_land() and aml_break() primitives (Igor Mammedov)  
  - x86: cpuhp: refuse cpu hot-unplug request earlier if not supported (Igor Mammedov)  
  - x86: cpuhp: prevent guest crash on CPU hotplug when broadcast SMI is in use (Igor Mammedov)  
  - x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (Igor Mammedov)  
  - q35: implement 128K SMRAM at default SMBASE address (Igor Mammedov)  
  - hw/intc/arm_gic: Fix interrupt ID in GICD_SGIR register (Philippe Mathieu-Daudé)  [Orabug: 32470471]  {CVE-2021-20221}
  - memory: clamp cached translation in case it points to an MMIO region (Paolo Bonzini)  [Orabug: 32252673]  {CVE-2020-27821}
  - hw/sd/sdhci: Fix DMA Transfer Block Size field (Philippe Mathieu-Daudé)  [Orabug: 32613470]  {CVE-2021-3409}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-9.el7
changelog:
  - Revert "oslib-posix: refactor memory prealloc threads" (Mark Kanda)  [Orabug: 32903662] 
  - Revert "oslib-posix: initialize backend memory objects in parallel" (Mark Kanda)  [Orabug: 32903662]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-10.el7
changelog:
  - e1000: fail early for evil descriptor (Jason Wang)  [Orabug: 32560552]  {CVE-2021-20257}
  - Document CVE-2020-27661 as fixed (Mark Kanda)  [Orabug: 32960200]  {CVE-2020-27661}
  - block: Avoid stale pointer dereference in blk_get_aio_context() (Greg Kurz)  
  - block: Fix blk->in_flight during blk_wait_while_drained() (Kevin Wolf)  
  - block: Increase BB.in_flight for coroutine and sync interfaces (Kevin Wolf)  
  - block-backend: Reorder flush/pdiscard function definitions (Kevin Wolf)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-11.el7
changelog:
  - pvrdma: Fix the ring init error flow (CVE-2021-3608) (Marcel Apfelbaum)  [Orabug: 33120142]  {CVE-2021-3608}
  - pvrdma: Ensure correct input on ring init (CVE-2021-3607) (Marcel Apfelbaum)  [Orabug: 33120146]  {CVE-2021-3607}
  - hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582) (Marcel Apfelbaum)  [Orabug: 33120084]  {CVE-2021-3582}
  - vhost-user-gpu: reorder free calls. (Gerd Hoffmann)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: abstract vg_cleanup_mapping_iov (Li Qiang)  [Orabug: 32950716]  {CVE-2021-3546}
  - vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) (Li Qiang)  [Orabug: 32950716]  {CVE-2021-3546}
  - vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) (Li Qiang)  [Orabug: 32950701]  {CVE-2021-3544}
  - vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) (Li Qiang)  [Orabug: 32950708]  {CVE-2021-3545}
  - usb: limit combined packets to 1 MiB (CVE-2021-3527) (Gerd Hoffmann)  [Orabug: 32842778]  {CVE-2021-3527}
  - usb/redir: avoid dynamic stack allocation (CVE-2021-3527) (Gerd Hoffmann)  [Orabug: 32842778]  {CVE-2021-3527}
  - mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392) (Michael Tokarev)  [Orabug: 32470463]  {CVE-2021-3392}


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-12.el7
changelog:
  - hw/pflash_cfi01: Allow backing devices to be smaller than memory region (David Edmondson)  
  - pcie: expire pending delete (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: fast unplug when slot power is off (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: factor out pcie_cap_slot_unplug() (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: add power indicator blink check (Gerd Hoffmann)  [Orabug: 33450706] 
  - pcie: implement slot power control for pcie root ports (Gerd Hoffmann)  [Orabug: 33450706] 
  - pci: implement power state (Gerd Hoffmann)  [Orabug: 33450706] 
  - hw/pci/pcie: Move hot plug capability check to pre_plug callback (Julia Suvorova)  [Orabug: 33450706] 
  - hw/pci/pcie: Replace PCI_DEVICE() casts with existing variable (Julia Suvorova)  [Orabug: 33450706] 
  - hw/pci/pcie: Forbid hot-plug if it's disabled on the slot (Julia Suvorova)  [Orabug: 33450706] 
  - pcie_root_port: Add hotplug disabling option (Julia Suvorova)  [Orabug: 33450706] 
  - qdev-monitor: Forbid repeated device_del (Julia Suvorova)  [Orabug: 33450706] 
  - i386:acpi: Remove _HID from the SMBus ACPI entry (Corey Minyard)  
  - uas: add stream number sanity checks. (Gerd Hoffmann)  [Orabug: 33280793]  {CVE-2021-3713}
  - usbredir: fix free call (Gerd Hoffmann)  [Orabug: 33198441]  {CVE-2021-3682}
  - hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands (Mauro Matteo Cascella)  [Orabug: 33548490]  {CVE-2021-3930}
  - e1000: fix tx re-entrancy problem (Jon Maloy)  [Orabug: 32560552]  {CVE-2021-20257}
  - Update libslirp to v4.6.1 (Marc-André Lureau)  [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420]  {CVE-2020-10756} {CVE-2020-1983} {CVE-2020-29129} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - virtio-net-pci: Don't use "efi-virtio.rom" on AArch64 (Mark Kanda)  
  - MAINTAINERS: Add ACPI/HEST/GHES entries (Dongjiu Geng)  
  - target-arm: kvm64: handle SIGBUS signal from kernel or KVM (Dongjiu Geng)  
  - ACPI: Record Generic Error Status Block(GESB) table (Dongjiu Geng)  
  - KVM: Move hwpoison page related functions into kvm-all.c (Dongjiu Geng)  
  - ACPI: Record the Generic Error Status Block address (Dongjiu Geng)  
  - ACPI: Build Hardware Error Source Table (Dongjiu Geng)  
  - ACPI: Build related register address fields via hardware error fw_cfg blob (Dongjiu Geng)  
  - docs: APEI GHES generation and CPER record description (Dongjiu Geng)  
  - hw/arm/virt: Introduce a RAS machine option (Dongjiu Geng)  
  - acpi: nvdimm: change NVDIMM_UUID_LE to a common macro (Dongjiu Geng)  
  - block/curl: HTTP header field names are case insensitive (David Edmondson)  [Orabug: 33287589] 
  - block/curl: HTTP header fields allow whitespace around values (David Edmondson)  [Orabug: 33287589]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-12.1.el7
changelog:
  - Update slirp to address various CVEs (Mark Kanda)  [Orabug: 32208456] [Orabug: 33014409] [Orabug: 33014414] [Orabug: 33014417] [Orabug: 33014420]  {CVE-2020-29129} {CVE-2020-29130} {CVE-2021-3592} {CVE-2021-3593} {CVE-2021-3594} {CVE-2021-3595}
  - Revert "Update libslirp to v4.6.1" (Mark Kanda)  [Orabug: 33607100]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-14.el7
changelog:
  - scsi: fix sense code for EREMOTEIO (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: move host_status handling into SCSI drivers (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: inline sg_io_sense_from_errno() into the callers. (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi-generic: do not snoop the output of failed commands (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: Add mapping for generic SCSI_HOST status to sense codes (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: Rename linux-specific SG_ERR codes to generic SCSI_HOST error codes (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi: drop 'result' argument from command_complete callback (Hannes Reinecke)  [Orabug: 33537443] 
  - scsi-disk: pass guest recoverable errors through even for rerror=stop (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: pass SCSI status to scsi_handle_rw_error (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi: introduce scsi_sense_from_errno() (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: do not complete requests early for rerror/werror=ignore (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: move scsi_handle_rw_error earlier (Paolo Bonzini)  [Orabug: 33537443] 
  - scsi-disk: convert more errno values back to SCSI statuses (Paolo Bonzini)  [Orabug: 33537443]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-15.el7
changelog:
  - Document CVE-2021-4158 and CVE-2021-3947 as fixed (Mark Kanda)  [Orabug: 33719302] [Orabug: 33754145]  {CVE-2021-3947} {CVE-2021-4158}
  - hw/block/fdc: Kludge missing floppy drive to fix CVE-2021-20196 (Philippe Mathieu-Daudé)  [Orabug: 32439466]  {CVE-2021-20196}
  - hw/block/fdc: Extract blk_create_empty_drive() (Philippe Mathieu-Daudé)  [Orabug: 32439466]  {CVE-2021-20196}
  - net: vmxnet3: validate configuration values during activate (CVE-2021-20203) (Prasad J Pandit)  [Orabug: 32559476]  {CVE-2021-20203}
  - lan9118: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - pcnet: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - rtl8139: switch to use qemu_receive_packet() for loopback (Alexander Bulekov)  [Orabug: 32560540]  {CVE-2021-3416}
  - tx_pkt: switch to use qemu_receive_packet_iov() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - sungem: switch to use qemu_receive_packet() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - dp8393x: switch to use qemu_receive_packet() for loopback packet (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - e1000: switch to use qemu_receive_packet() for loopback (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - net: introduce qemu_receive_packet() (Jason Wang)  [Orabug: 32560540]  {CVE-2021-3416}
  - target/i386: Populate x86_ext_save_areas offsets using cpuid where possible (David Edmondson)  
  - target/i386: Observe XSAVE state area offsets (David Edmondson)  
  - target/i386: Make x86_ext_save_areas visible outside cpu.c (David Edmondson)  
  - target/i386: Pass buffer and length to XSAVE helper (David Edmondson)  
  - target/i386: Clarify the padding requirements of X86XSaveArea (David Edmondson)  
  - target/i386: Consolidate the X86XSaveArea offset checks (David Edmondson)  
  - target/i386: Declare constants for XSAVE offsets (David Edmondson)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-16.el7
changelog:
  - Document CVE-2021-4145 as fixed (Mark Kanda)  [Orabug: 33791496]  {CVE-2021-4145}
  - migration: Tally pre-copy, downtime and post-copy bytes independently (David Edmondson)  
  - migration: Introduce ram_transferred_add() (David Edmondson)  
  - ACPI ERST: specification for ERST support (Eric DeVolder)  
  - ACPI ERST: step 6 of bios-tables-test.c (Eric DeVolder)  
  - ACPI ERST: bios-tables-test testcase (Eric DeVolder)  
  - ACPI ERST: qtest for ERST (Eric DeVolder)  
  - ACPI ERST: create ACPI ERST table for pc/x86 machines (Eric DeVolder)  
  - ACPI ERST: build the ACPI ERST table (Eric DeVolder)  
  - ACPI ERST: support for ACPI ERST feature (Eric DeVolder)  
  - ACPI ERST: header file for ERST (Eric DeVolder)  
  - ACPI ERST: PCI device_id for ERST (Eric DeVolder)  
  - ACPI ERST: bios-tables-test.c steps 1 and 2 (Eric DeVolder)  
  - ACPI: cleanup bios-tables-test state (Eric DeVolder)  
  - KVM: x86: believe what KVM says about WAITPKG (Paolo Bonzini)  [Orabug: 33832295] 
  - cputlb: destroy CPUTLB with tlb_destroy (Emilio G. Cota)  [Orabug: 33428107]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-17.el7
changelog:
  - arm/acpi: fix an out of spec _UID for PCI root (Michael S. Tsirkin)  
  - arm/acpi: fix duplicated _UID of PCI interrupt link devices (Heyi Guo)  
  - arm/acpi: fix PCI _PRT definition (Heyi Guo)  
  - docs: fix references to docs/devel/atomics.rst (Stefano Garzarella)  [Orabug: 33659123] 
  - rcu: do not mention atomic_mb_read/set in documentation (Paolo Bonzini)  [Orabug: 33659123] 
  - atomics: update documentation (Paolo Bonzini)  [Orabug: 33659123] 
  - atomics: convert to reStructuredText (Paolo Bonzini)  [Orabug: 33659123] 
  - async: use explicit memory barriers (Paolo Bonzini)  [Orabug: 33659123] 
  - aio-wait: delegate polling of main AioContext if BQL not held (Paolo Bonzini)  [Orabug: 33659123] 
  - qapi: Add '@allow-write-only-overlay' feature for 'blockdev-snapshot' (Peter Krempa)  [Orabug: 33888021] 
  - iotests: Add iothread cases to 155 (Kevin Wolf)  [Orabug: 33888021] 
  - block: Fix cross-AioContext blockdev-snapshot (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Test mirror with temporarily disabled target backing file (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Fix run_job() with use_log=False (Kevin Wolf)  [Orabug: 33888021] 
  - block: Relax restrictions for blockdev-snapshot (Kevin Wolf)  [Orabug: 33888021] 
  - block: Make bdrv_get_cumulative_perm() public (Kevin Wolf)  [Orabug: 33888021] 
  - iotests: Use complete_and_wait() in 155 (Max Reitz)  [Orabug: 33888021] 
  - iotests: Support job-complete in run_job() (Kevin Wolf)  [Orabug: 33888021] 
  - linux-headers: update again to 5.8 (Paolo Bonzini)  [Orabug: 34022218] 
  - virtio-net: fix map leaking on error during receive (Jason Wang)  [Orabug: 33941879]  {CVE-2022-26353}
  - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella)  [Orabug: 33941844]  {CVE-2022-26354}
  - virtio-net: fix use after unmap/free for sg (Jason Wang)  [Orabug: 33972912]  {CVE-2021-3748}
  - migration: Report the error returned when save_live_iterate fails (David Edmondson)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-18.el7
changelog:
  - block: introduce max_hw_iov for use in scsi-generic (Paolo Bonzini)  [Orabug: 33785156] 
  - file-posix: try BLKSECTGET on block devices too, do not round to power of 2 (Paolo Bonzini)  [Orabug: 33785156] 
  - block: add max_hw_transfer to BlockLimits (Paolo Bonzini)  [Orabug: 33785156] 
  - block-backend: align max_transfer to request alignment (Paolo Bonzini)  [Orabug: 33785156] 
  - osdep: provide ROUND_DOWN macro (Paolo Bonzini)  [Orabug: 33785156] 
  - scsi-generic: pass max_segments via max_iov field in BlockLimits (Paolo Bonzini)  [Orabug: 33785156] 
  - file-posix: fix max_iov for /dev/sg devices (Paolo Bonzini)  [Orabug: 33785156] 
  - display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) (Mauro Matteo Cascella)  [Orabug: 34049511]  {CVE-2021-4207}
  - ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206) (Mauro Matteo Cascella)  [Orabug: 34049509]  {CVE-2021-4206}
  - hw/block/fdc: Prevent end-of-track overrun (CVE-2021-3507) (Philippe Mathieu-Daudé)  [Orabug: 32860387]  {CVE-2021-3507}
  - pc: q35: Bump max_cpus to 512 (Suravee Suthikulpanit)  [Orabug: 34314249] 
  - tests/qtest: fix pvpanic-pci-test (Mark Kanda)  [Orabug: 34284763] 
  - libqos: pci-pc: use 32-bit write for EJ register (Paolo Bonzini)  [Orabug: 34284758] 
  - libqos: usb-hcd-ehci: use 32-bit write for config register (Paolo Bonzini)  [Orabug: 34284768] 
  - target/i386/kvm: Fix disabling MPX on "-cpu host" with MPX-capable host (Maciej S. Szmigiero)  [Orabug: 33528615] 
  - i386: Mask SVM features if nested SVM is disabled (Eduardo Habkost)  [Orabug: 33860224] 
  - ide: Cap LBA28 capacity announcement to 2^28-1 (Samuel Thibault)  [Orabug: 25327652] 
  - tests/acpi: update expected arm/virt tables (Mark Kanda)  [Orabug: 34132842]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-19.el7
changelog:
  - virtio-net: handle zero mac for a vdpa peer (Cindy Lu)  [Orabug: 34137522] 
  - virtio-net: don't handle mq request in userspace handler for vhost-vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: change name and polarity for vhost_vdpa_one_time_request() (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: backend feature should set only once (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-net: fix improper cleanup in vhost_net_start (Si-Wei Liu)  [Orabug: 34137522] 
  - vhost-vdpa: fix improper cleanup in net_init_vhost_vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio-net: align ctrl_vq index for non-mq guest for vhost_vdpa (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio-net: setup vhost_dev and notifiers for cvq only when feature is negotiated (Si-Wei Liu)  [Orabug: 34137522] 
  - virtio: fix the condition for iommu_platform not supported (Halil Pasic)  [Orabug: 34137522] 
  - vdpa: Make ncs autofree (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost-vdpa: make notifiers _init()/_uninit() symmetric (Laurent Vivier)  [Orabug: 34137522] 
  - hw/virtio: vdpa: Fix leak of host-notifier memory-region (Laurent Vivier)  [Orabug: 34137522] 
  - vhost-vdpa: stick to -errno error return convention (Roman Kagan)  [Orabug: 34137522] 
  - vdpa: Add dummy receive callback (Eugenio Pérez)  [Orabug: 34137522] 
  - vdpa: Check for existence of opts.vhostdev (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost: Fix last vq queue index of devices with no cvq (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost: Rename last_index to vq_index_end (Eugenio Pérez)  [Orabug: 34137522] 
  - net/vhost-vdpa: fix memory leak in vhost_vdpa_get_max_queue_pairs() (Stefano Garzarella)  [Orabug: 34137522] 
  - vhost-vdpa: multiqueue support (Jason Wang)  [Orabug: 34137522] 
  - virtio-net: vhost control virtqueue support (Jason Wang)  [Orabug: 34137522] 
  - vhost: record the last virtqueue index for the virtio device (Jason Wang)  [Orabug: 34137522] 
  - virtio-net: use "queue_pairs" instead of "queues" when possible (Jason Wang)  [Orabug: 34137522] 
  - vhost-net: control virtqueue support (Jason Wang)  [Orabug: 34137522] 
  - net: introduce control client (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: let net_vhost_vdpa_init() returns NetClientState * (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: prepare for the multiqueue support (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: classify one time request (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: open device fd in net_init_vhost_vdpa() (Jason Wang)  [Orabug: 34137522] 
  - vdpa: Check for iova range at mappings changes (Eugenio Pérez)  [Orabug: 34137522] 
  - vdpa: Add vhost_vdpa_section_end (Eugenio Pérez)  [Orabug: 34137522] 
  - net/vhost-vdpa: Fix device compatibility check (Kevin Wolf)  [Orabug: 34137522] 
  - net/vhost-user: Fix device compatibility check (Kevin Wolf)  [Orabug: 34137522] 
  - net: Introduce NetClientInfo.check_peer_type() (Kevin Wolf)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unncessary queue_index assignment (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: fix the wrong assertion in vhost_vdpa_init() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: tweak the error label in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: fix leaking of vhost_net in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: don't cleanup twice in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unnecessary check in vhost_vdpa_add() (Jason Wang)  [Orabug: 34137522] 
  - vhost_net: do not assume nvqs is always 2 (Jason Wang)  [Orabug: 34137522] 
  - vhost: use unsigned int for nvqs (Jason Wang)  [Orabug: 34137522] 
  - vhost_net: remove the meaningless assignment in vhost_net_start_one() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: correctly return err in vhost_vdpa_set_backend_cap() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: remove unused variable "acked_features" (Jason Wang)  [Orabug: 34137522] 
  - vhost: correctly detect the enabling IOMMU (Jason Wang)  [Orabug: 34137522] 
  - virtio-pci: implement iommu_enabled() (Jason Wang)  [Orabug: 34137522] 
  - virtio-bus: introduce iommu_enabled() (Jason Wang)  [Orabug: 34137522] 
  - hw/virtio: Fix leak of host-notifier memory-region (Yajun Wu)  [Orabug: 34137522] 
  - vhost-vdpa: Do not send empty IOTLB update batches (Eugenio Pérez)  [Orabug: 34137522] 
  - vhost-vdpa: remove the unused vhost_vdpa_get_acked_features() (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: don't initialize backend_features (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: map virtqueue notification area if possible (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: skip ram device from the IOTLB mapping (Jason Wang)  [Orabug: 34137522] 
  - vhost-vdpa: Remove redundant declaration of address_space_memory (Xie Yongji)  [Orabug: 34137522] 
  - virtio: Fail if iommu_platform is requested, but unsupported (Kevin Wolf)  [Orabug: 34137522] 
  - vhost-vdpa: Make vhost_vdpa_get_device_id() static (Zenghui Yu)  [Orabug: 34137522] 
  - Update linux headers to 5.11-rc2 (Eric Farman)  [Orabug: 34137522] 
  - linux-headers: update against 5.10-rc1 (Matthew Rosato)  [Orabug: 34137522] 
  - linux headers: sync to 5.9-rc7 (Andrew Jones)  [Orabug: 34137522]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-20.el7
changelog:
  - vl: Add an -action option to override MCE handling (Mark Kanda)  [Orabug: 34538907] 
  - vl: Add an -action option specifying response to guest events (Alejandro Jimenez)  [Orabug: 34538907] 
  - qmp: generalize watchdog-set-action to -no-reboot/-no-shutdown (Alejandro Jimenez)  [Orabug: 34538907]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-21.el7
changelog:
  - qemu-kvm.spec: Fix the qemu-regdump sos report plugin path (Mark Kanda)  [Orabug: 34680062] 
  - qmp-regdump: Require python3 on OL8 (Mark Kanda)  [Orabug: 34672256] 
  - iotests: Adjust 186.out to account for 'null' node-name (Mark Kanda)  [Orabug: 34447388] 
  - block: Set the name of BlockBackend if possible (Annie Li)  [Orabug: 34447388] 
  - acpi: Update _DSM method in expected files (Mark Kanda)  [Orabug: 34616322] 
  - acpi/gpex: Fix cca attribute check for pxb device (Xingang Wang)  [Orabug: 34616322] 
  - acpi: Enable pxb unit-test for ARM virt machine (Jiahui Cen)  [Orabug: 34616322] 
  - Kconfig: Compile PXB for ARM_VIRT (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Exclude pxb's resources from PCI0 (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Inform os to keep firmware resource map (Jiahui Cen)  [Orabug: 34616322] 
  - acpi: Add addr offset in build_crs (Jiahui Cen)  [Orabug: 34616322] 
  - unit-test: Add testcase for pxb (Yubo Miao)  [Orabug: 34616322] 
  - acpi: Align the size to 128k (Yubo Miao)  [Orabug: 34616322] 
  - acpi/gpex: Build tables for pxb (Yubo Miao)  [Orabug: 34616322] 
  - acpi: Extract crs build form acpi_build.c (Yubo Miao)  [Orabug: 34616322] 
  - hw/arm/virt: Write extra pci roots into fw_cfg (Jiahui Cen)  [Orabug: 34616322] 
  - fw_cfg: Refactor extra pci roots addition (Jiahui Cen)  [Orabug: 34616322] 
  - acpi/gpex: Extract two APIs from acpi_dsdt_add_pci (Yubo Miao)  [Orabug: 34616322] 
  - arm: use acpi_dsdt_add_gpex (Gerd Hoffmann)  [Orabug: 34616322] 
  - acpi: add acpi_dsdt_add_gpex (Gerd Hoffmann)  [Orabug: 34616322] 
  - acpi: Allow DSDT acpi table changes (Jiahui Cen)  [Orabug: 34616322] 
  - move MemMapEntry (Gerd Hoffmann)  [Orabug: 34616322] 
  - scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella)  [Orabug: 34353672]  {CVE-2022-0216}
  - scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) (Mauro Matteo Cascella)  [Orabug: 34353672]  {CVE-2022-0216}
  - tests/qtest: Add fuzz-lsi53c895a-test (Philippe Mathieu-Daudé)  [Orabug: 34353672]  {CVE-2022-0216}
  - hw/scsi/lsi53c895a: Do not abort when DMA requested and no data queued (Philippe Mathieu-Daudé)  [Orabug: 34353672]  {CVE-2022-0216}
  - vfio: defer to commit kvm irq routing when enable msi/msix (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: simplify the failure path in vfio_msi_enable (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: move re-enabling INTX out of the common helper (Longpeng (Mike))  [Orabug: 34419422] 
  - vfio: simplify the conditional statements in vfio_msi_enable (Longpeng (Mike))  [Orabug: 34419422] 
  - kvm/msi: do explicit commit when adding msi routes (Longpeng (Mike))  [Orabug: 34419422] 
  - kvm-irqchip: introduce new API to support route change (Longpeng (Mike))  [Orabug: 34419422] 
  - event_notifier: handle initialization failure better (Maxim Levitsky)  [Orabug: 34419422] 
  - qmp-regdump: use QMP command 'query-cpus-fast' (Mark Kanda)  [Orabug: 34510460]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-22.el7
changelog:
  - Revert "block: Set the name of BlockBackend if possible" (Joe Jin)  [Orabug: 34841102] 
  - Revert "iotests: Adjust 186.out to account for 'null' node-name" (Joe Jin)  [Orabug: 34841102]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-23.el7
changelog:
  - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daudé)  [Orabug: 33930374]  {CVE-2021-3638}
  - tests/acpi: virt: update ACPI MADT and FADT binaries (Miguel Luis)  
  - acpi: arm/virt: madt: bump to revision 4 accordingly to ACPI 6.0 Errata A (Miguel Luis)  
  - acpi: arm/virt: madt: use build_append_int_noprefix() API to compose MADT table (Igor Mammedov)  
  - acpi: madt: arm/x86: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov)  
  - hw/arm/virt-acpi-build:Remove dead assignment in build_madt() (Chen Qun)  
  - acpi: build_fadt: adapt FADT table names (Miguel Luis)  
  - acpi: fadt: support revision 6.0 of the ACPI specification (Miguel Luis)  
  - tests/acpi: virt: allow acpi MADT and FADT changes (Miguel Luis)  
  - Document CVE-2022-1050 and CVE-2022-3165 (Mark Kanda)  [Orabug: 34132133] [Orabug: 34713999]  {CVE-2022-1050} {CVE-2022-3165}
  - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt)  [Orabug: 34779472]  {CVE-2022-4172}
  - vhost-vdpa: fix assert !virtio_net_get_subqueue(nc)->async_tx.elem in virtio_net_reset (Si-Wei Liu)  
  - net/vhost-vdpa.c: Fix clang compilation failure (Peter Maydell)  
  - vhost-vdpa: allow passing opened vhostfd to vhost-vdpa (Si-Wei Liu)  
  - virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug events (Venu Busireddy)  [Orabug: 33649154] 
  - hw/acpi/aml-build: Improve scalability of PPTT generation (Yanan Wang)  
  - tests/data/acpi/virt: update empty file for PPTT (Miguel Luis)  
  - hw/arm/virt-acpi-build: Generate PPTT table (Yanan Wang)  
  - tests/data/acpi/virt: Add an empty expected file for PPTT (Yanan Wang)  
  - hw/acpi/aml-build: Add PPTT table (Andrew Jones)  
  - hw/acpi/aml-build: Add Processor hierarchy node structure (Yanan Wang)  
  - machine: Add SMP Sockets in CpuTopology (Babu Moger)  
  - bios-tables-test: generate table for virt/DBG2 (Miguel Luis)  
  - hw/arm/virt_acpi_build: Generate DBG2 table (Eric Auger)  
  - tests/acpi: Add void table for virt/DBG2 bios-tables-test (Eric Auger)  
  - tests/acpi: virt: update ACPI GTDT binaries (Miguel Luis)  [Orabug: 34711916] 
  - acpi: arm/virt: build_gtdt: fix invalid 64-bit physical addresses (Miguel Luis)  [Orabug: 34711916] 
  - tests/acpi: virt: allow acpi GTDT changes (Miguel Luis)  [Orabug: 34711916] 
  - acpi: fix OEM ID/OEM Table ID padding (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: arm/virt: build_gtdt: use acpi_table_begin()/acpi_table_end() instead of build_header() (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: add helper routines to initialize ACPI tables (Igor Mammedov)  [Orabug: 34711916] 
  - acpi: declare the default assignable value for the ACPI table header (Miguel Luis)  [Orabug: 34711916]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-24.el7
changelog:
  - Revert "virtio-scsi: Send "REPORTED LUNS CHANGED" sense data upon disk hotplug
    events" (Mark Kanda)  [Orabug: 34905939]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-25.el7
changelog:
  - target/i386/kvm: get and put AMD pmu registers (Dongli Zhang)  [Orabug: 34641255] 
  - i386/kvm: fix a use-after-free when vcpu plug/unplug (Pan Nengyuan)  [Orabug: 34859902] 
  - memory: batch allocate ioeventfds[] in address_space_update_ioeventfds() (Stefan Hajnoczi)  [Orabug: 34538900] 
  - virtio-blk: Fix clean up of host notifiers for single MR transaction. (Mark Mielke)  [Orabug: 34538900] 
  - virtio-scsi: Configure all host notifiers in a single MR transaction (Greg Kurz)  [Orabug: 34538900] 
  - virtio-scsi: Set host notifiers and callbacks separately (Greg Kurz)  [Orabug: 34538900] 
  - virtio-blk: Configure all host notifiers in a single MR transaction (Greg Kurz)  [Orabug: 34538900] 
  - virtio-blk: Fix rollback path in virtio_blk_data_plane_start() (Greg Kurz)  [Orabug: 34538900] 
  - event_notifier: Set ->initialized earlier in event_notifier_init() (Greg Kurz)  [Orabug: 34538900] 
  - virtio-scsi: don't process IO on fenced dataplane (Maxim Levitsky)  [Orabug: 34538900] 
  - virtio-scsi: don't uninitialize queues that we didn't initialize (Maxim Levitsky)  [Orabug: 34538900] 
  - hw/arm/virt: build SMBIOS 19 table (Mihai Carabas)


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-26.el7
changelog:
  - migration: check magic value for deciding the mapping of channels (manish.mishra)  [Orabug: 34735462] 
  - io: Add support for MSG_PEEK for socket channel (manish.mishra)  [Orabug: 34735462] 
  - migration: Move channel setup out of postcopy_try_recover() (Peter Xu)  [Orabug: 34735462] 
  - vdpa: commit all host notifier MRs in a single MR transaction (Longpeng (Mike))  [Orabug: 35252234] 
  - vhost: configure all host notifiers in a single MR transaction (Longpeng (Mike))  [Orabug: 35252234] 
  - vhost: simplify vhost_dev_enable_notifiers (Longpeng (Mike))  [Orabug: 35252234] 
  - pcie: Do not update hotplugged device power in RUN_STATE_INMIGRATE state (Annie Li)  [Orabug: 35055290] 
  - qga/win32: Use rundll for VSS installation (Konstantin Kostiuk)  [Orabug: 35206108]  {CVE-2023-0664}
  - qga/win32: Remove change action from MSI installer (Konstantin Kostiuk)  [Orabug: 35206108]  {CVE-2023-0664}
  - hw/display/qxl: Assert memory slot fits in preallocated MemoryRegion (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Pass requested buffer size to qxl_phys2virt() (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Document qxl_phys2virt() (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - hw/display/qxl: Have qxl_log_command Return early if no log_cmd handler (Philippe Mathieu-Daudé)  [Orabug: 34846087]  {CVE-2022-4144}
  - virtio-blk: On restart, process queued requests in the proper context (Sergio Lopez)  [Orabug: 35060530] 
  - virtio-blk: Refactor the code that processes queued requests (Sergio Lopez)  [Orabug: 35060530] 
  - hw/intc/ioapic: Update KVM routes before redelivering IRQ, on RTE update (David Woodhouse)  [Orabug: 35219223] 
  - modules: load modules from /var/run/qemu/ directory firstly (Siddhi Katage)  [Orabug: 34867783] 
  - qemu.spec: Add post-install script for block storage modules (Siddhi Katage)  [Orabug: 34867783] 
  - qemu.spec: Enable '-module-upgrades' for OL7 (Siddhi Katage)  [Orabug: 34867783] 
  - module: increase dirs array size by one (Bruce Rogers)  [Orabug: 34867783] 
  - modules: load modules from versioned /var/run dir (Christian Ehrhardt)  [Orabug: 34867783] 
  - blockjob: Fix crash with IOthread when block commit after snapshot (Michael Qiu)  [Orabug: 35118668]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-27.el7
changelog:
  - hw/arm/virt: Add nvdimm hotplug support (Shameer Kolothum)  [Orabug: 35505663] 
  - hw/arm/virt: Add nvdimm hot-plug infrastructure (Kwangwoo Lee)  [Orabug: 35505663] 
  - nvdimm: Use configurable ACPI IO base and size (Kwangwoo Lee)  [Orabug: 35505663] 
  - target/i386: define a new MSR based feature word - FEAT_PERF_CAPABILITIES (Like Xu)  [Orabug: 35370615]


author: Mark Kanda <mark.kanda@oracle.com> - 15:4.2.1-27.1.el7
changelog:
  - kvm: Atomic memslot updates (David Hildenbrand)  [Orabug: 35719844] 
  - KVM: keep track of running ioctls (Emanuele Giuseppe Esposito)  [Orabug: 35719844] 
  - accel: introduce accelerator blocker API (Emanuele Giuseppe Esposito)  [Orabug: 35719844] 
  - KVM: Use a big lock to replace per-kml slots_lock (Peter Xu)  [Orabug: 35719844]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-1.el7
changelog:
  - vfio-pci: emit FAILOVER_PRIMARY_CHANGED event on guest behalf when unrealized
  - vfio-pci: emit FAILOVER_PRIMARY_CHANGED event on guest behalf when unrealized (Si-Wei Liu)  [Orabug: 29216696] 
  - vfio-pci: add FAILOVER_PRIMARY_CHANGED event to shorten downtime during failover (Si-Wei Liu)  [Orabug: 29216701] 
  - virtio_net: Add support for "Data Path Switching" during Live Migration. (Venu Busireddy)  [Orabug: 29216704] 
  - virtio_net: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net (Sridhar Samudrala)  [Orabug: 29216714] 
  - i386: Add some MSR based features on Cascadelake-Server CPU model (Tao Xu)  [Orabug: 29216681] 
  - i386: Update stepping of Cascadelake-Server (Tao Xu)  [Orabug: 29216681] 
  - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann)  [Orabug: 29216656]  {CVE-2018-16872}
  - pvrdma: add uar_read routine (Prasad J Pandit)  [Orabug: 29216658]  {CVE-2018-20191}
  - pvrdma: release ring object in case of an error (Prasad J Pandit)  [Orabug: 29216659]  {CVE-2018-20126}
  - pvrdma: check number of pages when creating rings (Prasad J Pandit)  [Orabug: 29216666]  {CVE-2018-20125}
  - pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit)  [Orabug: 29216672]  {CVE-2018-20216}
  - rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
  - rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
  - i386: Add "stibp" flag name (Eduardo Habkost)  
  - parfait: Run static analysis when --with parfait specified (Liam Merwick)  [Orabug: 29216688] 
  - parfait: add buildrpm/parfait-qemu.conf (Liam Merwick)  [Orabug: 29216688] 
  - Document various CVEs as fixed (Mark Kanda)  [Orabug: 29212424]  {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}
  - qemu.spec: Initial qemu.spec (Mark Kanda)  
  - virtio-pci: Set subsystem vendor ID to Oracle (Mark Kanda)  
  - qemu_regdump.py: Initial qemu_regdump.py (Mark Kanda)  
  - qmp-regdump: Initial qmp-regdump (Mark Kanda)  
  - bridge.conf: Initial bridge.conf (Mark Kanda)  
  - kvm.conf: Initial kvm.conf (Mark Kanda)  
  - 80-kvm.rules: Initial 80-kvm.rules (Mark Kanda)


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-2.el7
changelog:
  - x86: Add mds feature (Karl Heubaum)  
  - e1000: Never increment the RX undersize count register (Chris Kenna)  
  - qemu.spec: audioflags set but never passed to configure script (Liam Merwick)  [Orabug: 29715562] 
  - parfait: deal with parfait returning non-zero return value (Liam Merwick)  [Orabug: 29715548] 
  - parfait: use nproc to choose default number of threads (Liam Merwick)  [Orabug: 29715548] 
  - parfait: provide option to upload results (Liam Merwick)  [Orabug: 29715548] 
  - parfait: disable misaligned-access check (Liam Merwick)  [Orabug: 29715548] 
  - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008} {CVE-2019-8934}
  - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
  - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
  - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
  - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]  {CVE-2019-6501}
  - slirp: check data length while emulating ident function (Prasad J Pandit)  [Orabug: 29715755]  {CVE-2019-6778}


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-3.el7
changelog:
  - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as
    fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}
    {CVE-2018-12130} {CVE-2019-11091}


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-4.el7
changelog:
  - kvm: i386: halt poll control MSR support (Marcelo Tosatti)  [Orabug: 29933278] 
  - Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda)  [Orabug: 29886908]  {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
  - pvrdma: release device resources in case of an error (Prasad J Pandit)  [Orabug: 29056678]  {CVE-2018-20123}
  - qxl: check release info object (Prasad J Pandit)  [Orabug: 29886906]  {CVE-2019-12155}
  - target/i386: add MDS-NO feature (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrangé)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - target/i386: define md-clear bit (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
  - pvh: block migration if booting using PVH (Liam Merwick)  [Orabug: 29796676] 
  - hw/i386/pc: run the multiboot loader before the PVH loader (Stefano Garzarella)  [Orabug: 29796676] 
  - optionrom/pvh: load initrd from fw_cfg (Stefano Garzarella)  [Orabug: 29796676] 
  - hw/i386/pc: use PVH option rom (Stefano Garzarella)  [Orabug: 29796676] 
  - qemu.spec: add pvh.bin to %files (Liam Merwick)  [Orabug: 29796676] 
  - optionrom: add new PVH option rom (Stefano Garzarella)  [Orabug: 29796676] 
  - linuxboot_dma: move common functions in a new header (Stefano Garzarella)  [Orabug: 29796676] 
  - linuxboot_dma: remove duplicate definitions of FW_CFG (Stefano Garzarella)  [Orabug: 29796676] 
  - pvh: load initrd and expose it through fw_cfg (Stefano Garzarella)  [Orabug: 29796676] 
  - pvh: Boot uncompressed kernel using direct boot ABI (Liam Merwick)  [Orabug: 29796676] 
  - pvh: Add x86/HVM direct boot ABI header file (Liam Merwick)  [Orabug: 29796676] 
  - elf-ops.h: Add get_elf_note_type() (Liam Merwick)  [Orabug: 29796676] 
  - elf: Add optional function ptr to load_elf() to parse ELF notes (Liam Merwick)  [Orabug: 29796676]


author: Mark Kanda <mark.kanda@oracle.com> - 15:3.1.0-5.el7
changelog:
  - Only enable the halt poll control MSR if it is supported by the host (Mark
    Kanda)  [Orabug: 29946722]


author: Karl Heubaum <karl.heubaum@oracle.com> - 15:3.1.0-6.el7
changelog:
  - qemu.spec: Remove "BuildRequires: kernel" (Karl Heubaum)  [Orabug: 30858754] 
  - target/i386: add support for MSR_IA32_TSX_CTRL (Paolo Bonzini)  [Orabug: 30652327] 
  - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 30807256]  {CVE-2020-1711}
  - scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) (Paolo Bonzini)  [Orabug: 30351703]  {CVE-2019-12068}
  - lsi: use enum type for s->waiting (Sven Schnelle)   {CVE-2019-12068}
  - json: Fix % handling when not interpolating (Christophe Fergeau)  [Orabug: 30640103] 
  - qemu.spec: enable have_curl in spec (Dongli Zhang)  [Orabug: 30640103] 
  - Fix heap overflow in ip_reass on big packet input (Samuel Thibault)  [Orabug: 30229916]  {CVE-2019-14378}
  - Make poll_control_msr default 1 (Mark Kanda)  
  - Remove redundant check for host support of halt polling (Mark Kanda)  [Orabug: 30240121] 
  - Enable '-Werror' compiler flag (Mark Kanda)  [Orabug: 30213025] 
  - qemu-submodule-init: Add Git submodule init script (Karl Heubaum)  [Orabug: 30729551]


author: Patrick Colp <patrick.colp@oracle.com> - 0.3.4-2.el7
changelog:
  - swtpm: Add a function to query the mtime of the NVRAM file (Patrick Colp)  
  - Allow storing/loading the PCR event log state blob to/from a file (David Edmondson)  
  - Allow storing the PCR values state blob to a file (David Edmondson)  
  - Allow the PCR event log blob to be set (David Edmondson)  
  - Allow the current PCR event log blob to be queried (David Edmondson)  
  - Allow the current PCR values blob to be queried (David Edmondson)


author: Patrick Colp <patrick.colp@oracle.com> - 0.3.4-3.el7
changelog:
  - samples: Do not follow symlinks on logfile (CVE-2020-28407) (Patrick Colp)   {CVE-2020-28407}
  - swtpm_setup: Do no follow symlink on logfile (CVE-2020-28407) (Patrick Colp)   {CVE-2020-28407}
  - swtpm: Use open() (not fopen()) when accessing statefile (CVE-2020-28407) (Stefan Berger)   {CVE-2020-28407}
  - swtpm: Write state files atomically using file renaming (Stefan Berger)   {CVE-2020-28407}
  - swtpm: Switch to open() from fopen() for the pidfile (CVE-2020-28407) (Stefan Berger)   {CVE-2020-28407}
  - swtpm: Do not follow symlinks when opening lockfile (CVE-2020-28407) (Stefan Berger)   {CVE-2020-28407}
  - swtpm_cert: Switch to open() from fopen() for writing certificate (Stefan Berger)  [Orabug: 32739904]  {CVE-2020-28407}


