main/xen: upgrade to 4.8.1

16 files changed, 49 insertions, 1361 deletions

diff --git a/main/xen/0001-ipxe-dont-clobber-ebp.patch b/main/xen/0001-ipxe-dont-clobber-ebp.patch
deleted file mode 100644
index f3342e6007..0000000000
--- a/main/xen/0001-ipxe-dont-clobber-ebp.patch
+++ /dev/null
@@ -1,286 +0,0 @@
-From 65289dab529e8aefe6ef0e365739e05a8a574e0e Mon Sep 17 00:00:00 2001
-From: Natanael Copa <ncopa@alpinelinux.org>
-Date: Mon, 21 Oct 2013 14:22:17 +0000
-Subject: [PATCH] ipxe: dont clobber ebp
-
-build fix
-https://bugs.gentoo.org/show_bug.cgi?id=487254
----
- .../etherboot/patches/no-clobber-ebp.patch         | 220 +++++++++++++++++++++
- .../etherboot/patches/no-clobber-ebp2.patch        |  26 +++
- tools/firmware/etherboot/patches/series            |   2 +
- 3 files changed, 248 insertions(+)
- create mode 100644 tools/firmware/etherboot/patches/no-clobber-ebp.patch
- create mode 100644 tools/firmware/etherboot/patches/no-clobber-ebp2.patch
-
-diff --git a/tools/firmware/etherboot/patches/no-clobber-ebp.patch b/tools/firmware/etherboot/patches/no-clobber-ebp.patch
-new file mode 100644
-index 0000000..bbd8c06
---- /dev/null
-+++ b/tools/firmware/etherboot/patches/no-clobber-ebp.patch
-@@ -0,0 +1,220 @@
-+From cba22d36b77da53890bd65fdadd0e63925687af0 Mon Sep 17 00:00:00 2001
-+From: Michael Brown <mcb30@ipxe.org>
-+Date: Wed, 25 Sep 2013 12:55:46 +0100
-+Subject: [PATCH] [build] Work around bug in gcc >= 4.8
-+MIME-Version: 1.0
-+Content-Type: text/plain; charset=utf8
-+Content-Transfer-Encoding: 8bit
-+
-+Commit 238050d ("[build] Work around bug in gcc >= 4.8") works around
-+one instance of a bug in recent versions of gcc, in which "ebp" cannot
-+be specified within an asm clobber list.
-+
-+Some versions of gcc seem to exhibit the same bug on other points in
-+the codebase.  Fix by changing all instances of "ebp" in a clobber
-+list to use the push/pop %ebp workaround instead.
-+
-+Originally-implemented-by: Víctor Román Archidona <contacto@victor-roman.es>
-+Signed-off-by: Michael Brown <mcb30@ipxe.org>
-+---
-+ src/arch/i386/drivers/net/undiload.c          |    8 +++++---
-+ src/arch/i386/firmware/pcbios/bios_console.c  |    9 +++++----
-+ src/arch/i386/image/bootsector.c              |    7 ++++++-
-+ src/arch/i386/image/elfboot.c                 |    7 ++++---
-+ src/arch/i386/image/nbi.c                     |   16 ++++++++++------
-+ src/arch/i386/interface/pxeparent/pxeparent.c |    8 +++++---
-+ 6 files changed, 35 insertions(+), 20 deletions(-)
-+
-+diff --git a/src/arch/i386/drivers/net/undiload.c b/src/arch/i386/drivers/net/undiload.c
-+index f0f15e6..77134dc 100644
-+--- a/src/arch/i386/drivers/net/undiload.c
-++++ b/src/arch/i386/drivers/net/undiload.c
-+@@ -103,13 +103,15 @@ int undi_load ( struct undi_device *undi, struct undi_rom *undirom ) {
-+ 
-+ 	/* Call loader */
-+ 	undi_loader_entry = undirom->loader_entry;
-+-	__asm__ __volatile__ ( REAL_CODE ( "pushw %%ds\n\t"
-++	__asm__ __volatile__ ( REAL_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-++					   "pushw %%ds\n\t"
-+ 					   "pushw %%ax\n\t"
-+ 					   "lcall *undi_loader_entry\n\t"
-+-					   "addw $4, %%sp\n\t" )
-++					   "popl %%ebp\n\t" /* discard */
-++					   "popl %%ebp\n\t" /* gcc bug */ )
-+ 			       : "=a" ( exit )
-+ 			       : "a" ( __from_data16 ( &undi_loader ) )
-+-			       : "ebx", "ecx", "edx", "esi", "edi", "ebp" );
-++			       : "ebx", "ecx", "edx", "esi", "edi" );
-+ 
-+ 	if ( exit != PXENV_EXIT_SUCCESS ) {
-+ 		/* Clear entry point */
-+diff --git a/src/arch/i386/firmware/pcbios/bios_console.c b/src/arch/i386/firmware/pcbios/bios_console.c
-+index 213ebd9..79e4370 100644
-+--- a/src/arch/i386/firmware/pcbios/bios_console.c
-++++ b/src/arch/i386/firmware/pcbios/bios_console.c
-+@@ -167,7 +167,8 @@ static void bios_putchar ( int character ) {
-+ 		return;
-+ 
-+ 	/* Print character with attribute */
-+-	__asm__ __volatile__ ( REAL_CODE ( "sti\n\t"
-++	__asm__ __volatile__ ( REAL_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-++					   "sti\n\t"
-+ 					   /* Skip non-printable characters */
-+ 					   "cmpb $0x20, %%al\n\t"
-+ 					   "jb 1f\n\t"
-+@@ -188,11 +189,11 @@ static void bios_putchar ( int character ) {
-+ 					   "xorw %%bx, %%bx\n\t"
-+ 					   "movb $0x0e, %%ah\n\t"
-+ 					   "int $0x10\n\t"
-+-					   "cli\n\t" )
-++					   "cli\n\t"
-++					   "popl %%ebp\n\t" /* gcc bug */ )
-+ 			       : "=a" ( discard_a ), "=b" ( discard_b ),
-+ 			         "=c" ( discard_c )
-+-			       : "a" ( character ), "b" ( bios_attr )
-+-			       : "ebp" );
-++			       : "a" ( character ), "b" ( bios_attr ) );
-+ }
-+ 
-+ /**
-+diff --git a/src/arch/i386/image/bootsector.c b/src/arch/i386/image/bootsector.c
-+index ab3cf94..cb164fd 100644
-+--- a/src/arch/i386/image/bootsector.c
-++++ b/src/arch/i386/image/bootsector.c
-+@@ -80,6 +80,8 @@ int call_bootsector ( unsigned int segment, unsigned int offset,
-+ 					   "movw %%ss, %%ax\n\t"
-+ 					   "movw %%ax, %%cs:saved_ss\n\t"
-+ 					   "movw %%sp, %%cs:saved_sp\n\t"
-++					   /* Save frame pointer (gcc bug) */
-++					   "movl %%ebp, %%cs:saved_ebp\n\t"
-+ 					   /* Jump to boot sector */
-+ 					   "pushw %%bx\n\t"
-+ 					   "pushw %%di\n\t"
-+@@ -99,11 +101,14 @@ int call_bootsector ( unsigned int segment, unsigned int offset,
-+ 					   "sti\n\t"
-+ 					   "lret\n\t"
-+ 					   /* Preserved variables */
-++					   "\nsaved_ebp: .long 0\n\t"
-+ 					   "\nsaved_ss: .word 0\n\t"
-+ 					   "\nsaved_sp: .word 0\n\t"
-+ 					   "\nsaved_retaddr: .word 0\n\t"
-+ 					   /* Boot failure return point */
-+ 					   "\nbootsector_exec_fail:\n\t"
-++					   /* Restore frame pointer (gcc bug) */
-++					   "movl %%cs:saved_ebp, %%ebp\n\t"
-+ 					   /* Restore stack pointer */
-+ 					   "movw %%cs:saved_ss, %%ax\n\t"
-+ 					   "movw %%ax, %%ss\n\t"
-+@@ -114,7 +119,7 @@ int call_bootsector ( unsigned int segment, unsigned int offset,
-+ 			         "=d" ( discard_d )
-+ 			       : "b" ( segment ), "D" ( offset ),
-+ 			         "d" ( drive )
-+-			       : "eax", "ecx", "esi", "ebp" );
-++			       : "eax", "ecx", "esi" );
-+ 
-+ 	DBG ( "Booted disk returned via INT 18 or 19\n" );
-+ 
-+diff --git a/src/arch/i386/image/elfboot.c b/src/arch/i386/image/elfboot.c
-+index a867a95..0f6957f 100644
-+--- a/src/arch/i386/image/elfboot.c
-++++ b/src/arch/i386/image/elfboot.c
-+@@ -60,10 +60,11 @@ static int elfboot_exec ( struct image *image ) {
-+ 
-+ 	/* Jump to OS with flat physical addressing */
-+ 	DBGC ( image, "ELF %p starting execution at %lx\n", image, entry );
-+-	__asm__ __volatile__ ( PHYS_CODE ( "call *%%edi\n\t" )
-++	__asm__ __volatile__ ( PHYS_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-++					   "call *%%edi\n\t"
-++					   "popl %%ebp\n\t" /* gcc bug */ )
-+ 			       : : "D" ( entry )
-+-			       : "eax", "ebx", "ecx", "edx", "esi", "ebp",
-+-			         "memory" );
-++			       : "eax", "ebx", "ecx", "edx", "esi", "memory" );
-+ 
-+ 	DBGC ( image, "ELF %p returned\n", image );
-+ 
-+diff --git a/src/arch/i386/image/nbi.c b/src/arch/i386/image/nbi.c
-+index d3e523e..9904614 100644
-+--- a/src/arch/i386/image/nbi.c
-++++ b/src/arch/i386/image/nbi.c
-+@@ -248,7 +248,8 @@ static int nbi_boot16 ( struct image *image, struct imgheader *imgheader ) {
-+ 	       imgheader->execaddr.segoff.offset );
-+ 
-+ 	__asm__ __volatile__ (
-+-		REAL_CODE ( "pushw %%ds\n\t"	/* far pointer to bootp data */
-++		REAL_CODE ( "pushl %%ebp\n\t"	/* gcc bug */
-++			    "pushw %%ds\n\t"	/* far pointer to bootp data */
-+ 			    "pushw %%bx\n\t"
-+ 			    "pushl %%esi\n\t"	/* location */
-+ 			    "pushw %%cs\n\t"	/* lcall execaddr */
-+@@ -258,13 +259,14 @@ static int nbi_boot16 ( struct image *image, struct imgheader *imgheader ) {
-+ 			    "pushl %%edi\n\t"
-+ 			    "lret\n\t"
-+ 			    "\n2:\n\t"
-+-			    "addw $8,%%sp\n\t"	/* clean up stack */ )
-++			    "addw $8,%%sp\n\t"	/* clean up stack */
-++			    "popl %%ebp\n\t"	/* gcc bug */ )
-+ 		: "=a" ( rc ), "=D" ( discard_D ), "=S" ( discard_S ),
-+ 		  "=b" ( discard_b )
-+ 		: "D" ( imgheader->execaddr.segoff ),
-+ 		  "S" ( imgheader->location ),
-+ 		  "b" ( __from_data16 ( basemem_packet ) )
-+-		: "ecx", "edx", "ebp" );
-++		: "ecx", "edx" );
-+ 
-+ 	return rc;
-+ }
-+@@ -288,11 +290,13 @@ static int nbi_boot32 ( struct image *image, struct imgheader *imgheader ) {
-+ 
-+ 	/* Jump to OS with flat physical addressing */
-+ 	__asm__ __volatile__ (
-+-		PHYS_CODE ( "pushl %%ebx\n\t" /* bootp data */
-++		PHYS_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-++			    "pushl %%ebx\n\t" /* bootp data */
-+ 			    "pushl %%esi\n\t" /* imgheader */
-+ 			    "pushl %%eax\n\t" /* loaderinfo */
-+ 			    "call *%%edi\n\t"
-+-			    "addl $12, %%esp\n\t" /* clean up stack */ )
-++			    "addl $12, %%esp\n\t" /* clean up stack */
-++			    "popl %%ebp\n\t" /* gcc bug */ )
-+ 		: "=a" ( rc ), "=D" ( discard_D ), "=S" ( discard_S ),
-+ 		  "=b" ( discard_b )
-+ 		: "D" ( imgheader->execaddr.linear ),
-+@@ -300,7 +304,7 @@ static int nbi_boot32 ( struct image *image, struct imgheader *imgheader ) {
-+ 			imgheader->location.offset ),
-+ 		  "b" ( virt_to_phys ( basemem_packet ) ),
-+ 		  "a" ( virt_to_phys ( &loaderinfo ) )
-+-		: "ecx", "edx", "ebp", "memory" );
-++		: "ecx", "edx", "memory" );
-+ 
-+ 	return rc;
-+ }
-+diff --git a/src/arch/i386/interface/pxeparent/pxeparent.c b/src/arch/i386/interface/pxeparent/pxeparent.c
-+index b2c6ffb..9d2948c 100644
-+--- a/src/arch/i386/interface/pxeparent/pxeparent.c
-++++ b/src/arch/i386/interface/pxeparent/pxeparent.c
-+@@ -143,16 +143,18 @@ int pxeparent_call ( SEGOFF16_t entry, unsigned int function,
-+ 	/* Call real-mode entry point.  This calling convention will
-+ 	 * work with both the !PXE and the PXENV+ entry points.
-+ 	 */
-+-	__asm__ __volatile__ ( REAL_CODE ( "pushw %%es\n\t"
-++	__asm__ __volatile__ ( REAL_CODE ( "pushl %%ebp\n\t" /* gcc bug */
-++					   "pushw %%es\n\t"
-+ 					   "pushw %%di\n\t"
-+ 					   "pushw %%bx\n\t"
-+ 					   "lcall *pxeparent_entry_point\n\t"
-+-					   "addw $6, %%sp\n\t" )
-++					   "addw $6, %%sp\n\t"
-++					   "popl %%ebp\n\t" /* gcc bug */ )
-+ 			       : "=a" ( exit ), "=b" ( discard_b ),
-+ 			         "=D" ( discard_D )
-+ 			       : "b" ( function ),
-+ 			         "D" ( __from_data16 ( &pxeparent_params ) )
-+-			       : "ecx", "edx", "esi", "ebp" );
-++			       : "ecx", "edx", "esi" );
-+ 
-+ 	/* Determine return status code based on PXENV_EXIT and
-+ 	 * PXENV_STATUS
-+-- 
-+1.7.9
-+
-diff --git a/tools/firmware/etherboot/patches/no-clobber-ebp2.patch b/tools/firmware/etherboot/patches/no-clobber-ebp2.patch
-new file mode 100644
-index 0000000..6b9ac07
---- /dev/null
-+++ b/tools/firmware/etherboot/patches/no-clobber-ebp2.patch
-@@ -0,0 +1,26 @@
-+--- a/src/arch/i386/interface/pxe/pxe_call.c.orig
-++++ b/src/arch/i386/interface/pxe/pxe_call.c
-+@@ -265,11 +265,13 @@
-+ 
-+ 	/* Far call to PXE NBP */
-+ 	__asm__ __volatile__ ( REAL_CODE ( "movw %%cx, %%es\n\t"
-++					   "pushl %%ebp\n\t" /* gcc bug */
-+ 					   "pushw %%es\n\t"
-+ 					   "pushw %%di\n\t"
-+ 					   "sti\n\t"
-+ 					   "lcall $0, $0x7c00\n\t"
-+-					   "addw $4, %%sp\n\t" )
-++					   "addw $4, %%sp\n\t"
-++					   "popl %%ebp\n\t" ) /* gcc bug */
-+ 			       : "=a" ( rc ), "=b" ( discard_b ),
-+ 				 "=c" ( discard_c ), "=d" ( discard_d ),
-+ 				 "=D" ( discard_D )
-+@@ -277,7 +279,7 @@
-+ 			         "c" ( rm_cs ),
-+ 			         "d" ( virt_to_phys ( &pxenv ) ),
-+ 				 "D" ( __from_text16 ( &ppxe ) )
-+-			       : "esi", "ebp", "memory" );
-++			       : "esi", "memory" );
-+ 
-+ 	return rc;
-+ }
-diff --git a/tools/firmware/etherboot/patches/series b/tools/firmware/etherboot/patches/series
-index 5bd7df8..154e65b 100644
---- a/tools/firmware/etherboot/patches/series
-+++ b/tools/firmware/etherboot/patches/series
-@@ -4,3 +4,5 @@
- build_fix_3.patch
- build-compare.patch
- build_fix_4.patch
-+no-clobber-ebp.patch
-+no-clobber-ebp2.patch
--- 
-1.8.4.1
-
diff --git a/main/xen/APKBUILD b/main/xen/APKBUILD
index a56f634b7a..f4c13b07be 100644
--- a/main/xen/APKBUILD
+++ b/main/xen/APKBUILD
@@ -2,7 +2,7 @@
 # Contributor: Roger Pau Monne <roger.pau@entel.upc.edu>
 # Maintainer: William Pitcock <nenolod@dereferenced.org>
 pkgname=xen
-pkgver=4.7.2
+pkgver=4.8.1
 pkgrel=0
 pkgdesc="Xen hypervisor"
 url="http://www.xen.org/"
@@ -86,7 +86,7 @@ _POLARSSL_VERSION="1.1.4"
 _TPMEMU_VERSION="0.7.4"
 
 # grep ^IPXE_GIT_TAG tools/firmware/etherboot/Makefile
-_IPXE_GIT_TAG=9a93db3f0947484e30e753bbd61a10b17336e20e
+_IPXE_GIT_TAG=827dd1bfee67daa683935ce65316f7e0f057fe1c
 
 source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.gz
 	http://xenbits.xen.org/xen-extfiles/gmp-$_GMP_VERSION.tar.bz2
@@ -99,16 +99,11 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
 	http://xenbits.xen.org/xen-extfiles/zlib-$_ZLIB_VERSION.tar.gz
 	http://xenbits.xen.org/xen-extfiles/ipxe-git-$_IPXE_GIT_TAG.tar.gz
 
-	xsa211-qemut.patch
-	xsa211-qemuu-4.7.patch
-	xsa212.patch
-
 	qemu-coroutine-gthread.patch
 	qemu-xen_paths.patch
 
 	hotplug-vif-vtrill.patch
 	rombios-no-pie.patch
-	0001-ipxe-dont-clobber-ebp.patch
 
 	musl-support.patch
 	musl-hvmloader-fix-stdint.patch
@@ -120,21 +115,6 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
 
 	xenstore_client_transaction_fix.patch
 
-	patch-gcc6-etherboot-nonnull-compare.patch::https://git.ipxe.org/ipxe.git/patch/e2f14c2f8c10674dbbd4f1228d79dc4c9be213b5
-	patch-gcc6-etherboot-rm-unused-string-functions.patch
-	patch-gcc6-etherboot-nic.c.patch::https://git.ipxe.org/ipxe.git/patch/a5885fbc19c4b60dc1a21624d1a9d1b77a93504e
-	patch-gcc6-etherboot-ath.patch::https://git.ipxe.org/ipxe.git/patch/63037bdce4a325e5e1da85ffcdf27b77ac670c01
-	patch-gcc6-etherboot-sis190.patch::https://git.ipxe.org/ipxe.git/patch/65b32a0b7000f70a5bb1d33190d40f9b04c93172
-	patch-gcc6-etherboot-skge.patch::https://git.ipxe.org/ipxe.git/patch/76ec2a0540b25dbd183b9ce185583a4b24278cf1
-	patch-gcc6-etherboot-via-velocity.c.patch
-	patch-gcc6-etherboot-via-rhine.c.patch
-	patch-gcc6-etherboot-e1000_phy.c.patch
-	patch-gcc6-etherboot-igb_phy.c.patch
-	patch-gcc6-etherboot-ath9k-9287-array.patch
-	patch-gcc6-etherboot-no-pie.patch
-	patch-gcc6-etherboot-link-header.patch::https://git.ipxe.org/ipxe.git/patch/6324bd9389521c7e86384591f41eb78a81e9af47
-	patch-gcc6-etherboot-eth_broadcast.patch::https://git.ipxe.org/ipxe.git/patch/1cbb1581f16e235fafc963c906ad02b38d5457bd
-
 	xenstored.initd
 	xenstored.confd
 	xenconsoled.initd
@@ -146,7 +126,7 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
 	xenqemu.initd
 	"
 
-_builddir="$srcdir"/$pkgname-$pkgver
+builddir="$srcdir"/$pkgname-$pkgver
 _seabios=/usr/share/seabios/bios-256k.bin
 
 # Override wrong arch detection from xen-$pkgver/Config.mk.
@@ -156,7 +136,7 @@ esac
 
 prepare() {
 	local i _failed= _series=
-	cd "$_builddir"
+	cd "$builddir"
 
 	for i in $source; do
 		case $i in
@@ -189,7 +169,8 @@ prepare() {
 
 	# install our stdint_local.h and elf_local.h
 	install "$srcdir"/stdint_local.h "$srcdir"/elf_local.h \
-		"$_builddir"/tools/firmware/ || return 1
+		"$builddir"/tools/firmware/ || return 1
+	ln -s ../firmware/stdint_local.h "$builddir"/tools/libxl/
 
 	# remove all -Werror
 	msg "Eradicating -Werror..."
@@ -226,7 +207,7 @@ munge_cflags() {
 # to invoke specific tasks like building the hypervisor.  i.e.
 #    $ abuild configure build_tools
 configure() {
-	cd "$_builddir"
+	cd "$builddir"
 
 	msg "Running configure..."
 	./configure --prefix=/usr \
@@ -265,7 +246,7 @@ build_stubdom() {
 }
 
 build() {
-	cd "$_builddir"
+	cd "$builddir"
 	configure || return 1
 	build_hypervisor || return 1
 	build_tools || return 1
@@ -278,7 +259,7 @@ build() {
 }
 
 package() {
-	cd "$_builddir"
+	cd "$builddir"
 
 	unset CFLAGS
 	unset LDFLAGS
@@ -331,7 +312,7 @@ hypervisor() {
 	mv "$pkgdir"/boot "$subpkgdir"/
 }
 
-sha512sums="8f447e7feffec81fea5b5a4098968b8b8cebc6989e7b6a845413317644d5d328d6f12181d09266366200878ab6a29ab34c7235c1af7b55463a3fdaea40ee1500  xen-4.7.2.tar.gz
+sha512sums="9f535b4bb57d285dfb92c974d55513505cf485b2d7218fe8f6ed62768e2cee7f225b08adf6706590b2c0a04feca16e10915297c33b98e1b110f8ea7035f46c15  xen-4.8.1.tar.gz
 2e0b0fd23e6f10742a5517981e5171c6e88b0a93c83da701b296f5c0861d72c19782daab589a7eac3f9032152a0fc7eff7f5362db8fccc4859564a9aa82329cf  gmp-4.3.2.tar.bz2
 c2bc9ffc8583aeae71cee9ddcc4418969768d4e3764d47307da54f93981c0109fb07d84b061b3a3628bd00ba4d14a54742bc04848110eb3ae8ca25dbfbaabadb  grub-0.97.tar.gz
 1465b58279af1647f909450e394fe002ca165f0ff4a0254bfa9fe0e64316f50facdde2729d79a4e632565b4500cf4d6c74192ac0dd3bc9fe09129bbd67ba089d  lwip-1.3.0.tar.gz
@@ -340,36 +321,18 @@ c2bc9ffc8583aeae71cee9ddcc4418969768d4e3764d47307da54f93981c0109fb07d84b061b3a36
 88da614e4d3f4409c4fd3bb3e44c7587ba051e3fed4e33d526069a67e8180212e1ea22da984656f50e290049f60ddca65383e5983c0f8884f648d71f698303ad  polarssl-1.1.4-gpl.tgz
 4928b5b82f57645be9408362706ff2c4d9baa635b21b0d41b1c82930e8c60a759b1ea4fa74d7e6c7cae1b7692d006aa5cb72df0c3b88bf049779aa2b566f9d35  tpm_emulator-0.7.4.tar.gz
 021b958fcd0d346c4ba761bcf0cc40f3522de6186cf5a0a6ea34a70504ce9622b1c2626fce40675bc8282cf5f5ade18473656abc38050f72f5d6480507a2106e  zlib-1.2.3.tar.gz
-c5cb1cdff40d2d71fd3e692a9d0efadf2aa17290daf5195391a1c81ddd9dfc913a8e44d5be2b12be85b2a5565ea31631c99c7053564f2fb2225c80ea0bb0e4a4  ipxe-git-9a93db3f0947484e30e753bbd61a10b17336e20e.tar.gz
-a3d1975afabf344b01af992642a93088e42d7655c955d38d50f00b9388cadeedaea88b6afb1db7558703cb356024a81afaee3e5cdfd76b571df9e6604e6ee035  xsa211-qemut.patch
-7b1bae43d578ee1195c509760b14d15771987d685cfa2603ae07c49e1f4c9f8aea3240ebc1c14a8a1afa6d41be4e20f540ea14ca5e07e47714000ad2c9cc9cb6  xsa211-qemuu-4.7.patch
-d012556c6b439629c5e4284a0de2f5ae70cda3db4f6f42373b8719509fec3bb0bb667a50484fd1e6c1129dcd2bff550a3eb9ead0f676fb626e6263ac98023e06  xsa212.patch
+82ba65e1c676d32b29c71e6395c9506cab952c8f8b03f692e2b50133be8f0c0146d0f22c223262d81a4df579986fde5abc6507869f4965be4846297ef7b4b890  ipxe-git-827dd1bfee67daa683935ce65316f7e0f057fe1c.tar.gz
 c3c46f232f0bd9f767b232af7e8ce910a6166b126bd5427bb8dc325aeb2c634b956de3fc225cab5af72649070c8205cc8e1cab7689fc266c204f525086f1a562  qemu-coroutine-gthread.patch
 1936ab39a1867957fa640eb81c4070214ca4856a2743ba7e49c0cd017917071a9680d015f002c57fa7b9600dbadd29dcea5887f50e6c133305df2669a7a933f3  qemu-xen_paths.patch
 f095ea373f36381491ad36f0662fb4f53665031973721256b23166e596318581da7cbb0146d0beb2446729adfdb321e01468e377793f6563a67d68b8b0f7ffe3  hotplug-vif-vtrill.patch
-71d0ebcda62259a1bf056807363015f2370f12daa5774f16150da42cba66bb5b65ec82f1f806fe147346560aa4d0e78bc5b5d8ae9f7e82d0aabae9d63fc876f6  rombios-no-pie.patch
-a6455988477a29d856924651db5e14f96d835413b956278d2291cbb8e5877d7bf6f462890f607ecf1c7b4003997295d0ba7852e110fc20df3a3edf1845e778ba  0001-ipxe-dont-clobber-ebp.patch
-76bd60768b296752ca11195bb03a57584686461da45255cb540977111a73c42b5b92362fd46d97bfd20487c96971dd5aed7eae7d8bf1aad7d5199adb875d4962  musl-support.patch
-08cf7fac825dd3da5f33856abf6692da00d8928ab73050b3ae0a643ddb97c8ae323238a80152fd31595ac1c31678d559232264258c189e2c05ecaf33e295f13e  musl-hvmloader-fix-stdint.patch
-9dcb481c5b83c7df23e87be717d8a9234014f26a0f80893e125fe8110e2923562d95162d18ff64c08b5782cd7c085f90378a9e0802b3995c077c8ba32bbb669f  stdint_local.h
+5514d7697c87f7d54d64723d44446b9bd84f6c984e763bd21d4eeaf502bf0c5b765f7b2180f8ca496b3baf97e7efd600b1cc1fdd1284b6ecbffe9846190ca069  rombios-no-pie.patch
+15d8bfd94ef81b90bfa7480d482d7ff6a5a9dfe6769b3dd3e1d656a95523521e89b9e99f40f3edb457170df8bb5f921d1f720d566a70895882f8197ae0f3708d  musl-support.patch
+77b08e9655e091b0352e4630d520b54c6ca6d659d1d38fbb4b3bfc9ff3e66db433a2e194ead32bb10ff962c382d800a670e82b7a62835b238e294b22808290ea  musl-hvmloader-fix-stdint.patch
+8c3b57eab8641bcee3dbdc1937ea7874f77b9722a5a0aa3ddb8dff8cc0ced7e19703ef5d998621b3809bea7c16f3346cfa47610ec9ab014ad0de12651c94e5ff  stdint_local.h
 853467a2d055c5bfbdc7bdca175a334241be44a7c5ac3c0a84a4bc5463b5c070b66d37e2a557429ef860727a6b7350683af758cc2494d85b6be4d883143a2c0d  elf_local.h
 79cb1b6b81b17cb87a064dfe3548949dfb80f64f203cac11ef327102b7a25794549ce2d9c019ebf05f752214da8e05065e9219d069e679c0ae5bee3d090c685e  xen-hotplug-lockfd.patch
 e76816c6ad0e91dc5f81947f266da3429b20e6d976c3e8c41202c6179532eec878a3f0913921ef3ac853c5dbad8082da3c9cd53b65081910516feb492577b7fc  xen-fd-is-file.c
 69dfa60628ca838678862383528654ecbdf4269cbb5c9cfb6b84d976202a8dea85d711aa65a52fa1b477fb0b30604ca70cf1337192d6fb9388a08bbe7fe56077  xenstore_client_transaction_fix.patch
-be0f4d00d0952883f2e0f5cabff4bda9bbfc1ff728389065a7a820875b191cf37890a272d3f9a0398fa86bbad20f6a2c16d2b7f30f3e03d746ee1d72b8ae3614  patch-gcc6-etherboot-nonnull-compare.patch
-55cf5ced4ff02d7a94bcdddbfdd0f4894c07991fa0be1829787f9498401340f0da30d2f118f4798c87e6097b13f14e1829cdc8024227ad0a561d5d8e08fc14ac  patch-gcc6-etherboot-rm-unused-string-functions.patch
-fac0d9c790aa49ded45ab46304dada4d3526e62594dc837e0578ebff6e75d9e87d0451447deb8bc0a82b898e1d414d759bff67b71f84ef20d23655496769c939  patch-gcc6-etherboot-nic.c.patch
-4a47a6b3f0fa1061aaa7a3cecd8bc39d7200eac1861189bcb3f9aa82eec68272bc9b7e861f787f0edb894edf0e17cafdc3a5e53924893fec48c7269a129aac5b  patch-gcc6-etherboot-ath.patch
-3c5a8a05e73e688993438196c0d799f2a9d41d7f092722a42ddbb420c464f54cf870e071b71b0c1e0e96a0b934ae229bb7dff16ca0538c1ceebe7e44c51f374b  patch-gcc6-etherboot-sis190.patch
-d4de0c94b850b886ceaa519d327fbfb80028147395694a31aed76de1a6f4ea001a356f11fb833c963b3934268313611193e21c615273cbc99c9911b847ca0233  patch-gcc6-etherboot-skge.patch
-4676979566c78d8f8dc46083dd2959bd871fdc5e790ec0846f47cd74f6740117e217a1b382d03302965769afcdf3f299ec9abd584b27430c4ed69e6776081194  patch-gcc6-etherboot-via-velocity.c.patch
-be4a3f48a7a3de745693ef1b8d1ab487ee3d8d7ed1b2e98ed94af7d52fb1db2fd724f8fada267a5ef9caa41721431e0e66d18d9cfc6557bfb8a1f95f44eeba68  patch-gcc6-etherboot-via-rhine.c.patch
-1bec93daf9c2df4904828f6473c64a46d2da1401b6aac5c33b1c411f8bfc0be119109db7c6582bb38aa178a28a3401072cac2636f1c631392fcffeed88bc0950  patch-gcc6-etherboot-e1000_phy.c.patch
-78093aa78c4711001adef6f29588535ca000931bcfca7c247d5ff4ef24eff2a553919ec5bae2f7d40236513d3bfa04e3baf20fdba5cd1ce8bd4957b8deebeb3c  patch-gcc6-etherboot-igb_phy.c.patch
-cca8b3230d33261efffb30cfc42661a6ec09433e3aa80d50710112d73c6b45c81dc0fa259072dc42ca31c5cec8ceca84b0a4f44ed85716f2e2d3287ddc84b7ec  patch-gcc6-etherboot-ath9k-9287-array.patch
-a87f907b193203d6710515d48fb88dfd1c22ec4ca4a710822f1327df9902e4d66552208bc6b1c7fbd1816946edeccb3ffb374397b3e5b629be1b130bb763315e  patch-gcc6-etherboot-no-pie.patch
-3126cdc1338d14338b56defddb96e99a12aff0f847365386a89fd54469ed08e17abbb10827ce08ca515895c6b50c37d189b1f84712de938ce0db2f8817c1de6e  patch-gcc6-etherboot-link-header.patch
-44561a76fa7abab4dd9c150d4b14c83432fea1813c5455f7321f71b28ece47f56002fae6bec25c5d63259a961136dfd29c4ac4d9649a0a7b3b5dbcd5b62fc111  patch-gcc6-etherboot-eth_broadcast.patch
 52c43beb2596d645934d0f909f2d21f7587b6898ed5e5e7046799a8ed6d58f7a09c5809e1634fa26152f3fd4f3e7cfa07da7076f01b4a20cc8f5df8b9cb77e50  xenstored.initd
 093f7fbd43faf0a16a226486a0776bade5dc1681d281c5946a3191c32d74f9699c6bf5d0ab8de9d1195a2461165d1660788e92a3156c9b3c7054d7b2d52d7ff0  xenstored.confd
 3c86ed48fbee0af4051c65c4a3893f131fa66e47bf083caf20c9b6aa4b63fdead8832f84a58d0e27964bc49ec8397251b34e5be5c212c139f556916dc8da9523  xenconsoled.initd
diff --git a/main/xen/musl-hvmloader-fix-stdint.patch b/main/xen/musl-hvmloader-fix-stdint.patch
index 819746b5bb..0d42f034a1 100644
--- a/main/xen/musl-hvmloader-fix-stdint.patch
+++ b/main/xen/musl-hvmloader-fix-stdint.patch
@@ -34,7 +34,7 @@ index fe770a3..cdab677 100644
 diff --git a/tools/firmware/hvmloader/acpi/acpi2_0.h b/tools/firmware/hvmloader/acpi/acpi2_0.h
 index 7b22d80..413c930 100644
 --- a/tools/firmware/hvmloader/acpi/acpi2_0.h
-+++ b/tools/firmware/hvmloader/acpi/acpi2_0.h
++++ b/tools/libacpi/acpi2_0.h
 @@ -18,7 +18,7 @@
  #ifndef _ACPI_2_0_H_
  #define _ACPI_2_0_H_
@@ -139,15 +139,16 @@ diff --git a/tools/firmware/hvmloader/util.c b/tools/firmware/hvmloader/util.c
 index 80d822f..671d8cd 100644
 --- a/tools/firmware/hvmloader/util.c
 +++ b/tools/firmware/hvmloader/util.c
-@@ -22,7 +22,7 @@
- #include "config.h"
- #include "hypercall.h"
- #include "ctype.h"
+@@ -24,7 +24,7 @@
+ #include "vnuma.h"
+ #include <acpi2_0.h>
+ #include <libacpi.h>
 -#include <stdint.h>
 +#include <stdint_local.h>
  #include <xen/xen.h>
  #include <xen/memory.h>
  #include <xen/sched.h>
+
 diff --git a/tools/firmware/hvmloader/util.h b/tools/firmware/hvmloader/util.h
 index a70e4aa..a8a2628 100644
 --- a/tools/firmware/hvmloader/util.h
diff --git a/main/xen/musl-support.patch b/main/xen/musl-support.patch
index 81587d2340..67bc27f528 100644
--- a/main/xen/musl-support.patch
+++ b/main/xen/musl-support.patch
@@ -42,7 +42,7 @@
          libxl__exec(gc, -1, -1, -1, bl->args[0], (char **) bl->args, env);
          exit(-1);
 --- xen-4.3.1.orig/tools/firmware/hvmloader/acpi/acpi2_0.h
-+++ xen-4.3.1/tools/firmware/hvmloader/acpi/acpi2_0.h
++++ b/tools/libacpi/acpi2_0.h
 @@ -366,7 +366,7 @@
  /*
   * Table Signatures.
diff --git a/main/xen/patch-gcc6-etherboot-ath9k-9287-array.patch b/main/xen/patch-gcc6-etherboot-ath9k-9287-array.patch
deleted file mode 100644
index 7b1f369b1e..0000000000
--- a/main/xen/patch-gcc6-etherboot-ath9k-9287-array.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 83d6f1f15f8cce844b0a131cbc63e444620e48b5 Mon Sep 17 00:00:00 2001
-From: Arnd Bergmann <arnd@arndb.de>
-Date: Mon, 14 Mar 2016 15:18:36 +0100
-Subject: ath9k: fix buffer overrun for ar9287
-
-Code that was added back in 2.6.38 has an obvious overflow
-when accessing a static array, and at the time it was added
-only a code comment was put in front of it as a reminder
-to have it reviewed properly.
-
-This has not happened, but gcc-6 now points to the specific
-overflow:
-
-drivers/net/wireless/ath/ath9k/eeprom.c: In function 'ath9k_hw_get_gain_boundaries_pdadcs':
-drivers/net/wireless/ath/ath9k/eeprom.c:483:44: error: array subscript is above array bounds [-Werror=array-bounds]
-     maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
-                   ~~~~~~~~~~~~~~~~~~~~~~~~~^~~
-
-It turns out that the correct array length exists in the local
-'intercepts' variable of this function, so we can just use that
-instead of hardcoding '4', so this patch changes all three
-instances to use that variable. The other two instances were
-already correct, but it's more consistent this way.
-
-Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Fixes: 940cd2c12ebf ("ath9k_hw: merge the ar9287 version of ath9k_hw_get_gain_boundaries_pdadcs")
-Signed-off-by: David S. Miller <davem@davemloft.net>
----
- drivers/net/wireless/ath/ath9k/eeprom.c | 7 +++----
- 1 file changed, 3 insertions(+), 4 deletions(-)
-
-diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
-index 73fb423..a794157 100644
---- a/src/drivers/net/ath/ath9k/ath9k_eeprom.c
-+++ b/src/drivers/net/ath/ath9k/ath9k_eeprom.c
-@@ -477,10 +477,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
- 
- 	if (match) {
- 		if (AR_SREV_9287(ah)) {
--			/* FIXME: array overrun? */
- 			for (i = 0; i < numXpdGains; i++) {
- 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
--				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
-+				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
- 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- 						data_9287[idxL].pwrPdg[i],
- 						data_9287[idxL].vpdPdg[i],
-@@ -490,7 +489,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
- 		} else if (eeprom_4k) {
- 			for (i = 0; i < numXpdGains; i++) {
- 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
--				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
-+				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
- 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- 						data_4k[idxL].pwrPdg[i],
- 						data_4k[idxL].vpdPdg[i],
-@@ -500,7 +499,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
- 		} else {
- 			for (i = 0; i < numXpdGains; i++) {
- 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
--				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
-+				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
- 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
- 						data_def[idxL].pwrPdg[i],
- 						data_def[idxL].vpdPdg[i],
--- 
-cgit v0.12
-
diff --git a/main/xen/patch-gcc6-etherboot-e1000_phy.c.patch b/main/xen/patch-gcc6-etherboot-e1000_phy.c.patch
deleted file mode 100644
index 4cd6c246c1..0000000000
--- a/main/xen/patch-gcc6-etherboot-e1000_phy.c.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff -aur a/src/drivers/net/e1000/e1000_phy.c b/src/drivers/net/e1000/e1000_phy.c
---- a/src/drivers/net/e1000/e1000_phy.c	2016-05-12 19:40:13.950772568 +1000
-+++ b/src/drivers/net/e1000/e1000_phy.c	2016-05-12 19:41:08.429089344 +1000
-@@ -164,7 +164,7 @@
- 
- 	DEBUGFUNC("e1000_get_phy_id");
- 
--	if (!(phy->ops.read_reg))
-+	if (!(phy->ops.read_reg)) {
- 		goto out;
- 
- 		ret_val = phy->ops.read_reg(hw, PHY_ID1, &phy_id);
-@@ -179,6 +179,7 @@
- 
- 		phy->id |= (u32)(phy_id & PHY_REVISION_MASK);
- 		phy->revision = (u32)(phy_id & ~PHY_REVISION_MASK);
-+	}
- 
- out:
- 	return ret_val;
diff --git a/main/xen/patch-gcc6-etherboot-igb_phy.c.patch b/main/xen/patch-gcc6-etherboot-igb_phy.c.patch
deleted file mode 100644
index 44beb4baa9..0000000000
--- a/main/xen/patch-gcc6-etherboot-igb_phy.c.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-diff -aur a/src/drivers/net/igb/igb_phy.c b/src/drivers/net/igb/igb_phy.c
---- a/src/drivers/net/igb/igb_phy.c	2016-05-12 19:53:45.063246296 +1000
-+++ b/src/drivers/net/igb/igb_phy.c	2016-05-12 19:54:09.992692278 +1000
-@@ -88,7 +88,7 @@
- 
- 	DEBUGFUNC("igb_get_phy_id");
- 
--	if (!(phy->ops.read_reg))
-+	if (!(phy->ops.read_reg)) {
- 		goto out;
- 
- 		ret_val = phy->ops.read_reg(hw, PHY_ID1, &phy_id);
-@@ -103,6 +103,7 @@
- 
- 		phy->id |= (u32)(phy_id & PHY_REVISION_MASK);
- 		phy->revision = (u32)(phy_id & ~PHY_REVISION_MASK);
-+	}
- 
- out:
- 	return ret_val;
diff --git a/main/xen/patch-gcc6-etherboot-no-pie.patch b/main/xen/patch-gcc6-etherboot-no-pie.patch
deleted file mode 100644
index c4500259a6..0000000000
--- a/main/xen/patch-gcc6-etherboot-no-pie.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index e2425d7..20111d7 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -4,7 +4,7 @@
- #
- 
- CLEANUP		:=
--CFLAGS		:=
-+CFLAGS		:= -fno-pie
- ASFLAGS		:=
- LDFLAGS		:=
- MAKEDEPS	:= Makefile
diff --git a/main/xen/patch-gcc6-etherboot-rm-unused-string-functions.patch b/main/xen/patch-gcc6-etherboot-rm-unused-string-functions.patch
deleted file mode 100644
index 991d433301..0000000000
--- a/main/xen/patch-gcc6-etherboot-rm-unused-string-functions.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From b54167b8b6a35c7dab19bbe4b421d447036558d4 Mon Sep 17 00:00:00 2001
-From: Michael Brown <mcb30@ipxe.org>
-Date: Mon, 16 Feb 2015 15:33:32 +0000
-Subject: [PATCH] [libc] Remove unused string functions
-
-Signed-off-by: Michael Brown <mcb30@ipxe.org>
----
- src/core/stringextra.c |  188 ------------------------------------------------
- src/include/string.h   |    6 --
- 2 files changed, 0 insertions(+), 194 deletions(-)
-
-diff --git a/src/core/stringextra.c b/src/core/stringextra.c
-index 0a50985..18ffc63 100644
---- a/src/core/stringextra.c
-+++ b/src/core/stringextra.c
-@@ -38,122 +38,6 @@ FILE_LICENCE ( GPL2_ONLY );
- 
- /* *** FROM string.c *** */
- 
--#ifndef __HAVE_ARCH_STRNICMP
--/**
-- * strnicmp - Case insensitive, length-limited string comparison
-- * @s1: One string
-- * @s2: The other string
-- * @len: the maximum number of characters to compare
-- */
--int strnicmp(const char *s1, const char *s2, size_t len)
--{
--	/* Yes, Virginia, it had better be unsigned */
--	unsigned char c1, c2;
--
--	c1 = 0;	c2 = 0;
--	if (len) {
--		do {
--			c1 = *s1; c2 = *s2;
--			s1++; s2++;
--			if (!c1)
--				break;
--			if (!c2)
--				break;
--			if (c1 == c2)
--				continue;
--			c1 = tolower(c1);
--			c2 = tolower(c2);
--			if (c1 != c2)
--				break;
--		} while (--len);
--	}
--	return (int)c1 - (int)c2;
--}
--#endif
--
--char * ___strtok;
--
--#ifndef __HAVE_ARCH_STRNCAT
--/**
-- * strncat - Append a length-limited, %NUL-terminated string to another
-- * @dest: The string to be appended to
-- * @src: The string to append to it
-- * @count: The maximum numbers of bytes to copy
-- *
-- * Note that in contrast to strncpy, strncat ensures the result is
-- * terminated.
-- */
--char * strncat(char *dest, const char *src, size_t count)
--{
--	char *tmp = dest;
--
--	if (count) {
--		while (*dest)
--			dest++;
--		while ((*dest++ = *src++)) {
--			if (--count == 0) {
--				*dest = '\0';
--				break;
--			}
--		}
--	}
--
--	return tmp;
--}
--#endif
--
--#ifndef __HAVE_ARCH_STRSPN
--/**
-- * strspn - Calculate the length of the initial substring of @s which only
-- * 	contain letters in @accept
-- * @s: The string to be searched
-- * @accept: The string to search for
-- */
--size_t strspn(const char *s, const char *accept)
--{
--	const char *p;
--	const char *a;
--	size_t count = 0;
--
--	for (p = s; *p != '\0'; ++p) {
--		for (a = accept; *a != '\0'; ++a) {
--			if (*p == *a)
--				break;
--		}
--		if (*a == '\0')
--			return count;
--		++count;
--	}
--
--	return count;
--}
--#endif
--
--#ifndef __HAVE_ARCH_STRCSPN
--/**
-- * strcspn - Calculate the length of the initial substring of @s which only
-- * 	contain letters not in @reject
-- * @s: The string to be searched
-- * @accept: The string to search for
-- */
--size_t strcspn(const char *s, const char *reject)
--{
--	const char *p;
--	const char *r;
--	size_t count = 0;
--
--	for (p = s; *p != '\0'; ++p) {
--		for (r = reject; *r != '\0'; ++r) {
--			if (*p == *r)
--				return count;
--		}
--		++count;
--	}
--
--	return count;
--}
--#endif
--
- #ifndef __HAVE_ARCH_STRPBRK
- /**
-  * strpbrk - Find the first occurrence of a set of characters
-@@ -174,35 +58,6 @@ char * strpbrk(const char * cs,const char * ct)
- }
- #endif
- 
--#ifndef __HAVE_ARCH_STRTOK
--/**
-- * strtok - Split a string into tokens
-- * @s: The string to be searched
-- * @ct: The characters to search for
-- *
-- * WARNING: strtok is deprecated, use strsep instead.
-- */
--char * strtok(char * s,const char * ct)
--{
--	char *sbegin, *send;
--
--	sbegin  = s ? s : ___strtok;
--	if (!sbegin) {
--		return NULL;
--	}
--	sbegin += strspn(sbegin,ct);
--	if (*sbegin == '\0') {
--		___strtok = NULL;
--		return( NULL );
--	}
--	send = strpbrk( sbegin, ct);
--	if (send && *send != '\0')
--		*send++ = '\0';
--	___strtok = send;
--	return (sbegin);
--}
--#endif
--
- #ifndef __HAVE_ARCH_STRSEP
- /**
-  * strsep - Split a string into tokens
-@@ -230,46 +85,3 @@ char * strsep(char **s, const char *ct)
- 	return sbegin;
- }
- #endif
--
--#ifndef __HAVE_ARCH_BCOPY
--/**
-- * bcopy - Copy one area of memory to another
-- * @src: Where to copy from
-- * @dest: Where to copy to
-- * @count: The size of the area.
-- *
-- * Note that this is the same as memcpy(), with the arguments reversed.
-- * memcpy() is the standard, bcopy() is a legacy BSD function.
-- *
-- * You should not use this function to access IO space, use memcpy_toio()
-- * or memcpy_fromio() instead.
-- */
--char * bcopy(const char * src, char * dest, int count)
--{
--	return memmove(dest,src,count);
--}
--#endif
--
--#ifndef __HAVE_ARCH_MEMSCAN
--/**
-- * memscan - Find a character in an area of memory.
-- * @addr: The memory area
-- * @c: The byte to search for
-- * @size: The size of the area.
-- *
-- * returns the address of the first occurrence of @c, or 1 byte past
-- * the area if @c is not found
-- */
--void * memscan(const void * addr, int c, size_t size)
--{
--	unsigned char * p = (unsigned char *) addr;
--
--	while (size) {
--		if (*p == c)
--			return (void *) p;
--		p++;
--		size--;
--	}
--  	return (void *) p;
--}
--#endif
-diff --git a/src/include/string.h b/src/include/string.h
-index 3482e1b..dfd78a6 100644
---- a/src/include/string.h
-+++ b/src/include/string.h
-@@ -19,11 +19,9 @@ FILE_LICENCE ( GPL2_ONLY );
- #include <stddef.h>
- #include <bits/string.h>
- 
--int __pure strnicmp(const char *s1, const char *s2, size_t len) __nonnull;
- char * strcpy(char * dest,const char *src) __nonnull;
- char * strncpy(char * dest,const char *src,size_t count) __nonnull;
- char * strcat(char * dest, const char * src) __nonnull;
--char * strncat(char *dest, const char *src, size_t count) __nonnull;
- int __pure strcmp(const char * cs,const char * ct) __nonnull;
- int __pure strncmp(const char * cs,const char * ct,
- 				     size_t count) __nonnull;
-@@ -31,16 +29,12 @@ char * __pure strchr(const char * s, int c) __nonnull;
- char * __pure strrchr(const char * s, int c) __nonnull;
- size_t __pure strlen(const char * s) __nonnull;
- size_t __pure strnlen(const char * s, size_t count) __nonnull;
--size_t __pure strspn(const char *s, const char *accept) __nonnull;
--size_t __pure strcspn(const char *s, const char *reject) __nonnull;
- char * __pure strpbrk(const char * cs,const char * ct) __nonnull;
--char * strtok(char * s,const char * ct) __nonnull;
- char * strsep(char **s, const char *ct) __nonnull;
- void * memset(void * s,int c,size_t count) __nonnull;
- void * memmove(void * dest,const void *src,size_t count) __nonnull;
- int __pure memcmp(const void * cs,const void * ct,
- 				    size_t count) __nonnull;
--void * __pure memscan(const void * addr, int c, size_t size) __nonnull;
- char * __pure strstr(const char * s1,const char * s2) __nonnull;
- void * __pure memchr(const void *s, int c, size_t n) __nonnull;
- char * __malloc strdup(const char *s) __nonnull;
--- 
-1.7.9
-
diff --git a/main/xen/patch-gcc6-etherboot-via-rhine.c.patch b/main/xen/patch-gcc6-etherboot-via-rhine.c.patch
deleted file mode 100644
index 697208ae3f..0000000000
--- a/main/xen/patch-gcc6-etherboot-via-rhine.c.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -aru a/src/drivers/net/via-rhine.c b/src/drivers/net/via-rhine.c
---- a/src/drivers/net/via-rhine.c	2016-05-12 19:24:14.047825550 +1000
-+++ b/src/drivers/net/via-rhine.c	2016-05-12 19:33:18.061858418 +1000
-@@ -945,13 +945,15 @@
-             /* added comment by guard */
-             /* For supporting VT6107, please use revision id to recognize different chips in driver */
-             // if (tp->chip_id == 0x3065)
--            if( tp->chip_revision < 0x80 && tp->chip_revision >=0x40 )
-+            if( tp->chip_revision < 0x80 && tp->chip_revision >=0x40 ) {
-                 intr_status |= inb(nic->ioaddr + IntrStatus2) << 16;
-                 intr_status = (intr_status & ~DEFAULT_INTR);
--                if ( action == ENABLE ) 
-+                if ( action == ENABLE ) {
-                     intr_status = intr_status | DEFAULT_INTR;
-                     outw(intr_status, nic->ioaddr + IntrEnable);
-+                }
-                 break;
-+            }
-         case FORCE :
-             outw(0x0010, nic->ioaddr + 0x84);
-            break;
diff --git a/main/xen/patch-gcc6-etherboot-via-velocity.c.patch b/main/xen/patch-gcc6-etherboot-via-velocity.c.patch
deleted file mode 100644
index 36a3d81158..0000000000
--- a/main/xen/patch-gcc6-etherboot-via-velocity.c.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -aur a/src/drivers/net/via-velocity.c b/src/drivers/net/via-velocity.c
---- a/src/drivers/net/via-velocity.c	2016-05-12 19:14:33.231788641 +1000
-+++ b/src/drivers/net/via-velocity.c	2016-05-12 19:17:08.235494746 +1000
-@@ -69,7 +69,7 @@
- 
- /* NIC specific static variables go here */
- #define VELOCITY_PARAM(N,D) \
--        static const int N[MAX_UNITS]=OPTION_DEFAULT;
-+        static __attribute__ ((unused)) const int N[MAX_UNITS]=OPTION_DEFAULT;
- /*        MODULE_PARM(N, "1-" __MODULE_STRING(MAX_UNITS) "i");\
-         MODULE_PARM_DESC(N, D); */
- 
diff --git a/main/xen/rombios-no-pie.patch b/main/xen/rombios-no-pie.patch
index 3e98bb497d..6387f4ef47 100644
--- a/main/xen/rombios-no-pie.patch
+++ b/main/xen/rombios-no-pie.patch
@@ -1,26 +1,22 @@
-diff --git a/tools/firmware/rombios/32bit/Makefile b/tools/firmware/rombios/32bit/Makefile
-index 396906c..07168eb 100644
---- a/tools/firmware/rombios/32bit/Makefile
-+++ b/tools/firmware/rombios/32bit/Makefile
-@@ -3,7 +3,7 @@ include $(XEN_ROOT)/tools/firmware/Rules.mk
+--- ./tools/firmware/rombios/32bit/tcgbios/Makefile.orig
++++ ./tools/firmware/rombios/32bit/tcgbios/Makefile
+@@ -3,7 +3,7 @@
  
- TARGET = 32bitbios_flat.h
+ TARGET  = tcgbiosext.o
  
--CFLAGS += $(CFLAGS_xeninclude) -I..
-+CFLAGS += $(CFLAGS_xeninclude) -I.. -fno-pie
+-CFLAGS += $(CFLAGS_xeninclude) -I.. -I../.. -I../../../../libacpi
++CFLAGS += $(CFLAGS_xeninclude) -I.. -I../.. -I../../../../libacpi -fno-pie
  
- SUBDIRS = tcgbios
+ .PHONY: all
+ all: $(TARGET)
+--- ./tools/firmware/rombios/32bit/Makefile.orig
++++ ./tools/firmware/rombios/32bit/Makefile
+@@ -3,7 +3,7 @@
  
-diff --git a/tools/firmware/rombios/32bit/tcgbios/Makefile b/tools/firmware/rombios/32bit/tcgbios/Makefile
-index f6f2649..104496a 100644
---- a/tools/firmware/rombios/32bit/tcgbios/Makefile
-+++ b/tools/firmware/rombios/32bit/tcgbios/Makefile
-@@ -3,7 +3,7 @@ include $(XEN_ROOT)/tools/firmware/Rules.mk
+ TARGET = 32bitbios_flat.h
  
- TARGET  = tcgbiosext.o
+-CFLAGS += $(CFLAGS_xeninclude) -I.. -I../../../libacpi
++CFLAGS += $(CFLAGS_xeninclude) -I.. -I../../../libacpi -fno-pie
  
--CFLAGS += $(CFLAGS_xeninclude) -I.. -I../..
-+CFLAGS += $(CFLAGS_xeninclude) -I.. -I../.. -fno-pie
+ SUBDIRS = tcgbios
  
- .PHONY: all
- all: $(TARGET)
diff --git a/main/xen/stdint_local.h b/main/xen/stdint_local.h
index 2c2fa6dd83..0eb485aaa1 100644
--- a/main/xen/stdint_local.h
+++ b/main/xen/stdint_local.h
@@ -1,23 +1,19 @@
 /* 32 bit int types */
 #ifndef STDINT_LOCAL_H
 #define STDINT_LOCAL_H
-typedef signed char             int8_t;
-typedef short int               int16_t;
-typedef int                     int32_t;
-# if defined(__x86_64__)
-typedef long int                int64_t;
-#else
-typedef long long int           int64_t;
-#endif
+typedef	__INT8_TYPE__		int8_t;
+typedef __INT16_TYPE__		int16_t;
+typedef __INT32_TYPE__		int32_t;
+typedef __INT64_TYPE__		int64_t;
+typedef __INTPTR_TYPE__		intptr_t;
 
 /* Unsigned.  */
-typedef unsigned char           uint8_t;
-typedef unsigned short int      uint16_t;
-typedef unsigned int            uint32_t;
-# if defined(__x86_64__)
-typedef unsigned long int       uint64_t;
-#else
-typedef unsigned long long int  uint64_t;
-#endif
+typedef	__UINT8_TYPE__		uint8_t;
+typedef __UINT16_TYPE__		uint16_t;
+typedef __UINT32_TYPE__		uint32_t;
+typedef __UINT64_TYPE__		uint64_t;
+typedef __UINTPTR_TYPE__	uintptr_t;
 
+#define INTPTR_MAX	0x7fffffffffffffffL
+#define UINTPTR_MAX	0xffffffffffffffffUL
 #endif
diff --git a/main/xen/xsa211-qemut.patch b/main/xen/xsa211-qemut.patch
deleted file mode 100644
index 1d088d7d7c..0000000000
--- a/main/xen/xsa211-qemut.patch
+++ /dev/null
@@ -1,225 +0,0 @@
-From 29e67cfd46b4d06ca1bb75558e227ec34a6af35f Mon Sep 17 00:00:00 2001
-From: Ian Jackson <ian.jackson@eu.citrix.com>
-Date: Thu, 9 Mar 2017 11:14:55 +0000
-Subject: [PATCH] cirrus/vnc: zap drop bitblit support from console code.
-
-From: Gerd Hoffmann <kraxel@redhat.com>
-
-There is a special code path (dpy_gfx_copy) to allow graphic emulation
-notify user interface code about bitblit operations carryed out by
-guests.  It is supported by cirrus and vnc server.  The intended purpose
-is to optimize display scrolls and just send over the scroll op instead
-of a full display update.
-
-This is rarely used these days though because modern guests simply don't
-use the cirrus blitter any more.  Any linux guest using the cirrus drm
-driver doesn't.  Any windows guest newer than winxp doesn't ship with a
-cirrus driver any more and thus uses the cirrus as simple framebuffer.
-
-So this code tends to bitrot and bugs can go unnoticed for a long time.
-See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV"
-which fixes a bug lingering in the code for almost a year, added by
-commit "c7628bf vnc: only alloc server surface with clients connected".
-
-Also the vnc server will throttle the frame rate in case it figures the
-network can't keep up (send buffers are full).  This doesn't work with
-dpy_gfx_copy, for any copy operation sent to the vnc client we have to
-send all outstanding updates beforehand, otherwise the vnc client might
-run the client side blit on outdated data and thereby corrupt the
-display.  So this dpy_gfx_copy "optimization" might even make things
-worse on slow network links.
-
-Lets kill it once for all.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-
-These changes (dropping dpy_copy and all its references and
-implementations) reimplemented for qemu-xen-traditional.
-
-This is XSA-211.
-
-Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
----
- console.c       |  8 --------
- console.h       | 16 ----------------
- hw/cirrus_vga.c | 15 +++++----------
- hw/vmware_vga.c |  1 +
- vnc.c           | 35 -----------------------------------
- 5 files changed, 6 insertions(+), 69 deletions(-)
-
-diff --git a/console.c b/console.c
-index d4f1ad0..e61b53b 100644
---- a/console.c
-+++ b/tools/qemu-xen-traditional/console.c
-@@ -1399,14 +1399,6 @@ void qemu_console_resize(DisplayState *ds, int width, int height)
-     }
- }
- 
--void qemu_console_copy(DisplayState *ds, int src_x, int src_y,
--                int dst_x, int dst_y, int w, int h)
--{
--    if (is_graphic_console()) {
--        dpy_copy(ds, src_x, src_y, dst_x, dst_y, w, h);
--    }
--}
--
- PixelFormat qemu_different_endianness_pixelformat(int bpp)
- {
-     PixelFormat pf;
-diff --git a/console.h b/console.h
-index 14b42f3..8306cc4 100644
---- a/console.h
-+++ b/tools/qemu-xen-traditional/console.h
-@@ -98,8 +98,6 @@ struct DisplayChangeListener {
-     void (*dpy_resize)(struct DisplayState *s);
-     void (*dpy_setdata)(struct DisplayState *s);
-     void (*dpy_refresh)(struct DisplayState *s);
--    void (*dpy_copy)(struct DisplayState *s, int src_x, int src_y,
--                     int dst_x, int dst_y, int w, int h);
-     void (*dpy_fill)(struct DisplayState *s, int x, int y,
-                      int w, int h, uint32_t c);
-     void (*dpy_text_cursor)(struct DisplayState *s, int x, int y);
-@@ -211,18 +209,6 @@ static inline void dpy_refresh(DisplayState *s)
-     }
- }
- 
--static inline void dpy_copy(struct DisplayState *s, int src_x, int src_y,
--                             int dst_x, int dst_y, int w, int h) {
--    struct DisplayChangeListener *dcl = s->listeners;
--    while (dcl != NULL) {
--        if (dcl->dpy_copy)
--            dcl->dpy_copy(s, src_x, src_y, dst_x, dst_y, w, h);
--        else /* TODO */
--            dcl->dpy_update(s, dst_x, dst_y, w, h);
--        dcl = dcl->next;
--    }
--}
--
- static inline void dpy_fill(struct DisplayState *s, int x, int y,
-                              int w, int h, uint32_t c) {
-     struct DisplayChangeListener *dcl = s->listeners;
-@@ -297,8 +283,6 @@ void text_consoles_set_display(DisplayState *ds);
- void console_select(unsigned int index);
- void console_color_init(DisplayState *ds);
- void qemu_console_resize(DisplayState *ds, int width, int height);
--void qemu_console_copy(DisplayState *ds, int src_x, int src_y,
--                int dst_x, int dst_y, int w, int h);
- 
- /* sdl.c */
- void sdl_display_init(DisplayState *ds, int full_screen, int no_frame, int opengl_enabled);
-diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
-index 06b4a3b..4e85b90 100644
---- a/hw/cirrus_vga.c
-+++ b/tools/qemu-xen-traditional/hw/cirrus_vga.c
-@@ -793,11 +793,6 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-         }
-     }
- 
--    /* we have to flush all pending changes so that the copy
--       is generated at the appropriate moment in time */
--    if (notify)
--	vga_hw_update();
--
-     (*s->cirrus_rop) (s, s->vram_ptr +
- 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 		      s->vram_ptr +
-@@ -806,13 +801,13 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- 		      s->cirrus_blt_width, s->cirrus_blt_height);
- 
-     if (notify)
--	qemu_console_copy(s->ds,
--			  sx, sy, dx, dy,
--			  s->cirrus_blt_width / depth,
--			  s->cirrus_blt_height);
-+	dpy_update(s->ds,
-+                   dx, dy,
-+                   s->cirrus_blt_width / depth,
-+                   s->cirrus_blt_height);
- 
-     /* we don't have to notify the display that this portion has
--       changed since qemu_console_copy implies this */
-+       changed since dpy_update implies this */
- 
-     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
- 				s->cirrus_blt_dstpitch, s->cirrus_blt_width,
-diff --git a/hw/vmware_vga.c b/hw/vmware_vga.c
-index d1cba28..c38e43c 100644
---- a/hw/vmware_vga.c
-+++ b/tools/qemu-xen-traditional/hw/vmware_vga.c
-@@ -383,6 +383,7 @@ static inline void vmsvga_copy_rect(struct vmsvga_state_s *s,
- 
- # ifdef DIRECT_VRAM
-     if (s->ds->dpy_copy)
-+#  error This configuration is not supported.  See XSA-211.
-         qemu_console_copy(s->ds, x0, y0, x1, y1, w, h);
-     else
- # endif
-diff --git a/vnc.c b/vnc.c
-index 61d1555..0e61197 100644
---- a/vnc.c
-+++ b/tools/qemu-xen-traditional/vnc.c
-@@ -572,36 +572,6 @@ static void send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
- 	    send_framebuffer_update_raw(vs, x, y, w, h);
- }
- 
--static void vnc_copy(DisplayState *ds, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
--{
--    VncState *vs = ds->opaque;
--    int updating_client = 1;
--
--    if (!vs->update_requested ||
--        src_x < vs->visible_x || src_y < vs->visible_y ||
--	dst_x < vs->visible_x || dst_y < vs->visible_y ||
--	(src_x + w) > (vs->visible_x + vs->visible_w) ||
--	(src_y + h) > (vs->visible_y + vs->visible_h) ||
--	(dst_x + w) > (vs->visible_x + vs->visible_w) ||
--	(dst_y + h) > (vs->visible_y + vs->visible_h))
--	updating_client = 0;
--
--    if (updating_client)
--        _vnc_update_client(vs);
--
--    if (updating_client && vs->csock != -1 && !vs->has_update) {
--	vnc_write_u8(vs, 0);  /* msg id */
--	vnc_write_u8(vs, 0);
--	vnc_write_u16(vs, 1); /* number of rects */
--	vnc_framebuffer_update(vs, dst_x, dst_y, w, h, 1);
--	vnc_write_u16(vs, src_x);
--	vnc_write_u16(vs, src_y);
--	vnc_flush(vs);
--        vs->update_requested--;
--    } else
--	framebuffer_set_updated(vs, dst_x, dst_y, w, h);
--}
--
- static int find_update_height(VncState *vs, int y, int maxy, int last_x, int x)
- {
-     int h;
-@@ -1543,16 +1513,12 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
-     vs->has_pointer_type_change = 0;
-     vs->has_WMVi = 0;
-     vs->absolute = -1;
--    dcl->dpy_copy = NULL;
- 
-     for (i = n_encodings - 1; i >= 0; i--) {
- 	switch (encodings[i]) {
- 	case 0: /* Raw */
- 	    vs->has_hextile = 0;
- 	    break;
--	case 1: /* CopyRect */
--	    dcl->dpy_copy = vnc_copy;
--	    break;
- 	case 5: /* Hextile */
- 	    vs->has_hextile = 1;
- 	    break;
-@@ -2459,7 +2425,6 @@ static void vnc_listen_read(void *opaque)
- 	vs->has_resize = 0;
- 	vs->has_hextile = 0;
-         vs->update_requested = 0;
--	dcl->dpy_copy = NULL;
- 	vnc_timer_init(vs);
-     }
- }
--- 
-2.1.4
-
diff --git a/main/xen/xsa211-qemuu-4.7.patch b/main/xen/xsa211-qemuu-4.7.patch
deleted file mode 100644
index c7a92ed3f1..0000000000
--- a/main/xen/xsa211-qemuu-4.7.patch
+++ /dev/null
@@ -1,259 +0,0 @@
-From 9de536fbc2be97ae887560f08f0fd824efa3d5db Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 14 Feb 2017 19:09:59 +0100
-Subject: [PATCH] cirrus/vnc: zap bitblit support from console code.
-
-There is a special code path (dpy_gfx_copy) to allow graphic emulation
-notify user interface code about bitblit operations carryed out by
-guests.  It is supported by cirrus and vnc server.  The intended purpose
-is to optimize display scrolls and just send over the scroll op instead
-of a full display update.
-
-This is rarely used these days though because modern guests simply don't
-use the cirrus blitter any more.  Any linux guest using the cirrus drm
-driver doesn't.  Any windows guest newer than winxp doesn't ship with a
-cirrus driver any more and thus uses the cirrus as simple framebuffer.
-
-So this code tends to bitrot and bugs can go unnoticed for a long time.
-See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV"
-which fixes a bug lingering in the code for almost a year, added by
-commit "c7628bf vnc: only alloc server surface with clients connected".
-
-Also the vnc server will throttle the frame rate in case it figures the
-network can't keep up (send buffers are full).  This doesn't work with
-dpy_gfx_copy, for any copy operation sent to the vnc client we have to
-send all outstanding updates beforehand, otherwise the vnc client might
-run the client side blit on outdated data and thereby corrupt the
-display.  So this dpy_gfx_copy "optimization" might even make things
-worse on slow network links.
-
-Lets kill it once for all.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- hw/display/cirrus_vga.c | 12 ++-----
- include/ui/console.h    |  7 ----
- ui/console.c            | 28 ---------------
- ui/vnc.c                | 91 -------------------------------------------------
- 4 files changed, 3 insertions(+), 135 deletions(-)
-
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 5901250..2841676 100644
---- a/hw/display/cirrus_vga.c
-+++ b/tools/qemu-xen/hw/display/cirrus_vga.c
-@@ -758,11 +758,6 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
-         }
-     }
- 
--    /* we have to flush all pending changes so that the copy
--       is generated at the appropriate moment in time */
--    if (notify)
--        graphic_hw_update(s->vga.con);
--
-     (*s->cirrus_rop) (s, s->vga.vram_ptr +
- 		      (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
- 		      s->vga.vram_ptr +
-@@ -771,10 +766,9 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
- 		      s->cirrus_blt_width, s->cirrus_blt_height);
- 
-     if (notify) {
--        qemu_console_copy(s->vga.con,
--			  sx, sy, dx, dy,
--			  s->cirrus_blt_width / depth,
--			  s->cirrus_blt_height);
-+        dpy_gfx_update(s->vga.con, dx, dy,
-+                       s->cirrus_blt_width / depth,
-+                       s->cirrus_blt_height);
-     }
- 
-     /* we don't have to notify the display that this portion has
-diff --git a/include/ui/console.h b/include/ui/console.h
-index 047a2b4..ed07065 100644
---- a/include/ui/console.h
-+++ b/tools/qemu-xen/include/ui/console.h
-@@ -166,9 +166,6 @@ typedef struct DisplayChangeListenerOps {
-                            int x, int y, int w, int h);
-     void (*dpy_gfx_switch)(DisplayChangeListener *dcl,
-                            struct DisplaySurface *new_surface);
--    void (*dpy_gfx_copy)(DisplayChangeListener *dcl,
--                         int src_x, int src_y,
--                         int dst_x, int dst_y, int w, int h);
-     bool (*dpy_gfx_check_format)(DisplayChangeListener *dcl,
-                                  pixman_format_code_t format);
- 
-@@ -233,8 +230,6 @@ int dpy_set_ui_info(QemuConsole *con, QemuUIInfo *info);
- void dpy_gfx_update(QemuConsole *con, int x, int y, int w, int h);
- void dpy_gfx_replace_surface(QemuConsole *con,
-                              DisplaySurface *surface);
--void dpy_gfx_copy(QemuConsole *con, int src_x, int src_y,
--                  int dst_x, int dst_y, int w, int h);
- void dpy_text_cursor(QemuConsole *con, int x, int y);
- void dpy_text_update(QemuConsole *con, int x, int y, int w, int h);
- void dpy_text_resize(QemuConsole *con, int w, int h);
-@@ -329,8 +324,6 @@ void text_consoles_set_display(DisplayState *ds);
- void console_select(unsigned int index);
- void console_color_init(DisplayState *ds);
- void qemu_console_resize(QemuConsole *con, int width, int height);
--void qemu_console_copy(QemuConsole *con, int src_x, int src_y,
--                       int dst_x, int dst_y, int w, int h);
- DisplaySurface *qemu_console_surface(QemuConsole *con);
- 
- /* console-gl.c */
-diff --git a/ui/console.c b/ui/console.c
-index 75fc492..72d91cb 100644
---- a/ui/console.c
-+++ b/tools/qemu-xen/ui/console.c
-@@ -1495,27 +1495,6 @@ static void dpy_refresh(DisplayState *s)
-     }
- }
- 
--void dpy_gfx_copy(QemuConsole *con, int src_x, int src_y,
--                  int dst_x, int dst_y, int w, int h)
--{
--    DisplayState *s = con->ds;
--    DisplayChangeListener *dcl;
--
--    if (!qemu_console_is_visible(con)) {
--        return;
--    }
--    QLIST_FOREACH(dcl, &s->listeners, next) {
--        if (con != (dcl->con ? dcl->con : active_console)) {
--            continue;
--        }
--        if (dcl->ops->dpy_gfx_copy) {
--            dcl->ops->dpy_gfx_copy(dcl, src_x, src_y, dst_x, dst_y, w, h);
--        } else { /* TODO */
--            dcl->ops->dpy_gfx_update(dcl, dst_x, dst_y, w, h);
--        }
--    }
--}
--
- void dpy_text_cursor(QemuConsole *con, int x, int y)
- {
-     DisplayState *s = con->ds;
-@@ -1968,13 +1947,6 @@ void qemu_console_resize(QemuConsole *s, int width, int height)
-     dpy_gfx_replace_surface(s, surface);
- }
- 
--void qemu_console_copy(QemuConsole *con, int src_x, int src_y,
--                       int dst_x, int dst_y, int w, int h)
--{
--    assert(con->console_type == GRAPHIC_CONSOLE);
--    dpy_gfx_copy(con, src_x, src_y, dst_x, dst_y, w, h);
--}
--
- DisplaySurface *qemu_console_surface(QemuConsole *console)
- {
-     return console->surface;
-diff --git a/ui/vnc.c b/ui/vnc.c
-index 52c6809..61ab611 100644
---- a/ui/vnc.c
-+++ b/tools/qemu-xen/ui/vnc.c
-@@ -908,96 +908,6 @@ int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
-     return n;
- }
- 
--static void vnc_copy(VncState *vs, int src_x, int src_y, int dst_x, int dst_y, int w, int h)
--{
--    /* send bitblit op to the vnc client */
--    vnc_lock_output(vs);
--    vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
--    vnc_write_u8(vs, 0);
--    vnc_write_u16(vs, 1); /* number of rects */
--    vnc_framebuffer_update(vs, dst_x, dst_y, w, h, VNC_ENCODING_COPYRECT);
--    vnc_write_u16(vs, src_x);
--    vnc_write_u16(vs, src_y);
--    vnc_unlock_output(vs);
--    vnc_flush(vs);
--}
--
--static void vnc_dpy_copy(DisplayChangeListener *dcl,
--                         int src_x, int src_y,
--                         int dst_x, int dst_y, int w, int h)
--{
--    VncDisplay *vd = container_of(dcl, VncDisplay, dcl);
--    VncState *vs, *vn;
--    uint8_t *src_row;
--    uint8_t *dst_row;
--    int i, x, y, pitch, inc, w_lim, s;
--    int cmp_bytes;
--
--    vnc_refresh_server_surface(vd);
--    QTAILQ_FOREACH_SAFE(vs, &vd->clients, next, vn) {
--        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--            vs->force_update = 1;
--            vnc_update_client(vs, 1, true);
--            /* vs might be free()ed here */
--        }
--    }
--
--    /* do bitblit op on the local surface too */
--    pitch = vnc_server_fb_stride(vd);
--    src_row = vnc_server_fb_ptr(vd, src_x, src_y);
--    dst_row = vnc_server_fb_ptr(vd, dst_x, dst_y);
--    y = dst_y;
--    inc = 1;
--    if (dst_y > src_y) {
--        /* copy backwards */
--        src_row += pitch * (h-1);
--        dst_row += pitch * (h-1);
--        pitch = -pitch;
--        y = dst_y + h - 1;
--        inc = -1;
--    }
--    w_lim = w - (VNC_DIRTY_PIXELS_PER_BIT - (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
--    if (w_lim < 0) {
--        w_lim = w;
--    } else {
--        w_lim = w - (w_lim % VNC_DIRTY_PIXELS_PER_BIT);
--    }
--    for (i = 0; i < h; i++) {
--        for (x = 0; x <= w_lim;
--                x += s, src_row += cmp_bytes, dst_row += cmp_bytes) {
--            if (x == w_lim) {
--                if ((s = w - w_lim) == 0)
--                    break;
--            } else if (!x) {
--                s = (VNC_DIRTY_PIXELS_PER_BIT -
--                    (dst_x % VNC_DIRTY_PIXELS_PER_BIT));
--                s = MIN(s, w_lim);
--            } else {
--                s = VNC_DIRTY_PIXELS_PER_BIT;
--            }
--            cmp_bytes = s * VNC_SERVER_FB_BYTES;
--            if (memcmp(src_row, dst_row, cmp_bytes) == 0)
--                continue;
--            memmove(dst_row, src_row, cmp_bytes);
--            QTAILQ_FOREACH(vs, &vd->clients, next) {
--                if (!vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--                    set_bit(((x + dst_x) / VNC_DIRTY_PIXELS_PER_BIT),
--                            vs->dirty[y]);
--                }
--            }
--        }
--        src_row += pitch - w * VNC_SERVER_FB_BYTES;
--        dst_row += pitch - w * VNC_SERVER_FB_BYTES;
--        y += inc;
--    }
--
--    QTAILQ_FOREACH(vs, &vd->clients, next) {
--        if (vnc_has_feature(vs, VNC_FEATURE_COPYRECT)) {
--            vnc_copy(vs, src_x, src_y, dst_x, dst_y, w, h);
--        }
--    }
--}
--
- static void vnc_mouse_set(DisplayChangeListener *dcl,
-                           int x, int y, int visible)
- {
-@@ -3131,7 +3041,6 @@ static void vnc_listen_websocket_read(void *opaque)
- static const DisplayChangeListenerOps dcl_ops = {
-     .dpy_name             = "vnc",
-     .dpy_refresh          = vnc_refresh,
--    .dpy_gfx_copy         = vnc_dpy_copy,
-     .dpy_gfx_update       = vnc_dpy_update,
-     .dpy_gfx_switch       = vnc_dpy_switch,
-     .dpy_gfx_check_format = qemu_pixman_check_format,
--- 
-2.1.4
-
diff --git a/main/xen/xsa212.patch b/main/xen/xsa212.patch
deleted file mode 100644
index 2c435c4136..0000000000
--- a/main/xen/xsa212.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-memory: properly check guest memory ranges in XENMEM_exchange handling
-
-The use of guest_handle_okay() here (as introduced by the XSA-29 fix)
-is insufficient here, guest_handle_subrange_okay() needs to be used
-instead.
-
-Note that the uses are okay in
-- XENMEM_add_to_physmap_batch handling due to the size field being only
-  16 bits wide,
-- livepatch_list() due to the limit of 1024 enforced on the
-  number-of-entries input (leaving aside the fact that this can be
-  called by a privileged domain only anyway),
-- compat mode handling due to counts there being limited to 32 bits,
-- everywhere else due to guest arrays being accessed sequentially from
-  index zero.
-
-This is XSA-212.
-
-Reported-by: Jann Horn <jannh@google.com>
-Signed-off-by: Jan Beulich <jbeulich@suse.com>
-Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
-
---- a/xen/common/memory.c
-+++ b/xen/common/memory.c
-@@ -436,8 +436,8 @@ static long memory_exchange(XEN_GUEST_HA
-         goto fail_early;
-     }
- 
--    if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) ||
--         !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) )
-+    if ( !guest_handle_subrange_okay(exch.in.extent_start, exch.nr_exchanged,
-+                                     exch.in.nr_extents - 1) )
-     {
-         rc = -EFAULT;
-         goto fail_early;
-@@ -447,11 +447,27 @@ static long memory_exchange(XEN_GUEST_HA
-     {
-         in_chunk_order  = exch.out.extent_order - exch.in.extent_order;
-         out_chunk_order = 0;
-+
-+        if ( !guest_handle_subrange_okay(exch.out.extent_start,
-+                                         exch.nr_exchanged >> in_chunk_order,
-+                                         exch.out.nr_extents - 1) )
-+        {
-+            rc = -EFAULT;
-+            goto fail_early;
-+        }
-     }
-     else
-     {
-         in_chunk_order  = 0;
-         out_chunk_order = exch.in.extent_order - exch.out.extent_order;
-+
-+        if ( !guest_handle_subrange_okay(exch.out.extent_start,
-+                                         exch.nr_exchanged << out_chunk_order,
-+                                         exch.out.nr_extents - 1) )
-+        {
-+            rc = -EFAULT;
-+            goto fail_early;
-+        }
-     }
- 
-     d = rcu_lock_domain_by_any_id(exch.in.domid);
---- a/xen/include/asm-x86/x86_64/uaccess.h
-+++ b/xen/include/asm-x86/x86_64/uaccess.h
-@@ -29,8 +29,9 @@ extern void *xlat_malloc(unsigned long *
- /*
-  * Valid if in +ve half of 48-bit address space, or above Xen-reserved area.
-  * This is also valid for range checks (addr, addr+size). As long as the
-- * start address is outside the Xen-reserved area then we will access a
-- * non-canonical address (and thus fault) before ever reaching VIRT_START.
-+ * start address is outside the Xen-reserved area, sequential accesses
-+ * (starting at addr) will hit a non-canonical address (and thus fault)
-+ * before ever reaching VIRT_START.
-  */
- #define __addr_ok(addr) \
-     (((unsigned long)(addr) < (1UL<<47)) || \
-@@ -40,7 +41,8 @@ extern void *xlat_malloc(unsigned long *
-     (__addr_ok(addr) || is_compat_arg_xlat_range(addr, size))
- 
- #define array_access_ok(addr, count, size) \
--    (access_ok(addr, (count)*(size)))
-+    (likely(((count) ?: 0UL) < (~0UL / (size))) && \
-+     access_ok(addr, (count) * (size)))
- 
- #define __compat_addr_ok(d, addr) \
-     ((unsigned long)(addr) < HYPERVISOR_COMPAT_VIRT_START(d))