Merge remote-tracking branch 'luiz/queue/qmp' into staging

# By Peter Maydell
# Via Luiz Capitulino
* luiz/queue/qmp:
  tests/test-string-input-visitor: Handle errors provoked by fuzz test

diff --git a/block/curl.c b/block/curl.c
index 47df9524ea8c7e131f3de77629d819c871b9cefb..f6226b3a086ba8dbae878689037095b5d5cc831c 100644 (file)
--- a/block/curl.c
+++ b/block/curl.c
@@ -34,6 +34,10 @@
 #define DPRINTF(fmt, ...) do { } while (0)
 #endif
 
+#define PROTOCOLS (CURLPROTO_HTTP | CURLPROTO_HTTPS | \
+                   CURLPROTO_FTP | CURLPROTO_FTPS | \
+                   CURLPROTO_TFTP)
+
 #define CURL_NUM_STATES 8
 #define CURL_NUM_ACB    8
 #define SECTOR_SIZE     512
@@ -302,6 +306,13 @@ static CURLState *curl_init_state(BDRVCURLState *s)
     curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg);
     curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1);
 
+    /* Restrict supported protocols to avoid security issues in the more
+     * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
+     * CVE-2013-0249.
+     */
+    curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
+    curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
+
 #ifdef DEBUG_VERBOSE
     curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
 #endif

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index d4677814ca862c6ae50c1676c8477f9288dc36c8..089ed9200695e0d93bdb10ac83cca2e667a0a049 100644 (file)
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -153,7 +153,8 @@ static int s390_virtio_net_init(VirtIOS390Device *dev)
 {
     VirtIODevice *vdev;
 
-    vdev = virtio_net_init((DeviceState *)dev, &dev->nic, &dev->net);
+    vdev = virtio_net_init((DeviceState *)dev, &dev->nic, &dev->net,
+                           dev->host_features);
     if (!vdev) {
         return -1;
     }

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 231f81e48cc66968c945a76b60377f799098abd9..d92e42735cf56bf9d77f991f9d4ef7b99ba45634 100644 (file)
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -555,7 +555,8 @@ static int virtio_ccw_net_init(VirtioCcwDevice *dev)
 {
     VirtIODevice *vdev;
 
-    vdev = virtio_net_init((DeviceState *)dev, &dev->nic, &dev->net);
+    vdev = virtio_net_init((DeviceState *)dev, &dev->nic, &dev->net,
+                           dev->host_features[0]);
     if (!vdev) {
         return -1;
     }

diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index e37358a40c3ecf3c3e4c1883943b06b31f5af078..573c669d15c691eddb21409109cdc0a7b7d2984b 100644 (file)
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -73,8 +73,31 @@ typedef struct VirtIONet
     int multiqueue;
     uint16_t max_queues;
     uint16_t curr_queues;
+    size_t config_size;
 } VirtIONet;
 
+/*
+ * Calculate the number of bytes up to and including the given 'field' of
+ * 'container'.
+ */
+#define endof(container, field) \
+    (offsetof(container, field) + sizeof(((container *)0)->field))
+
+typedef struct VirtIOFeature {
+    uint32_t flags;
+    size_t end;
+} VirtIOFeature;
+
+static VirtIOFeature feature_sizes[] = {
+    {.flags = 1 << VIRTIO_NET_F_MAC,
+     .end = endof(struct virtio_net_config, mac)},
+    {.flags = 1 << VIRTIO_NET_F_STATUS,
+     .end = endof(struct virtio_net_config, status)},
+    {.flags = 1 << VIRTIO_NET_F_MQ,
+     .end = endof(struct virtio_net_config, max_virtqueue_pairs)},
+    {}
+};
+
 static VirtIONetQueue *virtio_net_get_subqueue(NetClientState *nc)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
@@ -104,15 +127,15 @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
     stw_p(&netcfg.status, n->status);
     stw_p(&netcfg.max_virtqueue_pairs, n->max_queues);
     memcpy(netcfg.mac, n->mac, ETH_ALEN);
-    memcpy(config, &netcfg, sizeof(netcfg));
+    memcpy(config, &netcfg, n->config_size);
 }
 
 static void virtio_net_set_config(VirtIODevice *vdev, const uint8_t *config)
 {
     VirtIONet *n = to_virtio_net(vdev);
-    struct virtio_net_config netcfg;
+    struct virtio_net_config netcfg = {};
 
-    memcpy(&netcfg, config, sizeof(netcfg));
+    memcpy(&netcfg, config, n->config_size);
 
     if (!(n->vdev.guest_features >> VIRTIO_NET_F_CTRL_MAC_ADDR & 1) &&
         memcmp(netcfg.mac, n->mac, ETH_ALEN)) {
@@ -1279,15 +1302,21 @@ static void virtio_net_guest_notifier_mask(VirtIODevice *vdev, int idx,
 }
 
 VirtIODevice *virtio_net_init(DeviceState *dev, NICConf *conf,
-                              virtio_net_conf *net)
+                              virtio_net_conf *net, uint32_t host_features)
 {
     VirtIONet *n;
-    int i;
+    int i, config_size = 0;
+
+    for (i = 0; feature_sizes[i].flags != 0; i++) {
+        if (host_features & feature_sizes[i].flags) {
+            config_size = MAX(feature_sizes[i].end, config_size);
+        }
+    }
 
     n = (VirtIONet *)virtio_common_init("virtio-net", VIRTIO_ID_NET,
-                                        sizeof(struct virtio_net_config),
-                                        sizeof(VirtIONet));
+                                        config_size, sizeof(VirtIONet));
 
+    n->config_size = config_size;
     n->vdev.get_config = virtio_net_get_config;
     n->vdev.set_config = virtio_net_set_config;
     n->vdev.get_features = virtio_net_get_features;

diff --git a/hw/virtio-net.h b/hw/virtio-net.h
index f5fea6e9bc3a881a67e31c06f38feed0c1cfb380..e654c13a9fced65d63cfdf01244692cd7b79929e 100644 (file)
--- a/hw/virtio-net.h
+++ b/hw/virtio-net.h
@@ -191,6 +191,6 @@ struct virtio_net_ctrl_mq {
         DEFINE_PROP_BIT("ctrl_vlan", _state, _field, VIRTIO_NET_F_CTRL_VLAN, true), \
         DEFINE_PROP_BIT("ctrl_rx_extra", _state, _field, VIRTIO_NET_F_CTRL_RX_EXTRA, true), \
         DEFINE_PROP_BIT("ctrl_mac_addr", _state, _field, VIRTIO_NET_F_CTRL_MAC_ADDR, true), \
-        DEFINE_PROP_BIT("mq", _state, _field, VIRTIO_NET_F_MQ, true)
+        DEFINE_PROP_BIT("mq", _state, _field, VIRTIO_NET_F_MQ, false)
 
 #endif

diff --git a/hw/virtio-pci.c b/hw/virtio-pci.c
index 9abbcdfc7c125f306f53a400bf2133766af616ad..a869f535de634a343b558b3fea3454f75bda47ee 100644 (file)
--- a/hw/virtio-pci.c
+++ b/hw/virtio-pci.c
@@ -997,7 +997,8 @@ static int virtio_net_init_pci(PCIDevice *pci_dev)
     VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev);
     VirtIODevice *vdev;
 
-    vdev = virtio_net_init(&pci_dev->qdev, &proxy->nic, &proxy->net);
+    vdev = virtio_net_init(&pci_dev->qdev, &proxy->nic, &proxy->net,
+                           proxy->host_features);
 
     vdev->nvectors = proxy->nvectors;
     virtio_init_pci(proxy, vdev);

diff --git a/hw/virtio.h b/hw/virtio.h
index a29a54d4f31de58390aeb9da46c21bcfed4eced3..1e206b83551d8d47a63f19d71ace0952e87c6fde 100644 (file)
--- a/hw/virtio.h
+++ b/hw/virtio.h
@@ -243,7 +243,8 @@ typedef struct VirtIOBlkConf VirtIOBlkConf;
 VirtIODevice *virtio_blk_init(DeviceState *dev, VirtIOBlkConf *blk);
 struct virtio_net_conf;
 VirtIODevice *virtio_net_init(DeviceState *dev, NICConf *conf,
-                              struct virtio_net_conf *net);
+                              struct virtio_net_conf *net,
+                              uint32_t host_features);
 typedef struct virtio_serial_conf virtio_serial_conf;
 VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *serial);
 VirtIODevice *virtio_balloon_init(DeviceState *dev);

diff --git a/hw/xilinx_zynq.c b/hw/xilinx_zynq.c
index 0ac33b5dab6e729983e97303267f010222867bf8..311f7918338db4c6279f94f0ac5d0f2b7e1fc65c 100644 (file)
--- a/hw/xilinx_zynq.c
+++ b/hw/xilinx_zynq.c
@@ -168,7 +168,7 @@ static void zynq_init(QEMUMachineInitArgs *args)
     zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
 
     sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
-    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[75-IRQ_OFFSET]);
+    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
 
     sysbus_create_simple("cadence_uart", 0xE0000000, pic[59-IRQ_OFFSET]);
     sysbus_create_simple("cadence_uart", 0xE0001000, pic[82-IRQ_OFFSET]);

diff --git a/net/net.c b/net/net.c
index 98068625d4e486b5d3221a9ae2ec9a806bdd7b2e..f9e7136a2bfdb13ac6ba5d8b3b21cc8764813910 100644 (file)
--- a/net/net.c
+++ b/net/net.c
@@ -351,7 +351,7 @@ void qemu_del_net_client(NetClientState *nc)
 
 void qemu_del_nic(NICState *nic)
 {
-    int i, queues = nic->conf->queues;
+    int i, queues = MAX(nic->conf->queues, 1);
 
     /* If this is a peer NIC and peer has already been deleted, free it now. */
     if (nic->peer_deleted) {

diff --git a/pc-bios/README b/pc-bios/README
index eff3de7615f1796a30058f6757b6af8b86449460..bb182dc79c5ead654ebde4e1f535f2fc7297ca56 100644 (file)
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -12,7 +12,7 @@
   1275-1994 (referred to as Open Firmware) compliant firmware.
   The included images for PowerPC (for 32 and 64 bit PPC CPUs),
   Sparc32 and Sparc64 are built from OpenBIOS SVN revision
-  1063.
+  1097.
 
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at

diff --git a/pc-bios/openbios-ppc b/pc-bios/openbios-ppc
index 5311eca691f37222e8dc3453c4b6307e4f285306..c37c258143037cd40c07ddd6daceea0746b310fc 100644 (file)
Binary files a/pc-bios/openbios-ppc and b/pc-bios/openbios-ppc differ

diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index 6bd8e45d86e00919fcf3d4de697f1946ea2a3905..79e816ec437dd69bb7b9747b477b55ac675e62df 100644 (file)
Binary files a/pc-bios/openbios-sparc32 and b/pc-bios/openbios-sparc32 differ

diff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index 7c06fcc5aaa2274b01d65b26ec5339d190036e44..14624e9cc77fd5129d42e2d3ede134735ca49fc2 100644 (file)
Binary files a/pc-bios/openbios-sparc64 and b/pc-bios/openbios-sparc64 differ

diff --git a/qemu-nbd.texi b/qemu-nbd.texi
index 6955d903271de24a2c52b544cacdb67183115aeb..3e57200e76f9f14da8b9f304f7929c57930ba85f 100644 (file)
--- a/qemu-nbd.texi
+++ b/qemu-nbd.texi
@@ -29,7 +29,12 @@ Export QEMU disk image using NBD protocol.
 @item -s, --snapshot
   use snapshot file
 @item -n, --nocache
-  disable host cache
+@itemx --cache=@var{cache}
+  set cache mode to be used with the file.  See the documentation of
+  the emulator's @code{-drive cache=...} option for allowed values.
+@item --aio=@var{aio}
+  choose asynchronous I/O mode between @samp{threads} (the default)
+  and @samp{native} (Linux only).
 @item -c, --connect=@var{dev}
   connect @var{filename} to NBD device @var{dev}
 @item -d, --disconnect

diff --git a/roms/openbios b/roms/openbios
index f095c858136896d236931357b8d597f407286f71..a5af2b322e54104f1b095c8c156ffd03bf6ca3e9 160000 (submodule)
--- a/roms/openbios
+++ b/roms/openbios
@@ -1 +1 @@
-Subproject commit f095c858136896d236931357b8d597f407286f71
+Subproject commit a5af2b322e54104f1b095c8c156ffd03bf6ca3e9