Series comparison

-[Qemu-devel] [PULL 0/8] Block patches
+[PULL for-7.0 0/2] Block patches
-The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:
+The following changes since commit 15ef89d2a1a7b93845a6b09c2ee8e1979f6eb30b:
-  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)
+  Update version for v7.0.0-rc1 release (2022-03-22 22:58:44 +0000)
 are available in the Git repository at:
-  https://github.com/stefanha/qemu.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:
+for you to fetch changes up to 2539eade4f689eda7e9fe45486f18334bfbafaf0:
-  docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)
+  hw: Fix misleading hexadecimal format (2022-03-24 10:38:42 +0000)
 ----------------------------------------------------------------
 Pull request
+Philippe found cases where the 0x%d format string was used, leading to
+misleading output. The patches look harmless and could save people time, so I
+think it's worth including them in 7.0.
 ----------------------------------------------------------------
-Andrey Shinkevich (1):
+Philippe Mathieu-Daudé (2):
-  block/io.c: fix for the allocation failure
+  block: Fix misleading hexadecimal format
   hw: Fix misleading hexadecimal format
-Jules Irenge (3):
+ block/parallels-ext.c | 2 +-
-  util/readline: add a space to fix errors by checkpatch tool
+ hw/i386/sgx.c         | 2 +-
-  util: readline: replace tab indent by four spaces to fix checkpatch
+ hw/i386/trace-events  | 6 +++---
-    errors
+ hw/misc/trace-events  | 4 ++--
-  util/readline: Add braces to fix checkpatch errors
+ hw/scsi/trace-events  | 4 ++--
+files changed, 9 insertions(+), 9 deletions(-)
 Nikita Alekseev (1):
   block: Add coroutine_fn to bdrv_check_co_entry
 Paolo Bonzini (1):
   aio-posix: ensure poll mode is left when aio_notify is called
 Stefan Hajnoczi (2):
   docs: add Secure Coding Practices to developer docs
   docs: add Security chapter to the documentation
  Makefile                               |   2 +-
  block.c                                |   2 +-
  block/io.c                             |   2 +-
  util/aio-posix.c                       |  12 +-
  util/readline.c                        | 174 ++++++++++++++-----------
  docs/devel/index.rst                   |   1 +
  docs/devel/secure-coding-practices.rst | 106 +++++++++++++++
  docs/security.texi                     | 131 +++++++++++++++++++
  qemu-doc.texi                          |   3 +
 files changed, 347 insertions(+), 86 deletions(-)
  create mode 100644 docs/devel/secure-coding-practices.rst
  create mode 100644 docs/security.texi
 --
-.21.0
+.35.1

-[Qemu-devel] [PULL 1/8] util/readline: add a space to fix errors by checkpatch tool
+Deleted patch
-From: Jules Irenge <jbi.octave@gmail.com>
-util/readline: add a space to fix errors reported by checkpatch.pl tool
-"ERROR: space required before the open parenthesis"
-"ERROR: space required after that ..."
-within "util/redline.c" file
-Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
-Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/readline.c | 34 +++++++++++++++++-----------------
-file changed, 17 insertions(+), 17 deletions(-)
-diff --git a/util/readline.c b/util/readline.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/readline.c
-+++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
-     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
-         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
--        for(i = 0; i < rs->last_cmd_buf_index; i++) {
-+        for (i = 0; i < rs->last_cmd_buf_index; i++) {
-             rs->printf_func(rs->opaque, "\033[D");
-         }
-         rs->cmd_buf[rs->cmd_buf_size] = '\0';
-         if (rs->read_password) {
-             len = strlen(rs->cmd_buf);
--            for(i = 0; i < len; i++)
-+            for (i = 0; i < len; i++)
-                 rs->printf_func(rs->opaque, "*");
-         } else {
-             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
-@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
-     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
-         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
-         if (delta > 0) {
--            for(i = 0;i < delta; i++) {
-+            for (i = 0; i < delta; i++) {
-                 rs->printf_func(rs->opaque, "\033[C");
-             }
-         } else {
-             delta = -delta;
--            for(i = 0;i < delta; i++) {
-+            for (i = 0; i < delta; i++) {
-                 rs->printf_func(rs->opaque, "\033[D");
-             }
-         }
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-         return;
-     if (rs->nb_completions == 1) {
-         len = strlen(rs->completions[0]);
--        for(i = rs->completion_index; i < len; i++) {
-+        for (i = rs->completion_index; i < len; i++) {
-             readline_insert_char(rs, rs->completions[0][i]);
-         }
-         /* extra space for next argument. XXX: make it more generic */
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-               completion_comp);
-         rs->printf_func(rs->opaque, "\n");
-         max_width = 0;
--        max_prefix = 0;
--        for(i = 0; i < rs->nb_completions; i++) {
-+        max_prefix = 0;
-+        for (i = 0; i < rs->nb_completions; i++) {
-             len = strlen(rs->completions[i]);
--            if (i==0) {
-+            if (i == 0) {
-                 max_prefix = len;
-             } else {
-                 if (len < max_prefix)
-                     max_prefix = len;
--                for(j=0; j<max_prefix; j++) {
-+                for (j = 0; j < max_prefix; j++) {
-                     if (rs->completions[i][j] != rs->completions[0][j])
-                         max_prefix = j;
-                 }
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-             if (len > max_width)
-                 max_width = len;
-         }
--        if (max_prefix > 0)
--            for(i = rs->completion_index; i < max_prefix; i++) {
-+        if (max_prefix > 0)
-+            for (i = rs->completion_index; i < max_prefix; i++) {
-                 readline_insert_char(rs, rs->completions[0][i]);
-             }
-         max_width += 2;
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-             max_width = 80;
-         nb_cols = 80 / max_width;
-         j = 0;
--        for(i = 0; i < rs->nb_completions; i++) {
-+        for (i = 0; i < rs->nb_completions; i++) {
-             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
-             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
-                 rs->printf_func(rs->opaque, "\n");
-@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
- /* return true if command handled */
- void readline_handle_byte(ReadLineState *rs, int ch)
- {
--    switch(rs->esc_state) {
-+    switch (rs->esc_state) {
-     case IS_NORM:
--        switch(ch) {
-+        switch (ch) {
-         case 1:
-             readline_bol(rs);
-             break;
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-         }
-         break;
-     case IS_CSI:
--        switch(ch) {
-+        switch (ch) {
-     case 'A':
-     case 'F':
-         readline_up_char(rs);
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-             rs->esc_param = rs->esc_param * 10 + (ch - '0');
-             goto the_end;
-         case '~':
--            switch(rs->esc_param) {
-+            switch (rs->esc_param) {
-             case 1:
-                 readline_bol(rs);
-                 break;
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-     the_end:
-         break;
-     case IS_SS3:
--        switch(ch) {
-+        switch (ch) {
-         case 'F':
-             readline_eol(rs);
-             break;
---
-.21.0

-[Qemu-devel] [PULL 2/8] util: readline: replace tab indent by four spaces to fix checkpatch errors
+Deleted patch
-From: Jules Irenge <jbi.octave@gmail.com>
-Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
-"ERROR: code indent should never use tabs" within "util/readline.c" file.
-Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
-Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/readline.c | 98 ++++++++++++++++++++++++-------------------------
-file changed, 49 insertions(+), 49 deletions(-)
-diff --git a/util/readline.c b/util/readline.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/readline.c
-+++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
-     int idx;
-     if (rs->hist_entry == 0)
--    return;
-+        return;
-     if (rs->hist_entry == -1) {
--    /* Find latest entry */
--    for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--        if (rs->history[idx] == NULL)
--        break;
--    }
--    rs->hist_entry = idx;
-+        /* Find latest entry */
-+        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-+            if (rs->history[idx] == NULL)
-+                break;
-+        }
-+        rs->hist_entry = idx;
-     }
-     rs->hist_entry--;
-     if (rs->hist_entry >= 0) {
--    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-                 rs->history[rs->hist_entry]);
--    rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
-+        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
-         return;
-     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
-         rs->history[++rs->hist_entry] != NULL) {
--    pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-                 rs->history[rs->hist_entry]);
-     } else {
-         rs->cmd_buf[0] = 0;
--    rs->hist_entry = -1;
-+        rs->hist_entry = -1;
-     }
-     rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
- }
-@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-     int idx;
-     if (cmdline[0] == '\0')
--    return;
-+        return;
-     new_entry = NULL;
-     if (rs->hist_entry != -1) {
--    /* We were editing an existing history entry: replace it */
--    hist_entry = rs->history[rs->hist_entry];
--    idx = rs->hist_entry;
--    if (strcmp(hist_entry, cmdline) == 0) {
--        goto same_entry;
--    }
-+        /* We were editing an existing history entry: replace it */
-+        hist_entry = rs->history[rs->hist_entry];
-+        idx = rs->hist_entry;
-+        if (strcmp(hist_entry, cmdline) == 0) {
-+            goto same_entry;
-+        }
-     }
-     /* Search cmdline in history buffers */
-     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--    hist_entry = rs->history[idx];
--    if (hist_entry == NULL)
--        break;
--    if (strcmp(hist_entry, cmdline) == 0) {
--    same_entry:
--        new_entry = hist_entry;
--        /* Put this entry at the end of history */
--        memmove(&rs->history[idx], &rs->history[idx + 1],
--            (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
--        rs->history[READLINE_MAX_CMDS - 1] = NULL;
--        for (; idx < READLINE_MAX_CMDS; idx++) {
--        if (rs->history[idx] == NULL)
--            break;
--        }
--        break;
--    }
-+        hist_entry = rs->history[idx];
-+        if (hist_entry == NULL)
-+            break;
-+        if (strcmp(hist_entry, cmdline) == 0) {
-+        same_entry:
-+            new_entry = hist_entry;
-+            /* Put this entry at the end of history */
-+            memmove(&rs->history[idx], &rs->history[idx + 1],
-+                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-+            rs->history[READLINE_MAX_CMDS - 1] = NULL;
-+            for (; idx < READLINE_MAX_CMDS; idx++) {
-+                if (rs->history[idx] == NULL)
-+                    break;
-+            }
-+            break;
-+        }
-     }
-     if (idx == READLINE_MAX_CMDS) {
--    /* Need to get one free slot */
-+        /* Need to get one free slot */
-         g_free(rs->history[0]);
--    memmove(rs->history, &rs->history[1],
--            (READLINE_MAX_CMDS - 1) * sizeof(char *));
--    rs->history[READLINE_MAX_CMDS - 1] = NULL;
--    idx = READLINE_MAX_CMDS - 1;
-+        memmove(rs->history, &rs->history[1],
-+                (READLINE_MAX_CMDS - 1) * sizeof(char *));
-+        rs->history[READLINE_MAX_CMDS - 1] = NULL;
-+        idx = READLINE_MAX_CMDS - 1;
-     }
-     if (new_entry == NULL)
-         new_entry = g_strdup(cmdline);
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-         case 8:
-             readline_backspace(rs);
-             break;
--    case 155:
-+        case 155:
-             rs->esc_state = IS_CSI;
--        break;
-+            break;
-         default:
-             if (ch >= 32) {
-                 readline_insert_char(rs, ch);
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-         break;
-     case IS_CSI:
-         switch (ch) {
--    case 'A':
--    case 'F':
--        readline_up_char(rs);
--        break;
--    case 'B':
--    case 'E':
--        readline_down_char(rs);
--        break;
-+        case 'A':
-+        case 'F':
-+            readline_up_char(rs);
-+            break;
-+        case 'B':
-+        case 'E':
-+            readline_down_char(rs);
-+            break;
-         case 'D':
-             readline_backward_char(rs);
-             break;
---
-.21.0

-[Qemu-devel] [PULL 3/8] util/readline: Add braces to fix checkpatch errors
+Deleted patch
-From: Jules Irenge <jbi.octave@gmail.com>
-Add braces to fix errors issued by checkpatch.pl tool
-"ERROR: braces {} are necessary for all arms of this statement"
-Within "util/readline.c" file
-Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
-file changed, 33 insertions(+), 17 deletions(-)
-diff --git a/util/readline.c b/util/readline.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/readline.c
-+++ b/util/readline.c
-@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
-         rs->cmd_buf[rs->cmd_buf_size] = '\0';
-         if (rs->read_password) {
-             len = strlen(rs->cmd_buf);
--            for (i = 0; i < len; i++)
-+            for (i = 0; i < len; i++) {
-                 rs->printf_func(rs->opaque, "*");
-+            }
-         } else {
-             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
-         }
-@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
- {
-     int idx;
--    if (rs->hist_entry == 0)
-+    if (rs->hist_entry == 0) {
-         return;
-+    }
-     if (rs->hist_entry == -1) {
-         /* Find latest entry */
-         for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
--            if (rs->history[idx] == NULL)
-+            if (rs->history[idx] == NULL) {
-                 break;
-+            }
-         }
-         rs->hist_entry = idx;
-     }
-@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
- static void readline_down_char(ReadLineState *rs)
- {
--    if (rs->hist_entry == -1)
-+    if (rs->hist_entry == -1) {
-         return;
-+    }
-     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
-         rs->history[++rs->hist_entry] != NULL) {
-         pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
-@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-     char *hist_entry, *new_entry;
-     int idx;
--    if (cmdline[0] == '\0')
-+    if (cmdline[0] == '\0') {
-         return;
-+    }
-     new_entry = NULL;
-     if (rs->hist_entry != -1) {
-         /* We were editing an existing history entry: replace it */
-@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-     /* Search cmdline in history buffers */
-     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-         hist_entry = rs->history[idx];
--        if (hist_entry == NULL)
-+        if (hist_entry == NULL) {
-             break;
-+        }
-         if (strcmp(hist_entry, cmdline) == 0) {
-         same_entry:
-             new_entry = hist_entry;
-@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-                     (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-             rs->history[READLINE_MAX_CMDS - 1] = NULL;
-             for (; idx < READLINE_MAX_CMDS; idx++) {
--                if (rs->history[idx] == NULL)
-+                if (rs->history[idx] == NULL) {
-                     break;
-+                }
-             }
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
-         rs->history[READLINE_MAX_CMDS - 1] = NULL;
-         idx = READLINE_MAX_CMDS - 1;
-     }
--    if (new_entry == NULL)
-+    if (new_entry == NULL) {
-         new_entry = g_strdup(cmdline);
-+    }
-     rs->history[idx] = new_entry;
-     rs->hist_entry = -1;
- }
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-     g_free(cmdline);
-     /* no completion found */
--    if (rs->nb_completions <= 0)
-+    if (rs->nb_completions <= 0) {
-         return;
-+    }
-     if (rs->nb_completions == 1) {
-         len = strlen(rs->completions[0]);
-         for (i = rs->completion_index; i < len; i++) {
-             readline_insert_char(rs, rs->completions[0][i]);
-         }
-         /* extra space for next argument. XXX: make it more generic */
--        if (len > 0 && rs->completions[0][len - 1] != '/')
-+        if (len > 0 && rs->completions[0][len - 1] != '/') {
-             readline_insert_char(rs, ' ');
-+        }
-     } else {
-         qsort(rs->completions, rs->nb_completions, sizeof(char *),
-               completion_comp);
-@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
-             if (i == 0) {
-                 max_prefix = len;
-             } else {
--                if (len < max_prefix)
-+                if (len < max_prefix) {
-                     max_prefix = len;
-+                }
-                 for (j = 0; j < max_prefix; j++) {
--                    if (rs->completions[i][j] != rs->completions[0][j])
-+                    if (rs->completions[i][j] != rs->completions[0][j]) {
-                         max_prefix = j;
-+                    }
-                 }
-             }
--            if (len > max_width)
-+            if (len > max_width) {
-                 max_width = len;
-+            }
-         }
-         if (max_prefix > 0)
-             for (i = rs->completion_index; i < max_prefix; i++) {
-                 readline_insert_char(rs, rs->completions[0][i]);
-             }
-         max_width += 2;
--        if (max_width < 10)
-+        if (max_width < 10) {
-             max_width = 10;
--        else if (max_width > 80)
-+        } else if (max_width > 80) {
-             max_width = 80;
-+        }
-         nb_cols = 80 / max_width;
-         j = 0;
-         for (i = 0; i < rs->nb_completions; i++) {
-@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
-         case 10:
-         case 13:
-             rs->cmd_buf[rs->cmd_buf_size] = '\0';
--            if (!rs->read_password)
-+            if (!rs->read_password) {
-                 readline_hist_add(rs, rs->cmd_buf);
-+            }
-             rs->printf_func(rs->opaque, "\n");
-             rs->cmd_buf_index = 0;
-             rs->cmd_buf_size = 0;
-@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
- const char *readline_get_history(ReadLineState *rs, unsigned int index)
- {
--    if (index >= READLINE_MAX_CMDS)
-+    if (index >= READLINE_MAX_CMDS) {
-         return NULL;
-+    }
-     return rs->history[index];
- }
---
-.21.0

-[Qemu-devel] [PULL 4/8] block: Add coroutine_fn to bdrv_check_co_entry
+Deleted patch
-From: Nikita Alekseev <n.alekseev2104@gmail.com>
-bdrv_check_co_entry calls bdrv_co_check, which is a coroutine function.
-Thus, it also needs to be marked as a coroutine.
-Signed-off-by: Nikita Alekseev <n.alekseev2104@gmail.com>
-Message-id: 20190401093051.16488-1-n.alekseev2104@gmail.com
-Message-Id: <20190401093051.16488-1-n.alekseev2104@gmail.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/block.c b/block.c
-index XXXXXXX..XXXXXXX 100644
---- a/block.c
-+++ b/block.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CheckCo {
-     int ret;
- } CheckCo;
--static void bdrv_check_co_entry(void *opaque)
-+static void coroutine_fn bdrv_check_co_entry(void *opaque)
- {
-     CheckCo *cco = opaque;
-     cco->ret = bdrv_co_check(cco->bs, cco->res, cco->fix);
---
-.21.0

-[Qemu-devel] [PULL 5/8] block/io.c: fix for the allocation failure
+[PULL for-7.0 1/2] block: Fix misleading hexadecimal format
-From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-On a file system used by the customer, fallocate() returns an error
+"0x%u" format is very misleading, replace by "0x%x".
 if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
 fails. We can handle that case the same way as it is done for the
 unsupported cases, namely, call to bdrv_driver_pwritev() that writes
 zeroes to an image for the unaligned chunk of the block.
-Suggested-by: Denis V. Lunev <den@openvz.org>
+Found running:
-Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
-Reviewed-by: John Snow <jsnow@redhat.com>
+  $ git grep -E '0x%[0-9]*([lL]*|" ?PRI)[dDuU]' block/
-Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
-Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
+Inspired-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Denis V. Lunev <den@openvz.org>
 Message-id: 20220323114718.58714-2-philippe.mathieu.daude@gmail.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/io.c | 2 +-
+ block/parallels-ext.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/block/io.c b/block/io.c
+diff --git a/block/parallels-ext.c b/block/parallels-ext.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
+--- a/block/parallels-ext.c
-+++ b/block/io.c
++++ b/block/parallels-ext.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
+@@ -XXX,XX +XXX,XX @@ static int parallels_parse_format_extension(BlockDriverState *bs,
-             assert(!bs->supported_zero_flags);
+             break;
          default:
 -            error_setg(errp, "Unknown feature: 0x%" PRIu64, fh.magic);
 +            error_setg(errp, "Unknown feature: 0x%" PRIx64, fh.magic);
              goto fail;
          }
--        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
-+        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
-             /* Fall back to bounce buffer if write zeroes is unsupported */
-             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
 --
-.21.0
+.35.1

-[Qemu-devel] [PULL 6/8] aio-posix: ensure poll mode is left when aio_notify is called
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-With aio=thread, adaptive polling makes latency worse rather than
-better, because it delays the execution of the ThreadPool's
-completion bottom half.
-event_notifier_poll() does run while polling, detecting that
-a bottom half was scheduled by a worker thread, but because
-ctx->notifier is explicitly ignored in run_poll_handlers_once(),
-scheduling the BH does not count as making progress and
-run_poll_handlers() keeps running.  Fix this by recomputing
-the deadline after *timeout could have changed.
-With this change, ThreadPool still cannot participate in polling
-but at least it does not suffer from extra latency.
-Reported-by: Sergio Lopez <slp@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20190409122823.12416-1-pbonzini@redhat.com
-Cc: Stefan Hajnoczi <stefanha@gmail.com>
-Cc: Kevin Wolf <kwolf@redhat.com>
-Cc: qemu-block@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/aio-posix.c | 12 ++++++++----
-file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
-         if (!node->deleted && node->io_poll &&
-             aio_node_check(ctx, node->is_external) &&
-             node->io_poll(node->opaque)) {
-+            /*
-+             * Polling was successful, exit try_poll_mode immediately
-+             * to adjust the next polling time.
-+             */
-             *timeout = 0;
-             if (node->opaque != &ctx->notifier) {
-                 progress = true;
-@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
-     do {
-         progress = run_poll_handlers_once(ctx, timeout);
-         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
--    } while (!progress && elapsed_time < max_ns
--             && !atomic_read(&ctx->poll_disable_cnt));
-+        max_ns = qemu_soonest_timeout(*timeout, max_ns);
-+        assert(!(max_ns && progress));
-+    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
-     /* If time has passed with no successful polling, adjust *timeout to
-      * keep the same ending time.
-@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
-  */
- static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
- {
--    /* See qemu_soonest_timeout() uint64_t hack */
--    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
-+    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
-     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
-         poll_set_started(ctx, true);
---
-.21.0

-[Qemu-devel] [PULL 7/8] docs: add Secure Coding Practices to developer docs
+Deleted patch
-At KVM Forum 2018 I gave a presentation on security in QEMU:
-https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
-https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)
-This patch adds a guide to secure coding practices.  This document
-covers things that developers should know about security in QEMU.  It is
-just a starting point that we can expand on later.  I hope it will be
-useful as a resource for new contributors and will save code reviewers
-from explaining the same concepts many times.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
-Message-id: 20190509121820.16294-2-stefanha@redhat.com
-Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- docs/devel/index.rst                   |   1 +
- docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
-files changed, 107 insertions(+)
- create mode 100644 docs/devel/secure-coding-practices.rst
-diff --git a/docs/devel/index.rst b/docs/devel/index.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/index.rst
-+++ b/docs/devel/index.rst
-@@ -XXX,XX +XXX,XX @@ Contents:
-    stable-process
-    testing
-    decodetree
-+   secure-coding-practices
-diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/docs/devel/secure-coding-practices.rst
-@@ -XXX,XX +XXX,XX @@
-+=======================
-+Secure Coding Practices
-+=======================
-+This document covers topics that both developers and security researchers must
-+be aware of so that they can develop safe code and audit existing code
-+properly.
-+
-+Reporting Security Bugs
-+-----------------------
-+For details on how to report security bugs or ask questions about potential
-+security bugs, see the `Security Process wiki page
-+<https://wiki.qemu.org/SecurityProcess>`_.
-+
-+General Secure C Coding Practices
-+---------------------------------
-+Most CVEs (security bugs) reported against QEMU are not specific to
-+virtualization or emulation.  They are simply C programming bugs.  Therefore
-+it's critical to be aware of common classes of security bugs.
-+
-+There is a wide selection of resources available covering secure C coding.  For
-+example, the `CERT C Coding Standard
-+<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
-+covers the most important classes of security bugs.
-+
-+Instead of describing them in detail here, only the names of the most important
-+classes of security bugs are mentioned:
-+
-+* Buffer overflows
-+* Use-after-free and double-free
-+* Integer overflows
-+* Format string vulnerabilities
-+
-+Some of these classes of bugs can be detected by analyzers.  Static analysis is
-+performed regularly by Coverity and the most obvious of these bugs are even
-+reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
-+asan.
-+
-+Input Validation
-+----------------
-+Inputs from the guest or external sources (e.g. network, files) cannot be
-+trusted and may be invalid.  Inputs must be checked before using them in a way
-+that could crash the program, expose host memory to the guest, or otherwise be
-+exploitable by an attacker.
-+
-+The most sensitive attack surface is device emulation.  All hardware register
-+accesses and data read from guest memory must be validated.  A typical example
-+is a device that contains multiple units that are selectable by the guest via
-+an index register::
-+
-+  typedef struct {
-+      ProcessingUnit unit[2];
-+      ...
-+  } MyDeviceState;
-+
-+  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
-+  {
-+      MyDeviceState *mydev = opaque;
-+      ProcessingUnit *unit;
-+
-+      switch (addr) {
-+      case MYDEV_SELECT_UNIT:
-+          unit = &mydev->unit[val];   <-- this input wasn't validated!
-+          ...
-+      }
-+  }
-+
-+If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
-+place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
-+1 and handle the case where it is invalid.
-+
-+Unexpected Device Accesses
-+--------------------------
-+The guest may access device registers in unusual orders or at unexpected
-+moments.  Device emulation code must not assume that the guest follows the
-+typical "theory of operation" presented in driver writer manuals.  The guest
-+may make nonsense accesses to device registers such as starting operations
-+before the device has been fully initialized.
-+
-+A related issue is that device emulation code must be prepared for unexpected
-+device register accesses while asynchronous operations are in progress.  A
-+well-behaved guest might wait for a completion interrupt before accessing
-+certain device registers.  Device emulation code must handle the case where the
-+guest overwrites registers or submits further requests before an ongoing
-+request completes.  Unexpected accesses must not cause memory corruption or
-+leaks in QEMU.
-+
-+Invalid device register accesses can be reported with
-+``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
-+option enables these log messages.
-+
-+Live Migration
-+--------------
-+Device state can be saved to disk image files and shared with other users.
-+Live migration code must validate inputs when loading device state so an
-+attacker cannot gain control by crafting invalid device states.  Device state
-+is therefore considered untrusted even though it is typically generated by QEMU
-+itself.
-+
-+Guest Memory Access Races
-+-------------------------
-+Guests with multiple vCPUs may modify guest RAM while device emulation code is
-+running.  Device emulation code must copy in descriptors and other guest RAM
-+structures and only process the local copy.  This prevents
-+time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
-+crash when a vCPU thread modifies guest RAM while device emulation is
-+processing it.
---
-.21.0

-[Qemu-devel] [PULL 8/8] docs: add Security chapter to the documentation
+[PULL for-7.0 2/2] hw: Fix misleading hexadecimal format
-This new chapter in the QEMU documentation covers the security
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 requirements that QEMU is designed to meet and principles for securely
 deploying QEMU.
-It is just a starting point that can be extended in the future with more
+"0x%u" format is very misleading, replace by "0x%x".
 information.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Found running:
-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+  $ git grep -E '0x%[0-9]*([lL]*|" ?PRI)[dDuU]' hw/
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Inspired-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Message-id: 20220323114718.58714-3-philippe.mathieu.daude@gmail.com
 Message-id: 20190509121820.16294-3-stefanha@redhat.com
 Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- Makefile           |   2 +-
+ hw/i386/sgx.c        | 2 +-
- docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
+ hw/i386/trace-events | 6 +++---
- qemu-doc.texi      |   3 ++
+ hw/misc/trace-events | 4 ++--
-files changed, 135 insertions(+), 1 deletion(-)
+ hw/scsi/trace-events | 4 ++--
- create mode 100644 docs/security.texi
+files changed, 8 insertions(+), 8 deletions(-)
-diff --git a/Makefile b/Makefile
+diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
 index XXXXXXX..XXXXXXX 100644
---- a/Makefile
+--- a/hw/i386/sgx.c
-+++ b/Makefile
++++ b/hw/i386/sgx.c
-@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
+@@ -XXX,XX +XXX,XX @@ void pc_machine_init_sgx_epc(PCMachineState *pcms)
-     qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
+     }
-     qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
-     qemu-monitor-info.texi docs/qemu-block-drivers.texi \
+     if ((sgx_epc->base + sgx_epc->size) < sgx_epc->base) {
--    docs/qemu-cpu-models.texi
+-        error_report("Size of all 'sgx-epc' =0x%"PRIu64" causes EPC to wrap",
-+    docs/qemu-cpu-models.texi docs/security.texi
++        error_report("Size of all 'sgx-epc' =0x%"PRIx64" causes EPC to wrap",
+                      sgx_epc->size);
- docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
+         exit(EXIT_FAILURE);
-     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
+     }
-diff --git a/docs/security.texi b/docs/security.texi
+diff --git a/hw/i386/trace-events b/hw/i386/trace-events
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/hw/i386/trace-events
---- /dev/null
++++ b/hw/i386/trace-events
-+++ b/docs/security.texi
+@@ -XXX,XX +XXX,XX @@ vtd_fault_disabled(void) "Fault processing disabled for context entry"
  vtd_replay_ce_valid(const char *mode, uint8_t bus, uint8_t dev, uint8_t fn, uint16_t domain, uint64_t hi, uint64_t lo) "%s: replay valid context device %02"PRIx8":%02"PRIx8".%02"PRIx8" domain 0x%"PRIx16" hi 0x%"PRIx64" lo 0x%"PRIx64
  vtd_replay_ce_invalid(uint8_t bus, uint8_t dev, uint8_t fn) "replay invalid context device %02"PRIx8":%02"PRIx8".%02"PRIx8
  vtd_page_walk_level(uint64_t addr, uint32_t level, uint64_t start, uint64_t end) "walk (base=0x%"PRIx64", level=%"PRIu32") iova range 0x%"PRIx64" - 0x%"PRIx64
 -vtd_page_walk_one(uint16_t domain, uint64_t iova, uint64_t gpa, uint64_t mask, int perm) "domain 0x%"PRIu16" iova 0x%"PRIx64" -> gpa 0x%"PRIx64" mask 0x%"PRIx64" perm %d"
 +vtd_page_walk_one(uint16_t domain, uint64_t iova, uint64_t gpa, uint64_t mask, int perm) "domain 0x%"PRIx16" iova 0x%"PRIx64" -> gpa 0x%"PRIx64" mask 0x%"PRIx64" perm %d"
  vtd_page_walk_one_skip_map(uint64_t iova, uint64_t mask, uint64_t translated) "iova 0x%"PRIx64" mask 0x%"PRIx64" translated 0x%"PRIx64
  vtd_page_walk_one_skip_unmap(uint64_t iova, uint64_t mask) "iova 0x%"PRIx64" mask 0x%"PRIx64
  vtd_page_walk_skip_read(uint64_t iova, uint64_t next) "Page walk skip iova 0x%"PRIx64" - 0x%"PRIx64" due to unable to read"
  vtd_page_walk_skip_reserve(uint64_t iova, uint64_t next) "Page walk skip iova 0x%"PRIx64" - 0x%"PRIx64" due to rsrv set"
  vtd_switch_address_space(uint8_t bus, uint8_t slot, uint8_t fn, bool on) "Device %02x:%02x.%x switching address space (iommu enabled=%d)"
  vtd_as_unmap_whole(uint8_t bus, uint8_t slot, uint8_t fn, uint64_t iova, uint64_t size) "Device %02x:%02x.%x start 0x%"PRIx64" size 0x%"PRIx64
 -vtd_translate_pt(uint16_t sid, uint64_t addr) "source id 0x%"PRIu16", iova 0x%"PRIx64
 -vtd_pt_enable_fast_path(uint16_t sid, bool success) "sid 0x%"PRIu16" %d"
 +vtd_translate_pt(uint16_t sid, uint64_t addr) "source id 0x%"PRIx16", iova 0x%"PRIx64
 +vtd_pt_enable_fast_path(uint16_t sid, bool success) "sid 0x%"PRIx16" %d"
  vtd_irq_generate(uint64_t addr, uint64_t data) "addr 0x%"PRIx64" data 0x%"PRIx64
  vtd_reg_read(uint64_t addr, uint64_t size) "addr 0x%"PRIx64" size 0x%"PRIx64
  vtd_reg_write(uint64_t addr, uint64_t size, uint64_t val) "addr 0x%"PRIx64" size 0x%"PRIx64" value 0x%"PRIx64
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
 @@ -XXX,XX +XXX,XX @@
-+@node Security
+ # See docs/devel/tracing.rst for syntax documentation.
-+@chapter Security
-+
+ # allwinner-cpucfg.c
-+@section Overview
+-allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIu32
-+
++allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIx32
-+This chapter explains the security requirements that QEMU is designed to meet
+ allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
-+and principles for securely deploying QEMU.
+ allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
-+
-+@section Security Requirements
+@@ -XXX,XX +XXX,XX @@ imx7_gpr_write(uint64_t offset, uint64_t value) "addr 0x%08" PRIx64 "value 0x%08
-+
-+QEMU supports many different use cases, some of which have stricter security
+ # mos6522.c
-+requirements than others.  The community has agreed on the overall security
+ mos6522_set_counter(int index, unsigned int val) "T%d.counter=%d"
-+requirements that users may depend on.  These requirements define what is
+-mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d counter=0x%"PRId64 " delta_next=0x%"PRId64
-+considered supported from a security perspective.
++mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d counter=0x%"PRIx64 " delta_next=0x%"PRIx64
-+
+ mos6522_set_sr_int(void) "set sr_int"
-+@subsection Virtualization Use Case
+ mos6522_write(uint64_t addr, const char *name, uint64_t val) "reg=0x%"PRIx64 " [%s] val=0x%"PRIx64
-+
+ mos6522_read(uint64_t addr, const char *name, unsigned val) "reg=0x%"PRIx64 " [%s] val=0x%x"
-+The virtualization use case covers cloud and virtual private server (VPS)
+diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
 +hosting, as well as traditional data center and desktop virtualization.  These
 +use cases rely on hardware virtualization extensions to execute guest code
 +safely on the physical CPU at close-to-native speed.
 +
 +The following entities are untrusted, meaning that they may be buggy or
 +malicious:
 +
 +@itemize
 +@item Guest
 +@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
 +@item Network protocols (e.g. NBD, live migration)
 +@item User-supplied files (e.g. disk images, kernels, device trees)
 +@item Passthrough devices (e.g. PCI, USB)
 +@end itemize
 +
 +Bugs affecting these entities are evaluated on whether they can cause damage in
 +real-world use cases and treated as security bugs if this is the case.
 +
 +@subsection Non-virtualization Use Case
 +
 +The non-virtualization use case covers emulation using the Tiny Code Generator
 +(TCG).  In principle the TCG and device emulation code used in conjunction with
 +the non-virtualization use case should meet the same security requirements as
 +the virtualization use case.  However, for historical reasons much of the
 +non-virtualization use case code was not written with these security
 +requirements in mind.
 +
 +Bugs affecting the non-virtualization use case are not considered security
 +bugs at this time.  Users with non-virtualization use cases must not rely on
 +QEMU to provide guest isolation or any security guarantees.
 +
 +@section Architecture
 +
 +This section describes the design principles that ensure the security
 +requirements are met.
 +
 +@subsection Guest Isolation
 +
 +Guest isolation is the confinement of guest code to the virtual machine.  When
 +guest code gains control of execution on the host this is called escaping the
 +virtual machine.  Isolation also includes resource limits such as throttling of
 +CPU, memory, disk, or network.  Guests must be unable to exceed their resource
 +limits.
 +
 +QEMU presents an attack surface to the guest in the form of emulated devices.
 +The guest must not be able to gain control of QEMU.  Bugs in emulated devices
 +could allow malicious guests to gain code execution in QEMU.  At this point the
 +guest has escaped the virtual machine and is able to act in the context of the
 +QEMU process on the host.
 +
 +Guests often interact with other guests and share resources with them.  A
 +malicious guest must not gain control of other guests or access their data.
 +Disk image files and network traffic must be protected from other guests unless
 +explicitly shared between them by the user.
 +
 +@subsection Principle of Least Privilege
 +
 +The principle of least privilege states that each component only has access to
 +the privileges necessary for its function.  In the case of QEMU this means that
 +each process only has access to resources belonging to the guest.
 +
 +The QEMU process should not have access to any resources that are inaccessible
 +to the guest.  This way the guest does not gain anything by escaping into the
 +QEMU process since it already has access to those same resources from within
 +the guest.
 +
 +Following the principle of least privilege immediately fulfills guest isolation
 +requirements.  For example, guest A only has access to its own disk image file
 +@code{a.img} and not guest B's disk image file @code{b.img}.
 +
 +In reality certain resources are inaccessible to the guest but must be
 +available to QEMU to perform its function.  For example, host system calls are
 +necessary for QEMU but are not exposed to guests.  A guest that escapes into
 +the QEMU process can then begin invoking host system calls.
 +
 +New features must be designed to follow the principle of least privilege.
 +Should this not be possible for technical reasons, the security risk must be
 +clearly documented so users are aware of the trade-off of enabling the feature.
 +
 +@subsection Isolation mechanisms
 +
 +Several isolation mechanisms are available to realize this architecture of
 +guest isolation and the principle of least privilege.  With the exception of
 +Linux seccomp, these mechanisms are all deployed by management tools that
 +launch QEMU, such as libvirt.  They are also platform-specific so they are only
 +described briefly for Linux here.
 +
 +The fundamental isolation mechanism is that QEMU processes must run as
 +unprivileged users.  Sometimes it seems more convenient to launch QEMU as
 +root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
 +huge security risk.  File descriptor passing can be used to give an otherwise
 +unprivileged QEMU process access to host devices without running QEMU as root.
 +It is also possible to launch QEMU as a non-root user and configure UNIX groups
 +for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
 +Some Linux distros already ship with UNIX groups for these devices by default.
 +
 +@itemize
 +@item SELinux and AppArmor make it possible to confine processes beyond the
 +traditional UNIX process and file permissions model.  They restrict the QEMU
 +process from accessing processes and files on the host system that are not
 +needed by QEMU.
 +
 +@item Resource limits and cgroup controllers provide throughput and utilization
 +limits on key resources such as CPU time, memory, and I/O bandwidth.
 +
 +@item Linux namespaces can be used to make process, file system, and other system
 +resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
 +those resources that were granted to it.
 +
 +@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
 +system calls that are not needed by QEMU, thereby reducing the host kernel
 +attack surface.
 +@end itemize
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-doc.texi
+--- a/hw/scsi/trace-events
-+++ b/qemu-doc.texi
++++ b/hw/scsi/trace-events
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ lsi_bad_phase_interrupt(void) "Phase mismatch interrupt"
- * QEMU Guest Agent::
+ lsi_bad_selection(uint32_t id) "Selected absent target %"PRIu32
- * QEMU User space emulator::
+ lsi_do_dma_unavailable(void) "DMA no data available"
- * System requirements::
+ lsi_do_dma(uint64_t addr, int len) "DMA addr=0x%"PRIx64" len=%d"
-+* Security::
+-lsi_queue_command(uint32_t tag) "Queueing tag=0x%"PRId32
- * Implementation notes::
++lsi_queue_command(uint32_t tag) "Queueing tag=0x%"PRIx32
- * Deprecated features::
+ lsi_add_msg_byte_error(void) "MSG IN data too long"
- * Supported build platforms::
+ lsi_add_msg_byte(uint8_t data) "MSG IN 0x%02x"
-@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
+ lsi_reselect(int id) "Reselected target %d"
- if RHEL7 has kernel 3.10, KVM there has the required functionality there
+@@ -XXX,XX +XXX,XX @@ lsi_do_msgout_noop(void) "MSG: No Operation"
- to make it close to a 4.5 or newer kernel.
+ lsi_do_msgout_extended(uint8_t msg, uint8_t len) "Extended message 0x%x (len %d)"
+ lsi_do_msgout_ignored(const char *msg) "%s (ignored)"
-+@include docs/security.texi
+ lsi_do_msgout_simplequeue(uint8_t select_tag) "SIMPLE queue tag=0x%x"
-+
+-lsi_do_msgout_abort(uint32_t tag) "MSG: ABORT TAG tag=0x%"PRId32
- @include qemu-tech.texi
++lsi_do_msgout_abort(uint32_t tag) "MSG: ABORT TAG tag=0x%"PRIx32
+ lsi_do_msgout_clearqueue(uint32_t tag) "MSG: CLEAR QUEUE tag=0x%"PRIx32
- @include qemu-deprecated.texi
+ lsi_do_msgout_busdevicereset(uint32_t tag) "MSG: BUS DEVICE RESET tag=0x%"PRIx32
  lsi_do_msgout_select(int id) "Select LUN %d"
 --
-.21.0
+.35.1

The following changes since commit 812b835fb4d23dd108b2f9802158472d50b73579:

Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2019-05-07' into staging (2019-05-09 16:31:12 +0100)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to e84125761f78919fe63616d9888ea45e72dc956f:

docs: add Security chapter to the documentation (2019-05-10 10:53:52 +0100)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Andrey Shinkevich (1):
  block/io.c: fix for the allocation failure

Jules Irenge (3):
  util/readline: add a space to fix errors by checkpatch tool
  util: readline: replace tab indent by four spaces to fix checkpatch
    errors
  util/readline: Add braces to fix checkpatch errors

Nikita Alekseev (1):
  block: Add coroutine_fn to bdrv_check_co_entry

Paolo Bonzini (1):
  aio-posix: ensure poll mode is left when aio_notify is called

Stefan Hajnoczi (2):
  docs: add Secure Coding Practices to developer docs
  docs: add Security chapter to the documentation

-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

util/readline: add a space to fix errors reported by checkpatch.pl tool
"ERROR: space required before the open parenthesis"
"ERROR: space required after that ..."
within "util/redline.c" file

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-2-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-2-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
 
     if (rs->cmd_buf_size != rs->last_cmd_buf_size ||
         memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) {
-        for(i = 0; i < rs->last_cmd_buf_index; i++) {
+        for (i = 0; i < rs->last_cmd_buf_index; i++) {
             rs->printf_func(rs->opaque, "\033[D");
         }
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for(i = 0; i < len; i++)
+            for (i = 0; i < len; i++)
                 rs->printf_func(rs->opaque, "*");
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
     if (rs->cmd_buf_index != rs->last_cmd_buf_index) {
         delta = rs->cmd_buf_index - rs->last_cmd_buf_index;
         if (delta > 0) {
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[C");
             }
         } else {
             delta = -delta;
-            for(i = 0;i < delta; i++) {
+            for (i = 0; i < delta; i++) {
                 rs->printf_func(rs->opaque, "\033[D");
             }
         }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
         return;
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
-        for(i = rs->completion_index; i < len; i++) {
+        for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
               completion_comp);
         rs->printf_func(rs->opaque, "\n");
         max_width = 0;
-        max_prefix = 0;	
-        for(i = 0; i < rs->nb_completions; i++) {
+        max_prefix = 0;
+        for (i = 0; i < rs->nb_completions; i++) {
             len = strlen(rs->completions[i]);
-            if (i==0) {
+            if (i == 0) {
                 max_prefix = len;
             } else {
                 if (len < max_prefix)
                     max_prefix = len;
-                for(j=0; j<max_prefix; j++) {
+                for (j = 0; j < max_prefix; j++) {
                     if (rs->completions[i][j] != rs->completions[0][j])
                         max_prefix = j;
                 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (len > max_width)
                 max_width = len;
         }
-        if (max_prefix > 0) 
-            for(i = rs->completion_index; i < max_prefix; i++) {
+        if (max_prefix > 0)
+            for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             max_width = 80;
         nb_cols = 80 / max_width;
         j = 0;
-        for(i = 0; i < rs->nb_completions; i++) {
+        for (i = 0; i < rs->nb_completions; i++) {
             rs->printf_func(rs->opaque, "%-*s", max_width, rs->completions[i]);
             if (++j == nb_cols || i == (rs->nb_completions - 1)) {
                 rs->printf_func(rs->opaque, "\n");
@@ -XXX,XX +XXX,XX @@ static void readline_clear_screen(ReadLineState *rs)
 /* return true if command handled */
 void readline_handle_byte(ReadLineState *rs, int ch)
 {
-    switch(rs->esc_state) {
+    switch (rs->esc_state) {
     case IS_NORM:
-        switch(ch) {
+        switch (ch) {
         case 1:
             readline_bol(rs);
             break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         }
         break;
     case IS_CSI:
-        switch(ch) {
+        switch (ch) {
 	case 'A':
 	case 'F':
 	    readline_up_char(rs);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
             rs->esc_param = rs->esc_param * 10 + (ch - '0');
             goto the_end;
         case '~':
-            switch(rs->esc_param) {
+            switch (rs->esc_param) {
             case 1:
                 readline_bol(rs);
                 break;
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
     the_end:
         break;
     case IS_SS3:
-        switch(ch) {
+        switch (ch) {
         case 'F':
             readline_eol(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Replace tab indent by four spaces to fix errors issued by checkpatch.pl tool
"ERROR: code indent should never use tabs" within "util/readline.c" file.

Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190401024406.10819-3-jbi.octave@gmail.com
Message-Id: <20190401024406.10819-3-jbi.octave@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 98 ++++++++++++++++++++++++-------------------------
 1 file changed, 49 insertions(+), 49 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
     int idx;
 
     if (rs->hist_entry == 0)
-	return;
+        return;
     if (rs->hist_entry == -1) {
-	/* Find latest entry */
-	for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	    if (rs->history[idx] == NULL)
-		break;
-	}
-	rs->hist_entry = idx;
+        /* Find latest entry */
+        for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
+            if (rs->history[idx] == NULL)
+                break;
+        }
+        rs->hist_entry = idx;
     }
     rs->hist_entry--;
     if (rs->hist_entry >= 0) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
-	rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
+        rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void readline_down_char(ReadLineState *rs)
         return;
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
-	pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
+        pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
                 rs->history[rs->hist_entry]);
     } else {
         rs->cmd_buf[0] = 0;
-	rs->hist_entry = -1;
+        rs->hist_entry = -1;
     }
     rs->cmd_buf_index = rs->cmd_buf_size = strlen(rs->cmd_buf);
 }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     int idx;
 
     if (cmdline[0] == '\0')
-	return;
+        return;
     new_entry = NULL;
     if (rs->hist_entry != -1) {
-	/* We were editing an existing history entry: replace it */
-	hist_entry = rs->history[rs->hist_entry];
-	idx = rs->hist_entry;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	    goto same_entry;
-	}
+        /* We were editing an existing history entry: replace it */
+        hist_entry = rs->history[rs->hist_entry];
+        idx = rs->hist_entry;
+        if (strcmp(hist_entry, cmdline) == 0) {
+            goto same_entry;
+        }
     }
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-	hist_entry = rs->history[idx];
-	if (hist_entry == NULL)
-	    break;
-	if (strcmp(hist_entry, cmdline) == 0) {
-	same_entry:
-	    new_entry = hist_entry;
-	    /* Put this entry at the end of history */
-	    memmove(&rs->history[idx], &rs->history[idx + 1],
-		    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
-	    rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	    for (; idx < READLINE_MAX_CMDS; idx++) {
-		if (rs->history[idx] == NULL)
-		    break;
-	    }
-	    break;
-	}
+        hist_entry = rs->history[idx];
+        if (hist_entry == NULL)
+            break;
+        if (strcmp(hist_entry, cmdline) == 0) {
+        same_entry:
+            new_entry = hist_entry;
+            /* Put this entry at the end of history */
+            memmove(&rs->history[idx], &rs->history[idx + 1],
+                    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
+            rs->history[READLINE_MAX_CMDS - 1] = NULL;
+            for (; idx < READLINE_MAX_CMDS; idx++) {
+                if (rs->history[idx] == NULL)
+                    break;
+            }
+            break;
+        }
     }
     if (idx == READLINE_MAX_CMDS) {
-	/* Need to get one free slot */
+        /* Need to get one free slot */
         g_free(rs->history[0]);
-	memmove(rs->history, &rs->history[1],
-	        (READLINE_MAX_CMDS - 1) * sizeof(char *));
-	rs->history[READLINE_MAX_CMDS - 1] = NULL;
-	idx = READLINE_MAX_CMDS - 1;
+        memmove(rs->history, &rs->history[1],
+                (READLINE_MAX_CMDS - 1) * sizeof(char *));
+        rs->history[READLINE_MAX_CMDS - 1] = NULL;
+        idx = READLINE_MAX_CMDS - 1;
     }
     if (new_entry == NULL)
         new_entry = g_strdup(cmdline);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 8:
             readline_backspace(rs);
             break;
-	case 155:
+        case 155:
             rs->esc_state = IS_CSI;
-	    break;
+            break;
         default:
             if (ch >= 32) {
                 readline_insert_char(rs, ch);
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         break;
     case IS_CSI:
         switch (ch) {
-	case 'A':
-	case 'F':
-	    readline_up_char(rs);
-	    break;
-	case 'B':
-	case 'E':
-	    readline_down_char(rs);
-	    break;
+        case 'A':
+        case 'F':
+            readline_up_char(rs);
+            break;
+        case 'B':
+        case 'E':
+            readline_down_char(rs);
+            break;
         case 'D':
             readline_backward_char(rs);
             break;
-- 
2.21.0

From: Jules Irenge <jbi.octave@gmail.com>

Add braces to fix errors issued by checkpatch.pl tool
"ERROR: braces {} are necessary for all arms of this statement"
Within "util/readline.c" file
Message-Id: <20190330112142.14082-1-jbi.octave@gmail.com>

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/readline.c | 50 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/util/readline.c b/util/readline.c
index XXXXXXX..XXXXXXX 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -XXX,XX +XXX,XX @@ static void readline_update(ReadLineState *rs)
         rs->cmd_buf[rs->cmd_buf_size] = '\0';
         if (rs->read_password) {
             len = strlen(rs->cmd_buf);
-            for (i = 0; i < len; i++)
+            for (i = 0; i < len; i++) {
                 rs->printf_func(rs->opaque, "*");
+            }
         } else {
             rs->printf_func(rs->opaque, "%s", rs->cmd_buf);
         }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 {
     int idx;
 
-    if (rs->hist_entry == 0)
+    if (rs->hist_entry == 0) {
         return;
+    }
     if (rs->hist_entry == -1) {
         /* Find latest entry */
         for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
-            if (rs->history[idx] == NULL)
+            if (rs->history[idx] == NULL) {
                 break;
+            }
         }
         rs->hist_entry = idx;
     }
@@ -XXX,XX +XXX,XX @@ static void readline_up_char(ReadLineState *rs)
 
 static void readline_down_char(ReadLineState *rs)
 {
-    if (rs->hist_entry == -1)
+    if (rs->hist_entry == -1) {
         return;
+    }
     if (rs->hist_entry < READLINE_MAX_CMDS - 1 &&
         rs->history[++rs->hist_entry] != NULL) {
         pstrcpy(rs->cmd_buf, sizeof(rs->cmd_buf),
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     char *hist_entry, *new_entry;
     int idx;
 
-    if (cmdline[0] == '\0')
+    if (cmdline[0] == '\0') {
         return;
+    }
     new_entry = NULL;
     if (rs->hist_entry != -1) {
         /* We were editing an existing history entry: replace it */
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
     /* Search cmdline in history buffers */
     for (idx = 0; idx < READLINE_MAX_CMDS; idx++) {
         hist_entry = rs->history[idx];
-        if (hist_entry == NULL)
+        if (hist_entry == NULL) {
             break;
+        }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
             new_entry = hist_entry;
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
                     (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
             rs->history[READLINE_MAX_CMDS - 1] = NULL;
             for (; idx < READLINE_MAX_CMDS; idx++) {
-                if (rs->history[idx] == NULL)
+                if (rs->history[idx] == NULL) {
                     break;
+                }
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         rs->history[READLINE_MAX_CMDS - 1] = NULL;
         idx = READLINE_MAX_CMDS - 1;
     }
-    if (new_entry == NULL)
+    if (new_entry == NULL) {
         new_entry = g_strdup(cmdline);
+    }
     rs->history[idx] = new_entry;
     rs->hist_entry = -1;
 }
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
     g_free(cmdline);
 
     /* no completion found */
-    if (rs->nb_completions <= 0)
+    if (rs->nb_completions <= 0) {
         return;
+    }
     if (rs->nb_completions == 1) {
         len = strlen(rs->completions[0]);
         for (i = rs->completion_index; i < len; i++) {
             readline_insert_char(rs, rs->completions[0][i]);
         }
         /* extra space for next argument. XXX: make it more generic */
-        if (len > 0 && rs->completions[0][len - 1] != '/')
+        if (len > 0 && rs->completions[0][len - 1] != '/') {
             readline_insert_char(rs, ' ');
+        }
     } else {
         qsort(rs->completions, rs->nb_completions, sizeof(char *),
               completion_comp);
@@ -XXX,XX +XXX,XX @@ static void readline_completion(ReadLineState *rs)
             if (i == 0) {
                 max_prefix = len;
             } else {
-                if (len < max_prefix)
+                if (len < max_prefix) {
                     max_prefix = len;
+                }
                 for (j = 0; j < max_prefix; j++) {
-                    if (rs->completions[i][j] != rs->completions[0][j])
+                    if (rs->completions[i][j] != rs->completions[0][j]) {
                         max_prefix = j;
+                    }
                 }
             }
-            if (len > max_width)
+            if (len > max_width) {
                 max_width = len;
+            }
         }
         if (max_prefix > 0)
             for (i = rs->completion_index; i < max_prefix; i++) {
                 readline_insert_char(rs, rs->completions[0][i]);
             }
         max_width += 2;
-        if (max_width < 10)
+        if (max_width < 10) {
             max_width = 10;
-        else if (max_width > 80)
+        } else if (max_width > 80) {
             max_width = 80;
+        }
         nb_cols = 80 / max_width;
         j = 0;
         for (i = 0; i < rs->nb_completions; i++) {
@@ -XXX,XX +XXX,XX @@ void readline_handle_byte(ReadLineState *rs, int ch)
         case 10:
         case 13:
             rs->cmd_buf[rs->cmd_buf_size] = '\0';
-            if (!rs->read_password)
+            if (!rs->read_password) {
                 readline_hist_add(rs, rs->cmd_buf);
+            }
             rs->printf_func(rs->opaque, "\n");
             rs->cmd_buf_index = 0;
             rs->cmd_buf_size = 0;
@@ -XXX,XX +XXX,XX @@ void readline_restart(ReadLineState *rs)
 
 const char *readline_get_history(ReadLineState *rs, unsigned int index)
 {
-    if (index >= READLINE_MAX_CMDS)
+    if (index >= READLINE_MAX_CMDS) {
         return NULL;
+    }
     return rs->history[index];
 }
 
-- 
2.21.0

From: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>

On a file system used by the customer, fallocate() returns an error
if the block is not properly aligned. So, bdrv_co_pwrite_zeroes()
fails. We can handle that case the same way as it is done for the
unsupported cases, namely, call to bdrv_driver_pwritev() that writes
zeroes to an image for the unaligned chunk of the block.

Suggested-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: Andrey Shinkevich <andrey.shinkevich@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com
Message-Id: <1554474244-553661-1-git-send-email-andrey.shinkevich@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
             assert(!bs->supported_zero_flags);
         }
 
-        if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
+        if (ret < 0 && !(flags & BDRV_REQ_NO_FALLBACK)) {
             /* Fall back to bounce buffer if write zeroes is unsupported */
             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
 
-- 
2.21.0

From: Paolo Bonzini <pbonzini@redhat.com>

With aio=thread, adaptive polling makes latency worse rather than
better, because it delays the execution of the ThreadPool's
completion bottom half.

event_notifier_poll() does run while polling, detecting that
a bottom half was scheduled by a worker thread, but because
ctx->notifier is explicitly ignored in run_poll_handlers_once(),
scheduling the BH does not count as making progress and
run_poll_handlers() keeps running.  Fix this by recomputing
the deadline after *timeout could have changed.

With this change, ThreadPool still cannot participate in polling
but at least it does not suffer from extra latency.

Reported-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20190409122823.12416-1-pbonzini@redhat.com
Cc: Stefan Hajnoczi <stefanha@gmail.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: qemu-block@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1553692145-86728-1-git-send-email-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20190409122823.12416-1-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers_once(AioContext *ctx, int64_t *timeout)
         if (!node->deleted && node->io_poll &&
             aio_node_check(ctx, node->is_external) &&
             node->io_poll(node->opaque)) {
+            /*
+             * Polling was successful, exit try_poll_mode immediately
+             * to adjust the next polling time.
+             */
             *timeout = 0;
             if (node->opaque != &ctx->notifier) {
                 progress = true;
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
     do {
         progress = run_poll_handlers_once(ctx, timeout);
         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
-    } while (!progress && elapsed_time < max_ns
-             && !atomic_read(&ctx->poll_disable_cnt));
+        max_ns = qemu_soonest_timeout(*timeout, max_ns);
+        assert(!(max_ns && progress));
+    } while (elapsed_time < max_ns && !atomic_read(&ctx->poll_disable_cnt));
 
     /* If time has passed with no successful polling, adjust *timeout to
      * keep the same ending time.
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
  */
 static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
 {
-    /* See qemu_soonest_timeout() uint64_t hack */
-    int64_t max_ns = MIN((uint64_t)*timeout, (uint64_t)ctx->poll_ns);
+    int64_t max_ns = qemu_soonest_timeout(*timeout, ctx->poll_ns);
 
     if (max_ns && !atomic_read(&ctx->poll_disable_cnt)) {
         poll_set_started(ctx, true);
-- 
2.21.0

At KVM Forum 2018 I gave a presentation on security in QEMU:
https://www.youtube.com/watch?v=YAdRf_hwxU8 (video)
https://vmsplice.net/~stefan/stefanha-kvm-forum-2018.pdf (slides)

This patch adds a guide to secure coding practices.  This document
covers things that developers should know about security in QEMU.  It is
just a starting point that we can expand on later.  I hope it will be
useful as a resource for new contributors and will save code reviewers
from explaining the same concepts many times.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-2-stefanha@redhat.com
Message-Id: <20190509121820.16294-2-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/index.rst                   |   1 +
 docs/devel/secure-coding-practices.rst | 106 +++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 docs/devel/secure-coding-practices.rst

diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    stable-process
    testing
    decodetree
+   secure-coding-practices
diff --git a/docs/devel/secure-coding-practices.rst b/docs/devel/secure-coding-practices.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/secure-coding-practices.rst
@@ -XXX,XX +XXX,XX @@
+=======================
+Secure Coding Practices
+=======================
+This document covers topics that both developers and security researchers must
+be aware of so that they can develop safe code and audit existing code
+properly.
+
+Reporting Security Bugs
+-----------------------
+For details on how to report security bugs or ask questions about potential
+security bugs, see the `Security Process wiki page
+<https://wiki.qemu.org/SecurityProcess>`_.
+
+General Secure C Coding Practices
+---------------------------------
+Most CVEs (security bugs) reported against QEMU are not specific to
+virtualization or emulation.  They are simply C programming bugs.  Therefore
+it's critical to be aware of common classes of security bugs.
+
+There is a wide selection of resources available covering secure C coding.  For
+example, the `CERT C Coding Standard
+<https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard>`_
+covers the most important classes of security bugs.
+
+Instead of describing them in detail here, only the names of the most important
+classes of security bugs are mentioned:
+
+* Buffer overflows
+* Use-after-free and double-free
+* Integer overflows
+* Format string vulnerabilities
+
+Some of these classes of bugs can be detected by analyzers.  Static analysis is
+performed regularly by Coverity and the most obvious of these bugs are even
+reported by compilers.  Dynamic analysis is possible with valgrind, tsan, and
+asan.
+
+Input Validation
+----------------
+Inputs from the guest or external sources (e.g. network, files) cannot be
+trusted and may be invalid.  Inputs must be checked before using them in a way
+that could crash the program, expose host memory to the guest, or otherwise be
+exploitable by an attacker.
+
+The most sensitive attack surface is device emulation.  All hardware register
+accesses and data read from guest memory must be validated.  A typical example
+is a device that contains multiple units that are selectable by the guest via
+an index register::
+
+  typedef struct {
+      ProcessingUnit unit[2];
+      ...
+  } MyDeviceState;
+
+  static void mydev_writel(void *opaque, uint32_t addr, uint32_t val)
+  {
+      MyDeviceState *mydev = opaque;
+      ProcessingUnit *unit;
+
+      switch (addr) {
+      case MYDEV_SELECT_UNIT:
+          unit = &mydev->unit[val];   <-- this input wasn't validated!
+          ...
+      }
+  }
+
+If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
+place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
+1 and handle the case where it is invalid.
+
+Unexpected Device Accesses
+--------------------------
+The guest may access device registers in unusual orders or at unexpected
+moments.  Device emulation code must not assume that the guest follows the
+typical "theory of operation" presented in driver writer manuals.  The guest
+may make nonsense accesses to device registers such as starting operations
+before the device has been fully initialized.
+
+A related issue is that device emulation code must be prepared for unexpected
+device register accesses while asynchronous operations are in progress.  A
+well-behaved guest might wait for a completion interrupt before accessing
+certain device registers.  Device emulation code must handle the case where the
+guest overwrites registers or submits further requests before an ongoing
+request completes.  Unexpected accesses must not cause memory corruption or
+leaks in QEMU.
+
+Invalid device register accesses can be reported with
+``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
+option enables these log messages.
+
+Live Migration
+--------------
+Device state can be saved to disk image files and shared with other users.
+Live migration code must validate inputs when loading device state so an
+attacker cannot gain control by crafting invalid device states.  Device state
+is therefore considered untrusted even though it is typically generated by QEMU
+itself.
+
+Guest Memory Access Races
+-------------------------
+Guests with multiple vCPUs may modify guest RAM while device emulation code is
+running.  Device emulation code must copy in descriptors and other guest RAM
+structures and only process the local copy.  This prevents
+time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
+crash when a vCPU thread modifies guest RAM while device emulation is
+processing it.
-- 
2.21.0

This new chapter in the QEMU documentation covers the security
requirements that QEMU is designed to meet and principles for securely
deploying QEMU.

It is just a starting point that can be extended in the future with more
information.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Message-id: 20190509121820.16294-3-stefanha@redhat.com
Message-Id: <20190509121820.16294-3-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 Makefile           |   2 +-
 docs/security.texi | 131 +++++++++++++++++++++++++++++++++++++++++++++
 qemu-doc.texi      |   3 ++
 3 files changed, 135 insertions(+), 1 deletion(-)
 create mode 100644 docs/security.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi qemu-option-trace.texi \
 	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-	docs/qemu-cpu-models.texi
+	docs/qemu-cpu-models.texi docs/security.texi
 
 docs/interop/qemu-ga-ref.dvi docs/interop/qemu-ga-ref.html \
     docs/interop/qemu-ga-ref.info docs/interop/qemu-ga-ref.pdf \
diff --git a/docs/security.texi b/docs/security.texi
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/security.texi
@@ -XXX,XX +XXX,XX @@
+@node Security
+@chapter Security
+
+@section Overview
+
+This chapter explains the security requirements that QEMU is designed to meet
+and principles for securely deploying QEMU.
+
+@section Security Requirements
+
+QEMU supports many different use cases, some of which have stricter security
+requirements than others.  The community has agreed on the overall security
+requirements that users may depend on.  These requirements define what is
+considered supported from a security perspective.
+
+@subsection Virtualization Use Case
+
+The virtualization use case covers cloud and virtual private server (VPS)
+hosting, as well as traditional data center and desktop virtualization.  These
+use cases rely on hardware virtualization extensions to execute guest code
+safely on the physical CPU at close-to-native speed.
+
+The following entities are untrusted, meaning that they may be buggy or
+malicious:
+
+@itemize
+@item Guest
+@item User-facing interfaces (e.g. VNC, SPICE, WebSocket)
+@item Network protocols (e.g. NBD, live migration)
+@item User-supplied files (e.g. disk images, kernels, device trees)
+@item Passthrough devices (e.g. PCI, USB)
+@end itemize
+
+Bugs affecting these entities are evaluated on whether they can cause damage in
+real-world use cases and treated as security bugs if this is the case.
+
+@subsection Non-virtualization Use Case
+
+The non-virtualization use case covers emulation using the Tiny Code Generator
+(TCG).  In principle the TCG and device emulation code used in conjunction with
+the non-virtualization use case should meet the same security requirements as
+the virtualization use case.  However, for historical reasons much of the
+non-virtualization use case code was not written with these security
+requirements in mind.
+
+Bugs affecting the non-virtualization use case are not considered security
+bugs at this time.  Users with non-virtualization use cases must not rely on
+QEMU to provide guest isolation or any security guarantees.
+
+@section Architecture
+
+This section describes the design principles that ensure the security
+requirements are met.
+
+@subsection Guest Isolation
+
+Guest isolation is the confinement of guest code to the virtual machine.  When
+guest code gains control of execution on the host this is called escaping the
+virtual machine.  Isolation also includes resource limits such as throttling of
+CPU, memory, disk, or network.  Guests must be unable to exceed their resource
+limits.
+
+QEMU presents an attack surface to the guest in the form of emulated devices.
+The guest must not be able to gain control of QEMU.  Bugs in emulated devices
+could allow malicious guests to gain code execution in QEMU.  At this point the
+guest has escaped the virtual machine and is able to act in the context of the
+QEMU process on the host.
+
+Guests often interact with other guests and share resources with them.  A
+malicious guest must not gain control of other guests or access their data.
+Disk image files and network traffic must be protected from other guests unless
+explicitly shared between them by the user.
+
+@subsection Principle of Least Privilege
+
+The principle of least privilege states that each component only has access to
+the privileges necessary for its function.  In the case of QEMU this means that
+each process only has access to resources belonging to the guest.
+
+The QEMU process should not have access to any resources that are inaccessible
+to the guest.  This way the guest does not gain anything by escaping into the
+QEMU process since it already has access to those same resources from within
+the guest.
+
+Following the principle of least privilege immediately fulfills guest isolation
+requirements.  For example, guest A only has access to its own disk image file
+@code{a.img} and not guest B's disk image file @code{b.img}.
+
+In reality certain resources are inaccessible to the guest but must be
+available to QEMU to perform its function.  For example, host system calls are
+necessary for QEMU but are not exposed to guests.  A guest that escapes into
+the QEMU process can then begin invoking host system calls.
+
+New features must be designed to follow the principle of least privilege.
+Should this not be possible for technical reasons, the security risk must be
+clearly documented so users are aware of the trade-off of enabling the feature.
+
+@subsection Isolation mechanisms
+
+Several isolation mechanisms are available to realize this architecture of
+guest isolation and the principle of least privilege.  With the exception of
+Linux seccomp, these mechanisms are all deployed by management tools that
+launch QEMU, such as libvirt.  They are also platform-specific so they are only
+described briefly for Linux here.
+
+The fundamental isolation mechanism is that QEMU processes must run as
+unprivileged users.  Sometimes it seems more convenient to launch QEMU as
+root to give it access to host devices (e.g. @code{/dev/net/tun}) but this poses a
+huge security risk.  File descriptor passing can be used to give an otherwise
+unprivileged QEMU process access to host devices without running QEMU as root.
+It is also possible to launch QEMU as a non-root user and configure UNIX groups
+for access to @code{/dev/kvm}, @code{/dev/net/tun}, and other device nodes.
+Some Linux distros already ship with UNIX groups for these devices by default.
+
+@itemize
+@item SELinux and AppArmor make it possible to confine processes beyond the
+traditional UNIX process and file permissions model.  They restrict the QEMU
+process from accessing processes and files on the host system that are not
+needed by QEMU.
+
+@item Resource limits and cgroup controllers provide throughput and utilization
+limits on key resources such as CPU time, memory, and I/O bandwidth.
+
+@item Linux namespaces can be used to make process, file system, and other system
+resources unavailable to QEMU.  A namespaced QEMU process is restricted to only
+those resources that were granted to it.
+
+@item Linux seccomp is available via the QEMU @option{--sandbox} option.  It disables
+system calls that are not needed by QEMU, thereby reducing the host kernel
+attack surface.
+@end itemize
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@
 * QEMU Guest Agent::
 * QEMU User space emulator::
 * System requirements::
+* Security::
 * Implementation notes::
 * Deprecated features::
 * Supported build platforms::
@@ -XXX,XX +XXX,XX @@ added with Linux 4.5 which is supported by the major distros. And even
 if RHEL7 has kernel 3.10, KVM there has the required functionality there
 to make it close to a 4.5 or newer kernel.
 
+@include docs/security.texi
+
 @include qemu-tech.texi
 
 @include qemu-deprecated.texi
-- 
2.21.0

The following changes since commit 15ef89d2a1a7b93845a6b09c2ee8e1979f6eb30b:

Update version for v7.0.0-rc1 release (2022-03-22 22:58:44 +0000)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 2539eade4f689eda7e9fe45486f18334bfbafaf0:

hw: Fix misleading hexadecimal format (2022-03-24 10:38:42 +0000)

----------------------------------------------------------------
Pull request

Philippe found cases where the 0x%d format string was used, leading to
misleading output. The patches look harmless and could save people time, so I
think it's worth including them in 7.0.

----------------------------------------------------------------

Philippe Mathieu-Daudé (2):
  block: Fix misleading hexadecimal format
  hw: Fix misleading hexadecimal format

-- 
2.35.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

"0x%u" format is very misleading, replace by "0x%x".

Found running:

$ git grep -E '0x%[0-9]*([lL]*|" ?PRI)[dDuU]' block/

Inspired-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Hanna Reitz <hreitz@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Denis V. Lunev <den@openvz.org>
Message-id: 20220323114718.58714-2-philippe.mathieu.daude@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/parallels-ext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/parallels-ext.c b/block/parallels-ext.c
index XXXXXXX..XXXXXXX 100644
--- a/block/parallels-ext.c
+++ b/block/parallels-ext.c
@@ -XXX,XX +XXX,XX @@ static int parallels_parse_format_extension(BlockDriverState *bs,
             break;
 
         default:
-            error_setg(errp, "Unknown feature: 0x%" PRIu64, fh.magic);
+            error_setg(errp, "Unknown feature: 0x%" PRIx64, fh.magic);
             goto fail;
         }
 
-- 
2.35.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

"0x%u" format is very misleading, replace by "0x%x".

Found running:

$ git grep -E '0x%[0-9]*([lL]*|" ?PRI)[dDuU]' hw/

Inspired-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20220323114718.58714-3-philippe.mathieu.daude@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/i386/sgx.c        | 2 +-
 hw/i386/trace-events | 6 +++---
 hw/misc/trace-events | 4 ++--
 hw/scsi/trace-events | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/i386/sgx.c b/hw/i386/sgx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/sgx.c
+++ b/hw/i386/sgx.c
@@ -XXX,XX +XXX,XX @@ void pc_machine_init_sgx_epc(PCMachineState *pcms)
     }
 
     if ((sgx_epc->base + sgx_epc->size) < sgx_epc->base) {
-        error_report("Size of all 'sgx-epc' =0x%"PRIu64" causes EPC to wrap",
+        error_report("Size of all 'sgx-epc' =0x%"PRIx64" causes EPC to wrap",
                      sgx_epc->size);
         exit(EXIT_FAILURE);
     }
diff --git a/hw/i386/trace-events b/hw/i386/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/trace-events
+++ b/hw/i386/trace-events
@@ -XXX,XX +XXX,XX @@ vtd_fault_disabled(void) "Fault processing disabled for context entry"
 vtd_replay_ce_valid(const char *mode, uint8_t bus, uint8_t dev, uint8_t fn, uint16_t domain, uint64_t hi, uint64_t lo) "%s: replay valid context device %02"PRIx8":%02"PRIx8".%02"PRIx8" domain 0x%"PRIx16" hi 0x%"PRIx64" lo 0x%"PRIx64
 vtd_replay_ce_invalid(uint8_t bus, uint8_t dev, uint8_t fn) "replay invalid context device %02"PRIx8":%02"PRIx8".%02"PRIx8
 vtd_page_walk_level(uint64_t addr, uint32_t level, uint64_t start, uint64_t end) "walk (base=0x%"PRIx64", level=%"PRIu32") iova range 0x%"PRIx64" - 0x%"PRIx64
-vtd_page_walk_one(uint16_t domain, uint64_t iova, uint64_t gpa, uint64_t mask, int perm) "domain 0x%"PRIu16" iova 0x%"PRIx64" -> gpa 0x%"PRIx64" mask 0x%"PRIx64" perm %d"
+vtd_page_walk_one(uint16_t domain, uint64_t iova, uint64_t gpa, uint64_t mask, int perm) "domain 0x%"PRIx16" iova 0x%"PRIx64" -> gpa 0x%"PRIx64" mask 0x%"PRIx64" perm %d"
 vtd_page_walk_one_skip_map(uint64_t iova, uint64_t mask, uint64_t translated) "iova 0x%"PRIx64" mask 0x%"PRIx64" translated 0x%"PRIx64
 vtd_page_walk_one_skip_unmap(uint64_t iova, uint64_t mask) "iova 0x%"PRIx64" mask 0x%"PRIx64
 vtd_page_walk_skip_read(uint64_t iova, uint64_t next) "Page walk skip iova 0x%"PRIx64" - 0x%"PRIx64" due to unable to read"
 vtd_page_walk_skip_reserve(uint64_t iova, uint64_t next) "Page walk skip iova 0x%"PRIx64" - 0x%"PRIx64" due to rsrv set"
 vtd_switch_address_space(uint8_t bus, uint8_t slot, uint8_t fn, bool on) "Device %02x:%02x.%x switching address space (iommu enabled=%d)"
 vtd_as_unmap_whole(uint8_t bus, uint8_t slot, uint8_t fn, uint64_t iova, uint64_t size) "Device %02x:%02x.%x start 0x%"PRIx64" size 0x%"PRIx64
-vtd_translate_pt(uint16_t sid, uint64_t addr) "source id 0x%"PRIu16", iova 0x%"PRIx64
-vtd_pt_enable_fast_path(uint16_t sid, bool success) "sid 0x%"PRIu16" %d"
+vtd_translate_pt(uint16_t sid, uint64_t addr) "source id 0x%"PRIx16", iova 0x%"PRIx64
+vtd_pt_enable_fast_path(uint16_t sid, bool success) "sid 0x%"PRIx16" %d"
 vtd_irq_generate(uint64_t addr, uint64_t data) "addr 0x%"PRIx64" data 0x%"PRIx64
 vtd_reg_read(uint64_t addr, uint64_t size) "addr 0x%"PRIx64" size 0x%"PRIx64
 vtd_reg_write(uint64_t addr, uint64_t size, uint64_t val) "addr 0x%"PRIx64" size 0x%"PRIx64" value 0x%"PRIx64
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.rst for syntax documentation.
 
 # allwinner-cpucfg.c
-allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIu32
+allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIx32
 allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 
@@ -XXX,XX +XXX,XX @@ imx7_gpr_write(uint64_t offset, uint64_t value) "addr 0x%08" PRIx64 "value 0x%08
 
 # mos6522.c
 mos6522_set_counter(int index, unsigned int val) "T%d.counter=%d"
-mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d counter=0x%"PRId64 " delta_next=0x%"PRId64
+mos6522_get_next_irq_time(uint16_t latch, int64_t d, int64_t delta) "latch=%d counter=0x%"PRIx64 " delta_next=0x%"PRIx64
 mos6522_set_sr_int(void) "set sr_int"
 mos6522_write(uint64_t addr, const char *name, uint64_t val) "reg=0x%"PRIx64 " [%s] val=0x%"PRIx64
 mos6522_read(uint64_t addr, const char *name, unsigned val) "reg=0x%"PRIx64 " [%s] val=0x%x"
diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/trace-events
+++ b/hw/scsi/trace-events
@@ -XXX,XX +XXX,XX @@ lsi_bad_phase_interrupt(void) "Phase mismatch interrupt"
 lsi_bad_selection(uint32_t id) "Selected absent target %"PRIu32
 lsi_do_dma_unavailable(void) "DMA no data available"
 lsi_do_dma(uint64_t addr, int len) "DMA addr=0x%"PRIx64" len=%d"
-lsi_queue_command(uint32_t tag) "Queueing tag=0x%"PRId32
+lsi_queue_command(uint32_t tag) "Queueing tag=0x%"PRIx32
 lsi_add_msg_byte_error(void) "MSG IN data too long"
 lsi_add_msg_byte(uint8_t data) "MSG IN 0x%02x"
 lsi_reselect(int id) "Reselected target %d"
@@ -XXX,XX +XXX,XX @@ lsi_do_msgout_noop(void) "MSG: No Operation"
 lsi_do_msgout_extended(uint8_t msg, uint8_t len) "Extended message 0x%x (len %d)"
 lsi_do_msgout_ignored(const char *msg) "%s (ignored)"
 lsi_do_msgout_simplequeue(uint8_t select_tag) "SIMPLE queue tag=0x%x"
-lsi_do_msgout_abort(uint32_t tag) "MSG: ABORT TAG tag=0x%"PRId32
+lsi_do_msgout_abort(uint32_t tag) "MSG: ABORT TAG tag=0x%"PRIx32
 lsi_do_msgout_clearqueue(uint32_t tag) "MSG: CLEAR QUEUE tag=0x%"PRIx32
 lsi_do_msgout_busdevicereset(uint32_t tag) "MSG: BUS DEVICE RESET tag=0x%"PRIx32
 lsi_do_msgout_select(int id) "Select LUN %d"
-- 
2.35.1