[Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Laszlo Ersek]

Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
array from static to automatic. This broke the interface contract on the
fw_cfg_add_file() function, which is documented as follows, in
"include/hw/nvram/fw_cfg.h":

> [...] The data referenced by the starting pointer is only linked, NOT
> copied, into the data structure of the fw_cfg device. [...]

As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
file, it now sees garbage. Fix the regression by changing the storage
duration to allocated. (The call is reached at most once, on the realize
path of the board-specific fw_cfg sysbus device.)

While at it, clean up the name and the assignment of the object as well.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---
 hw/nvram/fw_cfg.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 53e8e010a8b7..7fdf04adc97f 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
 {
     const char *boot_splash_filename = NULL;
     const char *boot_splash_time = NULL;
-    uint8_t qemu_extra_params_fw[2];
     char *filename, *file_data;
     gsize file_size;
     int file_type;
@@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
     /* insert splash time if user configurated */
     if (boot_splash_time) {
         int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
+        uint16_t bst_le16;
+
         /* validate the input */
         if (bst_val < 0 || bst_val > 0xffff) {
             error_report("splash-time is invalid,"
@@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
             exit(1);
         }
         /* use little endian format */
-        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
-        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
-        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
+        bst_le16 = cpu_to_le16(bst_val);
+        fw_cfg_add_file(s, "etc/boot-menu-wait",
+                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
     }
 
     /* insert splash file if user configurated */
-- 
2.19.1.3.g30247aa5d201

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Gerd Hoffmann]

On Fri, Jan 18, 2019 at 11:31:52PM +0100, Laszlo Ersek wrote:
> Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> array from static to automatic. This broke the interface contract on the
> fw_cfg_add_file() function, which is documented as follows, in
> "include/hw/nvram/fw_cfg.h":
> 
> > [...] The data referenced by the starting pointer is only linked, NOT
> > copied, into the data structure of the fw_cfg device. [...]
> 
> As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> file, it now sees garbage. Fix the regression by changing the storage
> duration to allocated. (The call is reached at most once, on the realize
> path of the board-specific fw_cfg sysbus device.)
> 
> While at it, clean up the name and the assignment of the object as well.

Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>

> 
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Markus Armbruster <armbru@redhat.com>
> Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  hw/nvram/fw_cfg.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> index 53e8e010a8b7..7fdf04adc97f 100644
> --- a/hw/nvram/fw_cfg.c
> +++ b/hw/nvram/fw_cfg.c
> @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>  {
>      const char *boot_splash_filename = NULL;
>      const char *boot_splash_time = NULL;
> -    uint8_t qemu_extra_params_fw[2];
>      char *filename, *file_data;
>      gsize file_size;
>      int file_type;
> @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>      /* insert splash time if user configurated */
>      if (boot_splash_time) {
>          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
> +        uint16_t bst_le16;
> +
>          /* validate the input */
>          if (bst_val < 0 || bst_val > 0xffff) {
>              error_report("splash-time is invalid,"
> @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>              exit(1);
>          }
>          /* use little endian format */
> -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
> -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
> -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
> +        bst_le16 = cpu_to_le16(bst_val);
> +        fw_cfg_add_file(s, "etc/boot-menu-wait",
> +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
>      }
>  
>      /* insert splash file if user configurated */
> -- 
> 2.19.1.3.g30247aa5d201
> 

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Li Qiang]

Gerd Hoffmann <kraxel@redhat.com> 于2019年1月21日周一 下午3:22写道：

> On Fri, Jan 18, 2019 at 11:31:52PM +0100, Laszlo Ersek wrote:
> > Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> > 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> > array from static to automatic. This broke the interface contract on the
> > fw_cfg_add_file() function, which is documented as follows, in
> > "include/hw/nvram/fw_cfg.h":
> >
> > > [...] The data referenced by the starting pointer is only linked, NOT
> > > copied, into the data structure of the fw_cfg device. [...]
> >
> > As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> > file, it now sees garbage. Fix the regression by changing the storage
> > duration to allocated. (The call is reached at most once, on the realize
> > path of the board-specific fw_cfg sysbus device.)
> >
> > While at it, clean up the name and the assignment of the object as well.
>
> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
>
> >
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Markus Armbruster <armbru@redhat.com>
> > Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> > Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> > Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>

Oh my fault.

Reviewed-by: Li Qiang <liq3ea@gmail.com>

So I think my patch:
-->http://lists.nongnu.org/archive/html/qemu-devel/2019-01/msg04896.html
is useful to write this file entry test cases

Thanks,
Li Qiang


> > ---
> >  hw/nvram/fw_cfg.c | 9 +++++----
> >  1 file changed, 5 insertions(+), 4 deletions(-)
> >
> > diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> > index 53e8e010a8b7..7fdf04adc97f 100644
> > --- a/hw/nvram/fw_cfg.c
> > +++ b/hw/nvram/fw_cfg.c
> > @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >  {
> >      const char *boot_splash_filename = NULL;
> >      const char *boot_splash_time = NULL;
> > -    uint8_t qemu_extra_params_fw[2];
> >      char *filename, *file_data;
> >      gsize file_size;
> >      int file_type;
> > @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >      /* insert splash time if user configurated */
> >      if (boot_splash_time) {
> >          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
> > +        uint16_t bst_le16;
> > +
> >          /* validate the input */
> >          if (bst_val < 0 || bst_val > 0xffff) {
> >              error_report("splash-time is invalid,"
> > @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >              exit(1);
> >          }
> >          /* use little endian format */
> > -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
> > -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
> > -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw,
> 2);
> > +        bst_le16 = cpu_to_le16(bst_val);
> > +        fw_cfg_add_file(s, "etc/boot-menu-wait",
> > +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof
> bst_le16);
> >      }
> >
> >      /* insert splash file if user configurated */
> > --
> > 2.19.1.3.g30247aa5d201
> >
>
>

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Stefano Garzarella]

On Fri, Jan 18, 2019 at 11:31:52PM +0100, Laszlo Ersek wrote:
> Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> array from static to automatic. This broke the interface contract on the
> fw_cfg_add_file() function, which is documented as follows, in
> "include/hw/nvram/fw_cfg.h":
> 
> > [...] The data referenced by the starting pointer is only linked, NOT
> > copied, into the data structure of the fw_cfg device. [...]
> 
> As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> file, it now sees garbage. Fix the regression by changing the storage
> duration to allocated. (The call is reached at most once, on the realize
> path of the board-specific fw_cfg sysbus device.)
> 
> While at it, clean up the name and the assignment of the object as well.
> 
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Markus Armbruster <armbru@redhat.com>
> Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  hw/nvram/fw_cfg.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Philippe Mathieu-Daudé]

On 1/18/19 11:31 PM, Laszlo Ersek wrote:
> Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> array from static to automatic. This broke the interface contract on the
> fw_cfg_add_file() function, which is documented as follows, in
> "include/hw/nvram/fw_cfg.h":
> 
>> [...] The data referenced by the starting pointer is only linked, NOT
>> copied, into the data structure of the fw_cfg device. [...]
> 
> As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> file, it now sees garbage. Fix the regression by changing the storage
> duration to allocated. (The call is reached at most once, on the realize
> path of the board-specific fw_cfg sysbus device.)

Hopefully you catched this in time. This also demonstrate my testing is
poor. This will be improved.

> 
> While at it, clean up the name and the assignment of the object as well.
> 
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Markus Armbruster <armbru@redhat.com>
> Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  hw/nvram/fw_cfg.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> index 53e8e010a8b7..7fdf04adc97f 100644
> --- a/hw/nvram/fw_cfg.c
> +++ b/hw/nvram/fw_cfg.c
> @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>  {
>      const char *boot_splash_filename = NULL;
>      const char *boot_splash_time = NULL;
> -    uint8_t qemu_extra_params_fw[2];
>      char *filename, *file_data;
>      gsize file_size;
>      int file_type;
> @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>      /* insert splash time if user configurated */
>      if (boot_splash_time) {
>          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
> +        uint16_t bst_le16;
> +
>          /* validate the input */
>          if (bst_val < 0 || bst_val > 0xffff) {
>              error_report("splash-time is invalid,"
> @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>              exit(1);
>          }
>          /* use little endian format */
> -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
> -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
> -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
> +        bst_le16 = cpu_to_le16(bst_val);

I had a similar patch staged using the ldst API, however using the
cpu_to API is more consistent with the rest of this file.

> +        fw_cfg_add_file(s, "etc/boot-menu-wait",
> +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);

Using the heap and not worrying about releasing it is also consistent
with the rest of this file, so:

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Sorry for having you going throught this bug, and thanks for fixing it!

Phil.

>      }
>  
>      /* insert splash file if user configurated */
> 

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Laszlo Ersek]

On 01/18/19 23:31, Laszlo Ersek wrote:
> Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> array from static to automatic. This broke the interface contract on the
> fw_cfg_add_file() function, which is documented as follows, in
> "include/hw/nvram/fw_cfg.h":
> 
>> [...] The data referenced by the starting pointer is only linked, NOT
>> copied, into the data structure of the fw_cfg device. [...]
> 
> As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> file, it now sees garbage. Fix the regression by changing the storage
> duration to allocated. (The call is reached at most once, on the realize
> path of the board-specific fw_cfg sysbus device.)
> 
> While at it, clean up the name and the assignment of the object as well.
> 
> Cc: Gerd Hoffmann <kraxel@redhat.com>
> Cc: Markus Armbruster <armbru@redhat.com>
> Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> ---
>  hw/nvram/fw_cfg.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> index 53e8e010a8b7..7fdf04adc97f 100644
> --- a/hw/nvram/fw_cfg.c
> +++ b/hw/nvram/fw_cfg.c
> @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>  {
>      const char *boot_splash_filename = NULL;
>      const char *boot_splash_time = NULL;
> -    uint8_t qemu_extra_params_fw[2];
>      char *filename, *file_data;
>      gsize file_size;
>      int file_type;
> @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>      /* insert splash time if user configurated */
>      if (boot_splash_time) {
>          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
> +        uint16_t bst_le16;
> +
>          /* validate the input */
>          if (bst_val < 0 || bst_val > 0xffff) {
>              error_report("splash-time is invalid,"
> @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>              exit(1);
>          }
>          /* use little endian format */
> -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
> -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
> -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
> +        bst_le16 = cpu_to_le16(bst_val);
> +        fw_cfg_add_file(s, "etc/boot-menu-wait",
> +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
>      }
>  
>      /* insert splash file if user configurated */
> 

I hope a polite ping can't hurt; can we get this merged please?

Thanks
LAszlo

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Michael S. Tsirkin]

On Thu, Jan 31, 2019 at 03:27:01PM +0100, Laszlo Ersek wrote:
> On 01/18/19 23:31, Laszlo Ersek wrote:
> > Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
> > 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
> > array from static to automatic. This broke the interface contract on the
> > fw_cfg_add_file() function, which is documented as follows, in
> > "include/hw/nvram/fw_cfg.h":
> > 
> >> [...] The data referenced by the starting pointer is only linked, NOT
> >> copied, into the data structure of the fw_cfg device. [...]
> > 
> > As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
> > file, it now sees garbage. Fix the regression by changing the storage
> > duration to allocated. (The call is reached at most once, on the realize
> > path of the board-specific fw_cfg sysbus device.)
> > 
> > While at it, clean up the name and the assignment of the object as well.
> > 
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Cc: Markus Armbruster <armbru@redhat.com>
> > Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
> > Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
> > Signed-off-by: Laszlo Ersek <lersek@redhat.com>
> > ---
> >  hw/nvram/fw_cfg.c | 9 +++++----
> >  1 file changed, 5 insertions(+), 4 deletions(-)
> > 
> > diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> > index 53e8e010a8b7..7fdf04adc97f 100644
> > --- a/hw/nvram/fw_cfg.c
> > +++ b/hw/nvram/fw_cfg.c
> > @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >  {
> >      const char *boot_splash_filename = NULL;
> >      const char *boot_splash_time = NULL;
> > -    uint8_t qemu_extra_params_fw[2];
> >      char *filename, *file_data;
> >      gsize file_size;
> >      int file_type;
> > @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >      /* insert splash time if user configurated */
> >      if (boot_splash_time) {
> >          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
> > +        uint16_t bst_le16;
> > +
> >          /* validate the input */
> >          if (bst_val < 0 || bst_val > 0xffff) {
> >              error_report("splash-time is invalid,"
> > @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
> >              exit(1);
> >          }
> >          /* use little endian format */
> > -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
> > -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
> > -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
> > +        bst_le16 = cpu_to_le16(bst_val);
> > +        fw_cfg_add_file(s, "etc/boot-menu-wait",
> > +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
> >      }
> >  
> >      /* insert splash file if user configurated */
> > 
> 
> I hope a polite ping can't hurt; can we get this merged please?
> 
> Thanks
> LAszlo

Sure it does not hurt. I have it tagged  for the next pull.

Re: [Qemu-devel] [PATCH] fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw"

[Laszlo Ersek]

On 01/31/19 16:06, Michael S. Tsirkin wrote:
> On Thu, Jan 31, 2019 at 03:27:01PM +0100, Laszlo Ersek wrote:
>> On 01/18/19 23:31, Laszlo Ersek wrote:
>>> Commit 19bcc4bc3213 ("fw_cfg: Make qemu_extra_params_fw locally",
>>> 2019-01-04) changed the storage duration of the "qemu_extra_params_fw"
>>> array from static to automatic. This broke the interface contract on the
>>> fw_cfg_add_file() function, which is documented as follows, in
>>> "include/hw/nvram/fw_cfg.h":
>>>
>>>> [...] The data referenced by the starting pointer is only linked, NOT
>>>> copied, into the data structure of the fw_cfg device. [...]
>>>
>>> As a result, when guest firmware fetches the "etc/boot-menu-wait" fw_cfg
>>> file, it now sees garbage. Fix the regression by changing the storage
>>> duration to allocated. (The call is reached at most once, on the realize
>>> path of the board-specific fw_cfg sysbus device.)
>>>
>>> While at it, clean up the name and the assignment of the object as well.
>>>
>>> Cc: Gerd Hoffmann <kraxel@redhat.com>
>>> Cc: Markus Armbruster <armbru@redhat.com>
>>> Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
>>> Fixes: 19bcc4bc3213e78c303ad480a7a578f62258252d
>>> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>>> ---
>>>  hw/nvram/fw_cfg.c | 9 +++++----
>>>  1 file changed, 5 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
>>> index 53e8e010a8b7..7fdf04adc97f 100644
>>> --- a/hw/nvram/fw_cfg.c
>>> +++ b/hw/nvram/fw_cfg.c
>>> @@ -118,7 +118,6 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>>>  {
>>>      const char *boot_splash_filename = NULL;
>>>      const char *boot_splash_time = NULL;
>>> -    uint8_t qemu_extra_params_fw[2];
>>>      char *filename, *file_data;
>>>      gsize file_size;
>>>      int file_type;
>>> @@ -132,6 +131,8 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>>>      /* insert splash time if user configurated */
>>>      if (boot_splash_time) {
>>>          int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
>>> +        uint16_t bst_le16;
>>> +
>>>          /* validate the input */
>>>          if (bst_val < 0 || bst_val > 0xffff) {
>>>              error_report("splash-time is invalid,"
>>> @@ -139,9 +140,9 @@ static void fw_cfg_bootsplash(FWCfgState *s)
>>>              exit(1);
>>>          }
>>>          /* use little endian format */
>>> -        qemu_extra_params_fw[0] = (uint8_t)(bst_val & 0xff);
>>> -        qemu_extra_params_fw[1] = (uint8_t)((bst_val >> 8) & 0xff);
>>> -        fw_cfg_add_file(s, "etc/boot-menu-wait", qemu_extra_params_fw, 2);
>>> +        bst_le16 = cpu_to_le16(bst_val);
>>> +        fw_cfg_add_file(s, "etc/boot-menu-wait",
>>> +                        g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
>>>      }
>>>  
>>>      /* insert splash file if user configurated */
>>>
>>
>> I hope a polite ping can't hurt; can we get this merged please?
>>
>> Thanks
>> LAszlo
> 
> Sure it does not hurt. I have it tagged  for the next pull.
> 

Thanks!
Laszlo