[PATCH 0/2] ati-vga Coverity fixes

[PATCH 0/2] ati-vga Coverity fixes

[BALATON Zoltan]

Small patches to address Coverity warnings.

BALATON Zoltan (2):
  ati-vga: Silence warning about operator precedence
  ati-vga: Add upper limit to x-linear-aper-size property

 hw/display/ati.c    | 4 ++++
 hw/display/ati_2d.c | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

-- 
2.41.3

[PATCH 1/2] ati-vga: Silence warning about operator precedence

[BALATON Zoltan]

Coverity in CID 1645969 warns about possible operator precendence
issue which is a false positive in this case but simplify the
expression to silence the warning.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/display/ati_2d.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
index 23527b2c50..9baf6ff37b 100644
--- a/hw/display/ati_2d.c
+++ b/hw/display/ati_2d.c
@@ -91,7 +91,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DCtx *ctx)
     ctx->host_data_active = s->host_data.active;
     ctx->left_to_right = s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT;
     ctx->top_to_bottom = s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM;
-    ctx->need_swap = HOST_BIG_ENDIAN != s->vga.big_endian_fb ? true : false;
+    ctx->need_swap = (HOST_BIG_ENDIAN != s->vga.big_endian_fb);
     ctx->frgd_clr = s->regs.dp_brush_frgd_clr;
     ctx->palette = s->vga.palette;
     ctx->dst_offset = s->regs.dst_offset;
-- 
2.41.3

[PATCH 2/2] ati-vga: Add upper limit to x-linear-aper-size property

[BALATON Zoltan]

Coverity warns in CID 1645968 about possible integer overflow. This
should never happen but to ensure that, add an upper limit on the
x-linear-aper-size. This may not silence the warning but makes sure
users cannot cause an overflow.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/display/ati.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/display/ati.c b/hw/display/ati.c
index fc19737d1f..97d871b1e2 100644
--- a/hw/display/ati.c
+++ b/hw/display/ati.c
@@ -1130,6 +1130,10 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
             s->linear_aper_sz = ATI_R100_LINEAR_APER_SIZE;
         }
     }
+    if (s->linear_aper_sz > 256 * MiB) {
+        error_setg(errp, "x-linear-aper-size is too large (maximum 256 MiB)");
+        return;
+    }
     if (s->linear_aper_sz < 16 * MiB) {
         error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)");
         return;
-- 
2.41.3

Re: [PATCH 1/2] ati-vga: Silence warning about operator precedence

[Peter Maydell]

On Mon, 30 Mar 2026 at 22:09, BALATON Zoltan <balaton@eik.bme.hu> wrote:
>
> Coverity in CID 1645969 warns about possible operator precendence
> issue which is a false positive in this case but simplify the
> expression to silence the warning.
>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>  hw/display/ati_2d.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
> index 23527b2c50..9baf6ff37b 100644
> --- a/hw/display/ati_2d.c
> +++ b/hw/display/ati_2d.c
> @@ -91,7 +91,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DCtx *ctx)
>      ctx->host_data_active = s->host_data.active;
>      ctx->left_to_right = s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT;
>      ctx->top_to_bottom = s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM;
> -    ctx->need_swap = HOST_BIG_ENDIAN != s->vga.big_endian_fb ? true : false;
> +    ctx->need_swap = (HOST_BIG_ENDIAN != s->vga.big_endian_fb);
>      ctx->frgd_clr = s->regs.dp_brush_frgd_clr;
>      ctx->palette = s->vga.palette;
>      ctx->dst_offset = s->regs.dst_offset;
> --

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [PATCH 2/2] ati-vga: Add upper limit to x-linear-aper-size property

[Peter Maydell]

On Mon, 30 Mar 2026 at 22:09, BALATON Zoltan <balaton@eik.bme.hu> wrote:
>
> Coverity warns in CID 1645968 about possible integer overflow. This
> should never happen but to ensure that, add an upper limit on the
> x-linear-aper-size. This may not silence the warning but makes sure
> users cannot cause an overflow.
>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>  hw/display/ati.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/hw/display/ati.c b/hw/display/ati.c
> index fc19737d1f..97d871b1e2 100644
> --- a/hw/display/ati.c
> +++ b/hw/display/ati.c
> @@ -1130,6 +1130,10 @@ static void ati_vga_realize(PCIDevice *dev, Error **errp)
>              s->linear_aper_sz = ATI_R100_LINEAR_APER_SIZE;
>          }
>      }
> +    if (s->linear_aper_sz > 256 * MiB) {
> +        error_setg(errp, "x-linear-aper-size is too large (maximum 256 MiB)");
> +        return;
> +    }
>      if (s->linear_aper_sz < 16 * MiB) {
>          error_setg(errp, "x-linear-aper-size is too small (minimum 16 MiB)");
>          return;
> --
> 2.41.3
>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [PATCH 2/2] ati-vga: Add upper limit to x-linear-aper-size property

[Philippe Mathieu-Daudé]

On 30/3/26 23:09, BALATON Zoltan wrote:
> Coverity warns in CID 1645968 about possible integer overflow. This
> should never happen but to ensure that, add an upper limit on the
> x-linear-aper-size. This may not silence the warning but makes sure
> users cannot cause an overflow.
> 
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>   hw/display/ati.c | 4 ++++
>   1 file changed, 4 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Re: [PATCH 1/2] ati-vga: Silence warning about operator precedence

[Philippe Mathieu-Daudé]

On 30/3/26 23:09, BALATON Zoltan wrote:
> Coverity in CID 1645969 warns about possible operator precendence
> issue which is a false positive in this case but simplify the
> expression to silence the warning.
> 
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
> ---
>   hw/display/ati_2d.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
> index 23527b2c50..9baf6ff37b 100644
> --- a/hw/display/ati_2d.c
> +++ b/hw/display/ati_2d.c
> @@ -91,7 +91,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, ATI2DCtx *ctx)
>       ctx->host_data_active = s->host_data.active;
>       ctx->left_to_right = s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT;
>       ctx->top_to_bottom = s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM;
> -    ctx->need_swap = HOST_BIG_ENDIAN != s->vga.big_endian_fb ? true : false;
> +    ctx->need_swap = (HOST_BIG_ENDIAN != s->vga.big_endian_fb);

Do we really need the parenthesis?

>       ctx->frgd_clr = s->regs.dp_brush_frgd_clr;
>       ctx->palette = s->vga.palette;
>       ctx->dst_offset = s->regs.dst_offset;

Re: [PATCH 0/2] ati-vga Coverity fixes

[Philippe Mathieu-Daudé]

On 30/3/26 23:09, BALATON Zoltan wrote:
> Small patches to address Coverity warnings.
> 
> BALATON Zoltan (2):
>    ati-vga: Silence warning about operator precedence
>    ati-vga: Add upper limit to x-linear-aper-size property

Queued via hw-misc tree, thanks.

Re: [PATCH 1/2] ati-vga: Silence warning about operator precedence

[BALATON Zoltan]

[-- Attachment #1: Type: text/plain, Size: 1389 bytes --]

On Tue, 31 Mar 2026, Philippe Mathieu-Daudé wrote:
> On 30/3/26 23:09, BALATON Zoltan wrote:
>> Coverity in CID 1645969 warns about possible operator precendence
>> issue which is a false positive in this case but simplify the
>> expression to silence the warning.
>> 
>> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
>> ---
>>   hw/display/ati_2d.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>> 
>> diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
>> index 23527b2c50..9baf6ff37b 100644
>> --- a/hw/display/ati_2d.c
>> +++ b/hw/display/ati_2d.c
>> @@ -91,7 +91,7 @@ static void setup_2d_blt_ctx(const ATIVGAState *s, 
>> ATI2DCtx *ctx)
>>       ctx->host_data_active = s->host_data.active;
>>       ctx->left_to_right = s->regs.dp_cntl & DST_X_LEFT_TO_RIGHT;
>>       ctx->top_to_bottom = s->regs.dp_cntl & DST_Y_TOP_TO_BOTTOM;
>> -    ctx->need_swap = HOST_BIG_ENDIAN != s->vga.big_endian_fb ? true : 
>> false;
>> +    ctx->need_swap = (HOST_BIG_ENDIAN != s->vga.big_endian_fb);
>
> Do we really need the parenthesis?

Should not be needed but it may be more readable and Coverity warned about 
the original that did not need parenthesis either so it seems the safest 
to write it this way.

Regards,
BALATON Zoltan

>>       ctx->frgd_clr = s->regs.dp_brush_frgd_clr;
>>       ctx->palette = s->vga.palette;
>>       ctx->dst_offset = s->regs.dst_offset;
>
>

Re: [PATCH 0/2] ati-vga Coverity fixes

[BALATON Zoltan]

[-- Attachment #1: Type: text/plain, Size: 431 bytes --]

On Tue, 31 Mar 2026, Philippe Mathieu-Daudé wrote:
> On 30/3/26 23:09, BALATON Zoltan wrote:
>> Small patches to address Coverity warnings.
>> 
>> BALATON Zoltan (2):
>>    ati-vga: Silence warning about operator precedence
>>    ati-vga: Add upper limit to x-linear-aper-size property
>
> Queued via hw-misc tree, thanks.

Thanks. Could somebody review the cirrus-vga patch too so it could be 
picked up?

Regards,
BALATON Zoltan

Re: [PATCH 0/2] ati-vga Coverity fixes

[Philippe Mathieu-Daudé]

On 31/3/26 15:45, BALATON Zoltan wrote:
> On Tue, 31 Mar 2026, Philippe Mathieu-Daudé wrote:
>> On 30/3/26 23:09, BALATON Zoltan wrote:
>>> Small patches to address Coverity warnings.
>>>
>>> BALATON Zoltan (2):
>>>    ati-vga: Silence warning about operator precedence
>>>    ati-vga: Add upper limit to x-linear-aper-size property
>>
>> Queued via hw-misc tree, thanks.
> 
> Thanks. Could somebody review the cirrus-vga patch too so it could be 
> picked up?

I skipped them because Gerd left a comment.