[Qemu-devel] [PULL 0/2] spice patch queue

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Here comes the spice patch queue, carrying two coverity fixes in qxl.

please pull,
  Gerd

The following changes since commit 63fb2590839162afdf14d7c0ee02d460766c0956:

  Merge branch 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm (2013-01-12 12:47:07 +0000)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu spice.v67

for you to fetch changes up to 08688af04dc1137ac2f420b35c235183926b4a23:

  qxl: Don't drop client capability bits (2013-01-14 08:59:38 +0100)

----------------------------------------------------------------
Markus Armbruster (2):
      qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check
      qxl: Don't drop client capability bits

 hw/qxl.c |   26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

[Qemu-devel] [PATCH 1/2] qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check

[Gerd Hoffmann]

From: Markus Armbruster <armbru@pond.sub.org>

The pointer arithmetic there is safe, but ugly.  Coverity grouses
about it.  However, the actual comparison is off by one: <= end
instead of < end.  Fix by rewriting the check in a cleaner way.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/qxl.c |   20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/hw/qxl.c b/hw/qxl.c
index 00e517a..e8f380b 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -37,33 +37,25 @@
  */
 #undef SPICE_RING_PROD_ITEM
 #define SPICE_RING_PROD_ITEM(qxl, r, ret) {                             \
-        typeof(r) start = r;                                            \
-        typeof(r) end = r + 1;                                          \
         uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r);           \
-        typeof(&(r)->items[prod]) m_item = &(r)->items[prod];           \
-        if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
+        if (prod >= ARRAY_SIZE((r)->items)) {                           \
             qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
-                          "! %p <= %p < %p", (uint8_t *)start,          \
-                          (uint8_t *)m_item, (uint8_t *)end);           \
+                          "%u >= %zu", prod, ARRAY_SIZE((r)->items));   \
             ret = NULL;                                                 \
         } else {                                                        \
-            ret = &m_item->el;                                          \
+            ret = &(r)->items[prod].el;                                 \
         }                                                               \
     }
 
 #undef SPICE_RING_CONS_ITEM
 #define SPICE_RING_CONS_ITEM(qxl, r, ret) {                             \
-        typeof(r) start = r;                                            \
-        typeof(r) end = r + 1;                                          \
         uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r);           \
-        typeof(&(r)->items[cons]) m_item = &(r)->items[cons];           \
-        if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
+        if (cons >= ARRAY_SIZE((r)->items)) {                           \
             qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
-                          "! %p <= %p < %p", (uint8_t *)start,          \
-                          (uint8_t *)m_item, (uint8_t *)end);           \
+                          "%u >= %zu", cons, ARRAY_SIZE((r)->items));   \
             ret = NULL;                                                 \
         } else {                                                        \
-            ret = &m_item->el;                                          \
+            ret = &(r)->items[cons].el;                                 \
         }                                                               \
     }
 
-- 
1.7.9.7

[Qemu-devel] [PATCH 2/2] qxl: Don't drop client capability bits

[Gerd Hoffmann]

From: Markus Armbruster <armbru@redhat.com>

interface_set_client_capabilities() copies only the first few bits,
because it falls into a Classic C trap: you can declare a parameter
uint8_t caps[58], but the resulting parameter type is uint8_t *, not
uint8_t[58].  In particular, sizeof(caps) is sizeof(uint8_t *), not
the intended sizeof(uint8_t[58]).

Harmless, because the bits aren't used, yet.  Broken in commit
c10018d6.  Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/qxl.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/qxl.c b/hw/qxl.c
index e8f380b..9dc44b9 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -951,9 +951,11 @@ static void interface_set_client_capabilities(QXLInstance *sin,
     }
 
     qxl->shadow_rom.client_present = client_present;
-    memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps));
+    memcpy(qxl->shadow_rom.client_capabilities, caps,
+           sizeof(qxl->shadow_rom.client_capabilities));
     qxl->rom->client_present = client_present;
-    memcpy(qxl->rom->client_capabilities, caps, sizeof(caps));
+    memcpy(qxl->rom->client_capabilities, caps,
+           sizeof(qxl->rom->client_capabilities));
     qxl_rom_set_dirty(qxl);
 
     qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);
-- 
1.7.9.7

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Anthony Liguori]

Pulled, thanks.

Regards,

Anthony Liguori

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Tiny spice patch queue with only two patches, one adding a spice cmd
line option and one bugfix.

please pull,
  Gerd

The following changes since commit 576156ffed72ab4feb0b752979db86ff8759a2a1:

  Merge remote-tracking branch 'bonzini/iommu-for-anthony' into staging (2013-06-20 16:53:39 -0500)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu spice.v71

for you to fetch changes up to 5ad24e5f3b5968240d50fb2e5b6e19517b041052:

  spice: Add -spice disable-agent-file-transfer cmdline option (rhbz#961850) (2013-06-24 08:23:09 +0200)

----------------------------------------------------------------
Gerd Hoffmann (1):
      qxl: fix Coverity scan SIGN_EXTENSION error

Hans de Goede (1):
      spice: Add -spice disable-agent-file-transfer cmdline option (rhbz#961850)

 hw/display/qxl-render.c |    2 +-
 qemu-options.hx         |    7 +++++--
 ui/spice-core.c         |   13 +++++++++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Here comes the spice patch queue with two little bugfixes.

please pull,
  Gerd

The following changes since commit ff788b6fe67f694666781f821c1af812e8c7999b:

  Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-07' into staging (2014-05-07 18:38:39 +0100)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-7

for you to fetch changes up to a76a2f729aae21c45c7e9eef8d1d80e94d1cc930:

  spice: fix libvirt snapshots (2014-05-08 10:45:54 +0200)

----------------------------------------------------------------
spice: small fixes

----------------------------------------------------------------
Gerd Hoffmann (2):
      spice: fix "info spice"
      spice: fix libvirt snapshots

 ui/spice-core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Peter Maydell]

On 8 May 2014 09:51, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here comes the spice patch queue with two little bugfixes.
>
> please pull,
>   Gerd
>
> The following changes since commit ff788b6fe67f694666781f821c1af812e8c7999b:
>
>   Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-2014-05-07' into staging (2014-05-07 18:38:39 +0100)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-7
>
> for you to fetch changes up to a76a2f729aae21c45c7e9eef8d1d80e94d1cc930:
>
>   spice: fix libvirt snapshots (2014-05-08 10:45:54 +0200)

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Spice patch queue, featuring mouse pointer support for non-qxl cards
and a bugfix for the qxl renderer.

please pull,
  Gerd

The following changes since commit 2a2c4830c0068d70443f3dddc4cc668f0c601b5c:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20140611-1' into staging (2014-06-12 09:51:41 +0100)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140613-1

for you to fetch changes up to 788fbf042fc6d5aaeab56757e6dad622ac5f0c21:

  qxl-render: add sanity check (2014-06-13 12:34:57 +0200)

----------------------------------------------------------------
spice: add mouse cursor support
qxl-render: add sanity check

----------------------------------------------------------------
Gerd Hoffmann (2):
      spice: add mouse cursor support
      qxl-render: add sanity check

 hw/display/qxl-render.c    |   6 +++
 hw/display/qxl.c           |   6 ++-
 include/ui/spice-display.h |  14 +++++
 ui/spice-display.c         | 129 +++++++++++++++++++++++++++++++++++++++++----
 4 files changed, 143 insertions(+), 12 deletions(-)

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Peter Maydell]

On 13 June 2014 12:27, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Spice patch queue, featuring mouse pointer support for non-qxl cards
> and a bugfix for the qxl renderer.
>
> please pull,
>   Gerd
>
> The following changes since commit 2a2c4830c0068d70443f3dddc4cc668f0c601b5c:
>
>   Merge remote-tracking branch 'remotes/kraxel/tags/pull-gtk-20140611-1' into staging (2014-06-12 09:51:41 +0100)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140613-1
>
> for you to fetch changes up to 788fbf042fc6d5aaeab56757e6dad622ac5f0c21:
>
>   qxl-render: add sanity check (2014-06-13 12:34:57 +0200)
>
> ----------------------------------------------------------------
> spice: add mouse cursor support
> qxl-render: add sanity check
>

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Here comes the spice patch queue, pretty small this time, carrying an
additional qxl sanity check and a minor spice display channel tweak.

please pull,
  Gerd

The following changes since commit 8b3030114a449e66c68450acaac4b66f26d91416:

  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140829' into staging (2014-08-29 15:48:15 +0100)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140902-1

for you to fetch changes up to cd56cc6b079f44fbcca3d8a773ae87f7479c6585:

  spice: use console index as display id (2014-09-01 10:19:03 +0200)

----------------------------------------------------------------
sanity check for qxl, minor spice display channel tweak.

----------------------------------------------------------------
Gerd Hoffmann (2):
      qxl-render: add more sanity checks
      spice: use console index as display id

 hw/display/qxl-render.c | 4 +++-
 ui/spice-core.c         | 3 +--
 2 files changed, 4 insertions(+), 3 deletions(-)

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Peter Maydell]

On 2 September 2014 09:59, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here comes the spice patch queue, pretty small this time, carrying an
> additional qxl sanity check and a minor spice display channel tweak.
>
> please pull,
>   Gerd
>
> The following changes since commit 8b3030114a449e66c68450acaac4b66f26d91416:
>
>   Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20140829' into staging (2014-08-29 15:48:15 +0100)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140902-1
>
> for you to fetch changes up to cd56cc6b079f44fbcca3d8a773ae87f7479c6585:
>
>   spice: use console index as display id (2014-09-01 10:19:03 +0200)
>
> ----------------------------------------------------------------
> sanity check for qxl, minor spice display channel tweak.
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Short spice patch queue, adding a new graphic_console_set_hwops function
to the console core, which in turn allows to simplify switching between
vga and native mode in qxl.

please pull,
  Gerd

The following changes since commit 81ab11a7a524d12412a59ef49c6b270671e62ea0:

  Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2014-09-26 15:41:50 +0100)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140929-1

for you to fetch changes up to 151623353f4a3da4daec29d658c10ef3b57bd462:

  qxl: use graphic_console_set_hwops (2014-09-29 10:20:09 +0200)

----------------------------------------------------------------
add and use graphic_console_set_hwops

----------------------------------------------------------------
Gerd Hoffmann (2):
      console: add graphic_console_set_hwops
      qxl: use graphic_console_set_hwops

 hw/display/qxl.c     | 49 +++++++++----------------------------------------
 include/ui/console.h |  3 +++
 ui/console.c         | 11 +++++++++--
 3 files changed, 21 insertions(+), 42 deletions(-)

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Peter Maydell]

On 29 September 2014 11:20, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Short spice patch queue, adding a new graphic_console_set_hwops function
> to the console core, which in turn allows to simplify switching between
> vga and native mode in qxl.
>
> please pull,
>   Gerd
>
> The following changes since commit 81ab11a7a524d12412a59ef49c6b270671e62ea0:
>
>   Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2014-09-26 15:41:50 +0100)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20140929-1
>
> for you to fetch changes up to 151623353f4a3da4daec29d658c10ef3b57bd462:
>
>   qxl: use graphic_console_set_hwops (2014-09-29 10:20:09 +0200)
>
> ----------------------------------------------------------------
> add and use graphic_console_set_hwops
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 0/2] spice patch queue

[Gerd Hoffmann]

  Hi,

Here comes the small spice patch queue with only two patches,
one of them fixing a segfault though.

please pull,
  Gerd

The following changes since commit 0e12e61ff9a3407d123d0dbc4d945aec98d60fdf:

  Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150610-1' into staging (2015-06-10 18:13:58 +0100)

are available in the git repository at:


  git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20150611-1

for you to fetch changes up to 5a9259a0b5d6f9424f94539cd9c715b1d166d90c:

  spice: ui_info tweaks (2015-06-11 09:06:14 +0200)

----------------------------------------------------------------
spice: fix segfault in qemu_spice_create_update, ui_info tweaks.

----------------------------------------------------------------
Gerd Hoffmann (2):
      spice-display: fix segfault in qemu_spice_create_update
      spice: ui_info tweaks

 ui/spice-display.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

Re: [Qemu-devel] [PULL 0/2] spice patch queue

[Peter Maydell]

On 11 June 2015 at 08:52, Gerd Hoffmann <kraxel@redhat.com> wrote:
>   Hi,
>
> Here comes the small spice patch queue with only two patches,
> one of them fixing a segfault though.
>
> please pull,
>   Gerd
>
> The following changes since commit 0e12e61ff9a3407d123d0dbc4d945aec98d60fdf:
>
>   Merge remote-tracking branch 'remotes/kraxel/tags/pull-vga-20150610-1' into staging (2015-06-10 18:13:58 +0100)
>
> are available in the git repository at:
>
>
>   git://anongit.freedesktop.org/spice/qemu tags/pull-spice-20150611-1
>
> for you to fetch changes up to 5a9259a0b5d6f9424f94539cd9c715b1d166d90c:
>
>   spice: ui_info tweaks (2015-06-11 09:06:14 +0200)
>
> ----------------------------------------------------------------
> spice: fix segfault in qemu_spice_create_update, ui_info tweaks.
>

Applied, thanks.

-- PMM