From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:57523)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XrRP5-0007Wf-C5
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 08:04:13 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XrROy-0005Zx-Pv
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 08:04:07 -0500
Received: from szxga02-in.huawei.com ([119.145.14.65]:28384)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <arei.gonglei@huawei.com>) id 1XrROx-0005YF-Um
	for qemu-devel@nongnu.org; Thu, 20 Nov 2014 08:04:00 -0500
Message-ID: <546DE6AD.8010007@huawei.com>
Date: Thu, 20 Nov 2014 21:03:41 +0800
From: Gonglei <arei.gonglei@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: [Qemu-devel] [RFC] Break cross migration from qemu-1.5 to qemu-2.1.
 because of input/hid rewriting
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Cc: "kraxel@redhat.com" <kraxel@redhat.com>

Hi, Gerd

I encounter a problem that breaking  migration from qemu-1.5 to qemu-2.1.
The error message as below:
 qemu-system-x86_64: hw/input/hid.c:121: hid_pointer_event: Assertion `hs->n < 16' failed.
Qemu assert in hid_pointer_event().

I get the value of hs->n which is 16 by  reproduction. And the code of qemu-1.5 :

static void hid_pointer_event(void *opaque,
                              int x1, int y1, int z1, int buttons_state)
{
    HIDState *hs = opaque;
    unsigned use_slot = (hs->head + hs->n - 1) & QUEUE_MASK;
    unsigned previous_slot = (use_slot - 1) & QUEUE_MASK;

    if (hs->n == QUEUE_LENGTH) {
        /* Queue full.  Discard old button state, combine motion normally.  */
        hs->ptr.queue[use_slot].buttons_state = buttons_state;
    }

Which indicate it is legal when hs->n == QUEUE_LENGTH.

But now:
static void hid_pointer_event(DeviceState *dev, QemuConsole *src,
                              InputEvent *evt)
{
    static const int bmap[INPUT_BUTTON_MAX] = {
        [INPUT_BUTTON_LEFT]   = 0x01,
        [INPUT_BUTTON_RIGHT]  = 0x02,
        [INPUT_BUTTON_MIDDLE] = 0x04,
    };
    HIDState *hs = (HIDState *)dev;
    HIDPointerEvent *e;

    assert(hs->n < QUEUE_LENGTH);
    e = &hs->ptr.queue[(hs->head + hs->n) & QUEUE_MASK];
...

static void hid_pointer_sync(DeviceState *dev)
{
    HIDState *hs = (HIDState *)dev;
    HIDPointerEvent *prev, *curr, *next;
    bool event_compression = false;

    if (hs->n == QUEUE_LENGTH-1) {
        /*
         * Queue full.  We are losing information, but we at least
         * keep track of most recent button state.
         */
        return;
    }

What about this patch:

diff --git a/hw/input/hid.c b/hw/input/hid.c
index 148c003..56e0637 100644
--- a/hw/input/hid.c
+++ b/hw/input/hid.c
@@ -116,7 +116,7 @@ static void hid_pointer_event(DeviceState *dev, QemuConsole *src,
     HIDState *hs = (HIDState *)dev;
     HIDPointerEvent *e;

-    assert(hs->n < QUEUE_LENGTH);
+    assert(hs->n <= QUEUE_LENGTH);
     e = &hs->ptr.queue[(hs->head + hs->n) & QUEUE_MASK];

     switch (evt->kind) {

Best regards,
-Gonglei