motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-11 03:24:58 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'spice/spice.v67' into staging

Browse source 
* spice/spice.v67:
  qxl: Don't drop client capability bits
  qxl: Fix SPICE_RING_PROD_ITEM(), SPICE_RING_CONS_ITEM() sanity check

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Anthony Liguori 2013-01-14 10:27:08 -06:00
commit 167eb811d0
1 changed files with 10 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

26
hw/qxl.c
View file

@ -37,33 +37,25 @@
*/ */
#undef SPICE_RING_PROD_ITEM #undef SPICE_RING_PROD_ITEM
#define SPICE_RING_PROD_ITEM(qxl, r, ret) { \ #define SPICE_RING_PROD_ITEM(qxl, r, ret) { \
typeof(r) start = r; \
typeof(r) end = r + 1; \
uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \ uint32_t prod = (r)->prod & SPICE_RING_INDEX_MASK(r); \
typeof(&(r)->items[prod]) m_item = &(r)->items[prod]; \ if (prod >= ARRAY_SIZE((r)->items)) { \
if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \ qxl_set_guest_bug(qxl, "SPICE_RING_PROD_ITEM indices mismatch " \
"! %p <= %p < %p", (uint8_t *)start, \ "%u >= %zu", prod, ARRAY_SIZE((r)->items)); \
(uint8_t *)m_item, (uint8_t *)end); \
ret = NULL; \ ret = NULL; \
} else { \ } else { \
ret = &m_item->el; \ ret = &(r)->items[prod].el; \
} \ } \
} }
#undef SPICE_RING_CONS_ITEM #undef SPICE_RING_CONS_ITEM
#define SPICE_RING_CONS_ITEM(qxl, r, ret) { \ #define SPICE_RING_CONS_ITEM(qxl, r, ret) { \
typeof(r) start = r; \
typeof(r) end = r + 1; \
uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \ uint32_t cons = (r)->cons & SPICE_RING_INDEX_MASK(r); \
typeof(&(r)->items[cons]) m_item = &(r)->items[cons]; \ if (cons >= ARRAY_SIZE((r)->items)) { \
if (!((uint8_t*)m_item >= (uint8_t*)(start) && (uint8_t*)(m_item + 1) <= (uint8_t*)(end))) { \
qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \ qxl_set_guest_bug(qxl, "SPICE_RING_CONS_ITEM indices mismatch " \
"! %p <= %p < %p", (uint8_t *)start, \ "%u >= %zu", cons, ARRAY_SIZE((r)->items)); \
(uint8_t *)m_item, (uint8_t *)end); \
ret = NULL; \ ret = NULL; \
} else { \ } else { \
ret = &m_item->el; \ ret = &(r)->items[cons].el; \
} \ } \
} }
@ -959,9 +951,11 @@ static void interface_set_client_capabilities(QXLInstance *sin,
} }
qxl->shadow_rom.client_present = client_present; qxl->shadow_rom.client_present = client_present;
memcpy(qxl->shadow_rom.client_capabilities, caps, sizeof(caps)); memcpy(qxl->shadow_rom.client_capabilities, caps,
sizeof(qxl->shadow_rom.client_capabilities));
qxl->rom->client_present = client_present; qxl->rom->client_present = client_present;
memcpy(qxl->rom->client_capabilities, caps, sizeof(caps)); memcpy(qxl->rom->client_capabilities, caps,
sizeof(qxl->rom->client_capabilities));
qxl_rom_set_dirty(qxl); qxl_rom_set_dirty(qxl);
qxl_send_events(qxl, QXL_INTERRUPT_CLIENT); qxl_send_events(qxl, QXL_INTERRUPT_CLIENT);