diff mbox

[PATCHv3] qxl: QXL_IO_UPDATE_AREA: pass ram->update_area directly to update_area

Message ID 1310478932-25370-12-git-send-email-alevy@redhat.com
State New
Headers show

Commit Message

Alon Levy July 12, 2011, 1:55 p.m. UTC 
---
 hw/qxl.c |    6 +-----
 1 files changed, 1 insertions(+), 5 deletions(-)

Comments

Gerd Hoffmann July 13, 2011, 6:56 a.m. UTC | #1 
Hi,

> -        QXLRect update = d->ram->update_area;
>           qxl_spice_update_area(d, d->ram->update_surface,
> -&update, NULL, 0, 0);
> +&d->ram->update_area, NULL, 0, 1);

No, -ESECURITY.

With this in place the guest can change the update rect while 
spice-server is working with it.

cheers,
   Gerd
Alon Levy July 13, 2011, 9:29 a.m. UTC | #2 
On Wed, Jul 13, 2011 at 08:56:27AM +0200, Gerd Hoffmann wrote:
>   Hi,
> 
> >-        QXLRect update = d->ram->update_area;
> >          qxl_spice_update_area(d, d->ram->update_surface,
> >-&update, NULL, 0, 0);
> >+&d->ram->update_area, NULL, 0, 1);
> 
> No, -ESECURITY.
> 
> With this in place the guest can change the update rect while
> spice-server is working with it.
> 

ok, will drop.

> cheers,
>   Gerd
>
diff mbox

Patch

diff --git a/hw/qxl.c b/hw/qxl.c
index 17b5b39..6094b38 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -136,7 +136,6 @@  void qxl_guest_bug(PCIQXLDevice *qxl, const char *msg, ...)
     }
 }
 
-
 void qxl_spice_update_area(PCIQXLDevice *qxl, uint32_t surface_id,
                            struct QXLRect *area, struct QXLRect *dirty_rects,
                            uint32_t num_dirty_rects, uint32_t clear_dirty_region)
@@ -1081,12 +1080,9 @@  static void ioport_write(void *opaque, uint32_t addr, uint32_t val)
 
     switch (io_port) {
     case QXL_IO_UPDATE_AREA:
-    {
-        QXLRect update = d->ram->update_area;
         qxl_spice_update_area(d, d->ram->update_surface,
-                              &update, NULL, 0, 0);
+                              &d->ram->update_area, NULL, 0, 1);
         break;
-    }
     case QXL_IO_NOTIFY_CMD:
         qemu_spice_wakeup(&d->ssd);
         break;