aboutsummaryrefslogtreecommitdiff
path: root/ui
AgeCommit message (Collapse)Author
2023-11-07ui/gtk-egl: apply scale factor when calculating window's dimensionDongwon Kim
Scale factor needs to be applied when calculating width/height of the GTK windows. Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20231012222643.13996-1-dongwon.kim@intel.com> (cherry picked from commit 47fd6ab1e334962890bc3e8d2e32857f6594e1c1) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-11-07ui/gtk: force realization of drawing areaMarc-André Lureau
Fixes the GL context creation from a widget that isn't yet realized (in a hidden tab for example). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1727 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Antonio Caggiano <quic_acaggian@quicinc.com> Message-Id: <20231017111642.1155545-1-marcandre.lureau@redhat.com> (cherry picked from commit 565f85a9c293818a91a3d3414311303de7e00cec) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-28ui/vnc: fix handling of VNC_FEATURE_XVPPaolo Bonzini
VNC_FEATURE_XVP was not shifted left before adding it to vs->features, so it was never enabled; but it was also checked the wrong way with a logical AND instead of vnc_has_feature. Fix both places. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 477b301000d665313217f65e3a368d2cb7769c42) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-28ui/vnc: fix debug output for invalid audio messagePaolo Bonzini
The debug message was cut and pasted from the invalid audio format case, but the audio message is at bytes 2-3. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 0cb9c5880e6b8dedc4e20026ce859dd1ea9aac84) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-09-13ui: fix crash when there are no active_consoleMarc-André Lureau
Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault. 0x0000555555888630 in dpy_ui_info_supported (con=0x0) at ../ui/console.c:812 812 return con->hw_ops->ui_info != NULL; (gdb) bt #0 0x0000555555888630 in dpy_ui_info_supported (con=0x0) at ../ui/console.c:812 #1 0x00005555558a44b1 in protocol_client_msg (vs=0x5555578c76c0, data=0x5555581e93f0 <incomplete sequence \373>, len=24) at ../ui/vnc.c:2585 #2 0x00005555558a19ac in vnc_client_read (vs=0x5555578c76c0) at ../ui/vnc.c:1607 #3 0x00005555558a1ac2 in vnc_client_io (ioc=0x5555581eb0e0, condition=G_IO_IN, opaque=0x5555578c76c0) at ../ui/vnc.c:1635 Fixes: https://issues.redhat.com/browse/RHEL-2600 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Albert Esteve <aesteve@redhat.com> (cherry picked from commit 48a35e12faf90a896c5aa4755812201e00d60316) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-07-18ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)Mauro Matteo Cascella
A wrong exit condition may lead to an infinite loop when inflating a valid zlib buffer containing some extra bytes in the `inflate_buffer` function. The bug only occurs post-authentication. Return the buffer immediately if the end of the compressed data has been reached (Z_STREAM_END). Fixes: CVE-2023-3255 Fixes: 0bf41cab ("ui/vnc: clipboard support") Reported-by: Kevin Denis <kevin.denis@synacktiv.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-ID: <20230704084210.101822-1-mcascell@redhat.com> (cherry picked from commit d921fea338c1059a27ce7b75309d7a2e485f710b) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-07-02ui/gtk: set the area of the scanout texture correctlyDongwon Kim
x and y offsets and width and height of the scanout texture is not correctly configured in case guest scanout frame is dmabuf. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-ID: <20230621213150.29573-1-dongwon.kim@intel.com> (cherry picked from commit 37802a24eb4e535d96d6fe0273505d2b5c6528c2) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-06-11vnc: move assert in vnc_worker_thread_loopAnastasia Belova
job may be NULL if queue->exit is true. Check it before dereference job. Fixes: f31f9c1080 ("vnc: add magic cookie to VncState") Signed-off-by: Anastasia Belova <abelova@astralinux.ru> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> (cherry picked from commit bdfca8a22f41e7ad47fd2dac71e4d1387e2c0d4e) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/sdl2: disable SDL_HINT_GRAB_KEYBOARD on WindowsVolker Rümelin
Windows sends an extra left control key up/down input event for every right alt key up/down input event for keyboards with international layout. Since commit 830473455f ("ui/sdl2: fix handling of AltGr key on Windows") QEMU uses a Windows low level keyboard hook procedure to reliably filter out the special left control key and to grab the keyboard on Windows. The SDL2 version 2.0.16 introduced its own Windows low level keyboard hook procedure to grab the keyboard. Windows calls this callback before the QEMU keyboard hook procedure. This disables the special left control key filter when the keyboard is grabbed. To fix the problem, disable the SDL2 Windows low level keyboard hook procedure. Reported-by: Bernhard Beschow <shentey@gmail.com> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Thomas Huth <thuth@redhat.com> Tested-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20230418062823.5683-1-vr_qemu@t-online.de> (cherry picked from commit 1dfea3f212e43bfd59d1e1f40b9776db440b211f) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/sdl2: Grab Alt+F4 also under WindowsBernhard Beschow
SDL doesn't grab Alt+F4 under Windows by default. Pressing Alt+F4 thus closes the VM immediately without confirmation, possibly leading to data loss. Fix this by always grabbing Alt+F4 on Windows hosts, too. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20230417192139.43263-3-shentey@gmail.com> (cherry picked from commit 083db9db44c89d7ea7f81844302194d708bcff2b) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/sdl2: Grab Alt+Tab also in fullscreen modeBernhard Beschow
By default, SDL grabs Alt+Tab only in non-fullscreen mode. This causes Alt+Tab to switch tasks on the host rather than in the VM in fullscreen mode while it switches tasks in non-fullscreen mode in the VM. Fix this confusing behavior by grabbing Alt+Tab in fullscreen mode, always causing tasks to be switched in the VM. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20230417192139.43263-2-shentey@gmail.com> (cherry picked from commit efc00a37090eced53bff8b42d26991252aaacc44) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/sdl2: fix surface_gl_update_texture: Assertion 'gls' failedMarc-André Lureau
Before sdl2_gl_update() is called, sdl2_gl_switch() may decide to destroy the console window and its associated shaders. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1644 Fixes: c84ab0a500a8 ("ui/console: optionally update after gfx switch") Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Bin Meng <bin.meng@windriver.com> Message-Id: <20230511074217.4171842-1-marcandre.lureau@redhat.com> (cherry picked from commit b3a654d82ecf276b59a67b2fd688e11a0d8a0064) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/gtk-egl: fix scaling for cursor position in scanout modeErico Nunes
vc->gfx.w and vc->gfx.h are not updated appropriately in this code path, which leads to a different scaling factor for rendering the cursor on some edge cases (e.g. the focus has left and re-entered the gtk window). This can be reproduced using vhost-user-gpu with the gtk ui on the x11 backend. Use the surface dimensions which are already updated accordingly. Signed-off-by: Erico Nunes <ernunes@redhat.com> Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230320160856.364319-2-ernunes@redhat.com> (cherry picked from commit f8a951bb951140a585341c700ebeec58d83f7bbc) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/gtk: use widget size for cursor motion eventErico Nunes
The gd_motion_event size has some calculations for the cursor position, which also take into account things like different size of the framebuffer compared to the window size. The use of window size makes things more difficult though, as at least in the case of Wayland includes the size of ui elements like a menu bar at the top of the window. This leads to a wrong position calculation by a few pixels. Fix it by using the size of the widget, which already returns the size of the actual space to render the framebuffer. Signed-off-by: Erico Nunes <ernunes@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Message-Id: <20230320160856.364319-1-ernunes@redhat.com> (cherry picked from commit 2f31663ed4b5631b5e1c79f5cdd6463e55410eb8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-31ui/gtk: fix passing y0_top parameter to scanoutErico Nunes
The dmabuf->y0_top flag is passed to .dpy_gl_scanout_dmabuf(), however in the gtk ui both implementations dropped it when doing the next scanout_texture call. Fixes flipped linux console using vhost-user-gpu with the gtk ui display. Signed-off-by: Erico Nunes <ernunes@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20230220175605.43759-1-ernunes@redhat.com> (cherry picked from commit 94400fa53f81c9f58ad88cf3f3e7ea89ec423d39) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-05-18ui: Fix pixel colour channel order for PNG screenshotsPeter Maydell
When we take a PNG screenshot the ordering of the colour channels in the data is not correct, resulting in the image having weird colouring compared to the actual display. (Specifically, on a little-endian host the blue and red channels are swapped; on big-endian everything is wrong.) This happens because the pixman idea of the pixel data and the libpng idea differ. PIXMAN_a8r8g8b8 defines that pixels are 32-bit values, with A in bits 24-31, R in bits 16-23, G in bits 8-15 and B in bits 0-7. This means that on little-endian systems the bytes in memory are B G R A and on big-endian systems they are A R G B libpng, on the other hand, thinks of pixels as being a series of values for each channel, so its format PNG_COLOR_TYPE_RGB_ALPHA always wants bytes in the order R G B A This isn't the same as the pixman order for either big or little endian hosts. The alpha channel is also unnecessary bulk in the output PNG file, because there is no alpha information in a screenshot. To handle the endianness issue, we already define in ui/qemu-pixman.h various PIXMAN_BE_* and PIXMAN_LE_* values that give consistent byte-order pixel channel formats. So we can use PIXMAN_BE_r8g8b8 and PNG_COLOR_TYPE_RGB, which both have an in-memory byte order of R G B and 3 bytes per pixel. (PPM format screenshots get this right; they already use the PIXMAN_BE_r8g8b8 format.) Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1622 Fixes: 9a0a119a382867 ("Added parameter to take screenshot with screendump as PNG") Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20230502135548.2451309-1-peter.maydell@linaro.org (cherry picked from commit cd22a0f520f471e3bd33bc19cf3b2fa772cdb2a8) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-04-27vnc: avoid underflow when accessing user-provided addressPaolo Bonzini
If hostlen is zero, there is a possibility that addrstr[hostlen - 1] underflows and, if a closing bracked is there, hostlen - 2 is passed to g_strndup() on the next line. If websocket==false then addrstr[0] would be a colon, but if websocket==true this could in principle happen. Fix it by checking hostlen. Reported by Coverity. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 3f9c41c5df9617510d8533cf6588172efb3df34b) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2023-04-10ui: fix crash on serial reset, during initMarc-André Lureau
For ex, when resetting the xlnx-zcu102 machine: (lldb) bt * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x50) * frame #0: 0x10020a740 gd_vc_send_chars(vc=0x000000000) at gtk.c:1759:41 [opt] frame #1: 0x100636264 qemu_chr_fe_accept_input(be=<unavailable>) at char-fe.c:159:9 [opt] frame #2: 0x1000608e0 cadence_uart_reset_hold [inlined] uart_rx_reset(s=0x10810a960) at cadence_uart.c:158:5 [opt] frame #3: 0x1000608d4 cadence_uart_reset_hold(obj=0x10810a960) at cadence_uart.c:530:5 [opt] frame #4: 0x100580ab4 resettable_phase_hold(obj=0x10810a960, opaque=0x000000000, type=<unavailable>) at resettable.c:0 [opt] frame #5: 0x10057d1b0 bus_reset_child_foreach(obj=<unavailable>, cb=(resettable_phase_hold at resettable.c:162), opaque=0x000000000, type=RESET_TYPE_COLD) at bus.c:97:13 [opt] frame #6: 0x1005809f8 resettable_phase_hold [inlined] resettable_child_foreach(rc=0x000060000332d2c0, obj=0x0000600002c1c180, cb=<unavailable>, opaque=0x000000000, type=RESET_TYPE_COLD) at resettable.c:96:9 [opt] frame #7: 0x1005809d8 resettable_phase_hold(obj=0x0000600002c1c180, opaque=0x000000000, type=RESET_TYPE_COLD) at resettable.c:173:5 [opt] frame #8: 0x1005803a0 resettable_assert_reset(obj=0x0000600002c1c180, type=<unavailable>) at resettable.c:60:5 [opt] frame #9: 0x10058027c resettable_reset(obj=0x0000600002c1c180, type=RESET_TYPE_COLD) at resettable.c:45:5 [opt] While the chardev is created early, the VirtualConsole is associated after, during qemu_init_displays(). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20230220072251.3385878-1-marcandre.lureau@redhat.com> (cherry picked from commit 49152ac47003ca21fc6f2a5c3e517f79649e1541) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2022-11-23ui/gtk: prevent ui lock up when dpy_gl_update called again before current ↵Dongwon Kim
draw event occurs A warning, "qemu: warning: console: no gl-unblock within" followed by guest scanout lockup can happen if dpy_gl_update is called in a row and the second call is made before gd_draw_event scheduled by the first call is taking place. This is because draw call returns without decrementing gl_block ref count if the dmabuf was already submitted as shown below. (gd_gl_area_draw/gd_egl_draw) if (dmabuf) { if (!dmabuf->draw_submitted) { return; } else { dmabuf->draw_submitted = false; } } So it should not schedule any redundant draw event in case draw_submitted is already set in gd_egl_fluch/gd_gl_area_scanout_flush. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20221021192315.9110-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-11-23gtk: disable GTK Clipboard with a new meson optionClaudio Fontana
The GTK Clipboard implementation may cause guest hangs. Therefore implement new configure switch: --enable-gtk-clipboard, as a meson option disabled by default, which warns in the help text about the experimental nature of the feature. Regenerate the meson build options to include it. The initialization of the clipboard is gtk.c, as well as the compilation of gtk-clipboard.c are now conditional on this new option to be set. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1150 Signed-off-by: Claudio Fontana <cfontana@suse.de> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jim Fehlig <jfehlig@suse.com> Message-Id: <20221121135538.14625-1-cfontana@suse.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-11-08ui: fix tab indentationAmarjargal Gundjalam
The TABs should be replaced with spaces, to make sure that we have a consistent coding style with an indentation of 4 spaces everywhere. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/370 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Amarjargal Gundjalam <amarjargal16@gmail.com> Message-Id: <9a0d0718aafaa52029fad76a149f3200b6bba0dd.1666707782.git.amarjargal16@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-11-06module: add Error arguments to module_load and module_load_qomClaudio Fontana
improve error handling during module load, by changing: bool module_load(const char *prefix, const char *lib_name); void module_load_qom(const char *type); to: int module_load(const char *prefix, const char *name, Error **errp); int module_load_qom(const char *type, Error **errp); where the return value is: -1 on module load error, and errp is set with the error 0 on module or one of its dependencies are not installed 1 on module load success 2 on module load success (module already loaded or built-in) module_load_qom_one has been introduced in: commit 28457744c345 ("module: qom module support"), which built on top of module_load_one, but discarded the bool return value. Restore it. Adapt all callers to emit errors, or ignore them, or fail hard, as appropriate in each context. Replace the previous emission of errors via fprintf in _some_ error conditions with Error and error_report, so as to emit to the appropriate target. A memory leak is also fixed as part of the module_load changes. audio: when attempting to load an audio module, report module load errors. Note that still for some callers, a single issue may generate multiple error reports, and this could be improved further. Regarding the audio code itself, audio_add() seems to ignore errors, and this should probably be improved. block: when attempting to load a block module, report module load errors. For the code paths that already use the Error API, take advantage of those to report module load errors into the Error parameter. For the other code paths, we currently emit the error, but this could be improved further by adding Error parameters to all possible code paths. console: when attempting to load a display module, report module load errors. qdev: when creating a new qdev Device object (DeviceState), report load errors. If a module cannot be loaded to create that device, now abort execution (if no CONFIG_MODULE) or exit (if CONFIG_MODULE). qom/object.c: when initializing a QOM object, or looking up class_by_name, report module load errors. qtest: when processing the "module_load" qtest command, report errors in the load of the module. Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220929093035.4231-4-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-11-06module: rename module_load_one to module_loadClaudio Fontana
Signed-off-by: Claudio Fontana <cfontana@suse.de> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20220929093035.4231-3-cfontana@suse.de> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-10-24ui: remove useless typecastsVolker Rümelin
Commit 8f9abdf586 ("chardev: src buffer const for write functions") changed the type of the second parameter of qemu_chr_be_write() from uint8_t * to const uint8_t *. Remove the now useless type casts from qemu_chr_be_write() function calls in ui/console.c and ui/gtk.c. Cc: qemu-trivial@nongnu.org Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Claudio Fontana <cfontana@suse.de> Message-Id: <20221022141204.29358-1-vr_qemu@t-online.de> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-10-24treewide: Remove the unnecessary space before semicolonBin Meng
%s/return ;/return; Signed-off-by: Bin Meng <bmeng@tinylab.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Message-Id: <20221024072802.457832-1-bmeng@tinylab.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-10-22Drop useless casts from g_malloc() & friends to pointerMarkus Armbruster
These memory allocation functions return void *, and casting to another pointer type is useless clutter. Drop these casts. If you really want another pointer type, consider g_new(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20220923120025.448759-3-armbru@redhat.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
2022-10-12gtk: Add show_menubar=on|off command line option.Bryce Mills
The patch adds "show_menubar" command line option for GTK UI similar to "show_tabs". This option allows to hide menu bar initially, it still can be toggled by shortcut and other shortcuts still work. Signed-off-by: Bryce Mills <brycemills@proton.me> Acked-by: Markus Armbruster <armbru@redhat.com> Message-Id: <NWO_zx1CT5Aj9vAXsRlqBppXd63gcKwL9V1qM1Meh36M_9tCw-EsCnfpvONXhHjmtKIUoSuCy9OO6cHS7M8b0oHBOCZG6f1jZ4Q2tqgI2Qo=@proton.me> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-10-12ui/gtk: Fix the implicit mouse ungrabbing logicAkihiko Odaki
Although the grab menu item represents the tabbed displays, the old implicit mouse ungrabbing logic changes the grab menu item even for an untabbed display. Leave the grab menu item when implicitly ungrabbing mouse for an untabbed display. The new ungrabbing logic introduced in gd_mouse_mode_change() strictly follows the corresponding grabbing logic found in gd_button_event(). Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20221008140116.11473-1-akihiko.odaki@daynix.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-10-11ui/gtk-egl: egl context needs to be unbound in the end of gd_egl_switchDongwon Kim
A thread often fails to bind an egl context to itself after guest VM is rebooted because the context is still owned by another thread. It is not very clear what condition makes this happen but this can be prevented by unbinding the context from the thread in the end of gd_egl_switch. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Message-Id: <20220928215805.4661-1-dongwon.kim@intel.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-10-11ui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_extMauro Matteo Cascella
Extended ClientCutText messages start with a 4-byte header. If len < 4, an integer underflow occurs in vnc_client_cut_text_ext. The result is used to decompress data in a while loop in inflate_buffer, leading to CPU consumption and denial of service. Prevent this by checking dlen in protocol_client_msg. Fixes: CVE-2022-3165 Fixes: 0bf41cab93e5 ("ui/vnc: clipboard support") Reported-by: TangPeng <tangpeng@qianxin.com> Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Message-Id: <20220925204511.1103214-1-mcascell@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-10-04Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into stagingStefan Hajnoczi
* x86: re-enable rng seeding via SetupData * x86: reinitialize RNG seed on system reboot and after kernel load * qboot: rebuild based on latest commit * watchdog: remove -watchdog option * update Meson to 0.61.5, move more configure tests # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmM4kiAUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroNfbgf+IHhIHVxtBVWqayVRkwpQC+oAFV/V # 4bvJI90rHmTNPA36n1ocUmQmXyNVTQFW/t7mlln5BhOwNzxnQycVe2idfMa6ntkb # hHpe2NbICF9Crzb9BkK4wnaBLwEWA/X3WlnCqPYtxlxEhjmxu+HPtF7vm12OTkOV # JevH3EN1gMiAfMo+gcRBlrwb5kntLm3nGZTCd218Ope22PoU6MVvxb9ivieJG8kD # xDUGPQNU0mB9pypwLYZAqmu34xJ8Stly9UuJ1M2iQoawIs7W2Qy7svpOrsKZ3W/7 # D7J18QLAjI7Hq6rUWPgK5ugnUvVMdaTXM7MZSuIDIxRJuj5YryIsHRPybQ== # =HEmX # -----END PGP SIGNATURE----- # gpg: Signature made Sat 01 Oct 2022 15:16:48 EDT # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: x86: re-initialize RNG seed when selecting kernel target/i386/kvm: fix kvmclock_current_nsec: Assertion `time.tsc_timestamp <= migration_tsc' failed configure, meson: move linker flag detection to meson configure, meson: move C++ compiler detection to meson.build meson: multiple names can be passed to dependency() meson: require 0.61.3 meson: -display dbus and CFI are incompatible ui: fix path to dbus-display1.h watchdog: remove -watchdog option configure: do not invoke as/ld directly for pc-bios/optionrom qboot: rebuild based on latest commit x86: re-enable rng seeding via SetupData x86: reinitialize RNG seed on system reboot x86: use typedef for SetupData struct x86: return modified setup_data only if read as memory, not as file Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-29ui: fix path to dbus-display1.hPaolo Bonzini
While the source directory is always included in the include path, the corresponding directory in the build tree is not. Therefore, custom_targets (e.g. ui/dbus-display1.h) must be referred to using the full path. This avoids a build failure when ui/dbus-chardev.c is not built as a module: In file included from ../ui/dbus-chardev.c:32: ../ui/dbus.h:34:10: fatal error: dbus-display1.h: No such file or directory 34 | #include "dbus-display1.h" | ^~~~~~~~~~~~~~~~~ Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-09-27Merge tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu ↵Stefan Hajnoczi
into staging usb: make usbnet work with xhci. audio: add sndio backend. misc bugfixes for console, xhci, audio, ati-vga and virtio-gpu. # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmMyse8ACgkQTLbY7tPo # cTiLrRAAltoyd++jsmhg2wXuJsfekfec3kOro7T+eSznDWfBRvm7VxJ+gswYBYga # HbEkHjII0yPbOP9WDMhhHx33g2nYdbhDLPKXHdK8MjHTTPxtYP7XmsWkEVpuuzTx # WqeYvGSmUri6QOUz7fd07IhiBT1aQvUQ/vWQ6OhyRVPy41bR8kIbGx3iV0JDxWvz # n3xUZALGLz3QAM0lXRzXPYT9JB/RqdbpMM35HNTpN9/xaZmgFWsyuQXSSm61pTtb # PS+lILDPjgZeYsfsZRyhZaSZrp2f6WOGm1ZdtSM0rvmRKezOzYnG8fm4fqZQLYSj # nrAqUs38sKaM71a3QbpXhDjbv4cpj0K3iSNLmlUq4pgvPiMgwPlgSwwCGlkNDaRo # IA1KON1pMH2A5vvtXEUt5RTkbXxHAAKPdpl5sS6kgbs7dgoKDqzaIPFQELam259Z # 9nbMBqz/d6gm2CFT5ogrY0q511IC5hWtsmbQZkOZeBd5SvhvyJ59DIabFDcw05fG # ixZVapewXYtzFUde2lb8X5qyneUVeGY5D2OJ2uUykHgR2Qz4d3CjXlhnRkLIkMcd # Uu6N1LTkjyuuB86BoTSZxk0iz94OvmyDiXpqwmRaCGcdnTOTj0dKrbRrtHdC2vCo # cBpUAIdyJvDJSm0X8ZWvvv1sMJCAJ7lofFf/P/jUKlacC2ipgXQ= # =QBLK # -----END PGP SIGNATURE----- # gpg: Signature made Tue 27 Sep 2022 04:18:55 EDT # gpg: using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full] # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" [full] # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full] # Primary key fingerprint: A032 8CFF B93A 17A7 9901 FE7D 4CB6 D8EE D3E8 7138 * tag 'kraxel-20220927-pull-request' of https://gitlab.com/kraxel/qemu: (24 commits) virtio-gpu: update scanout if there is any area covered by the rect hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) audio: remove abort() in audio_bug() Revert "audio: Log context for audio bug" audio: Add sndio backend usbnet: Report link-up via interrupt endpoint in CDC-ECM mode usbnet: Detect short packets as sent by the xHCI controller usbnet: Accept mandatory USB_CDC_SET_ETHERNET_PACKET_FILTER request usbnet: Add missing usb_wakeup() call in usbnet_receive() hcd-xhci: drop operation with secondary stream arrays enabled usb/msd: add usb_msd_fatal_error() and fix guest-triggerable assert usb/msd: move usb_msd_packet_complete() hcd-ohci: Drop ohci_service_iso_td() if ed->head & OHCI_DPTR_MASK is zero hw/usb/hcd-xhci: Check whether DMA accesses fail ui/console: fix three double frees in png_save() ui/vdagent: fix serial reset of guest agent ui/clipboard: reset the serial state on reset ui/vdagent: always reset the clipboard serial on caps ui/clipboard: fix serial priority ui: add some vdagent related traces ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2022-09-23ui/console: fix three double frees in png_save()Volker Rümelin
The png_destroy_write_struct() function frees all memory used by libpng. Don't use the glib auto cleanup mechanism to free the memory allocated by libpng again. For the pixman image, use only the auto cleanup mechanism and remove the qemu_pixman_image_unref() function call to prevent another double free. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1210 Fixes: 9a0a119a38 ("Added parameter to take screenshot with screendump as PNG") Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Volker Rümelin <vr_qemu@t-online.de> Message-Id: <20220919061956.30929-1-vr_qemu@t-online.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/vdagent: fix serial reset of guest agentMarc-André Lureau
In order to reset the guest agent, we send CLOSED & OPENED events. They are correctly received by the guest kernel. However, they might not be noticed by the guest agent process, as the IO task (poll() for example) might be wake up after both CLOSED & OPENED have been processed. Wait until the guest agent is disconnected to re-open our side. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220912102455.111765-6-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/clipboard: reset the serial state on resetMarc-André Lureau
Not only we have to reset the vdagent clipboards serial state, but also the current QEMU clipboards info serial (the value is currently used by qemu_clipboard_check_serial, only used by -display dbus). Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220912102455.111765-5-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/vdagent: always reset the clipboard serial on capsMarc-André Lureau
The guest agent doesn't know what is the current serial state. Reset the serial value whenever a new agent connection is established. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2124446 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220912102455.111765-4-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/clipboard: fix serial priorityMarc-André Lureau
The incoming grab event should have a higher serial. See also "vdagent: introduce VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL": https://gitlab.freedesktop.org/spice/spice-protocol/-/commit/045a6978d6dbbf7046affc5c321fa8177c8cce56 This is only a relevant fix for the -display dbus, only user of that function. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220912102455.111765-3-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui: add some vdagent related tracesMarc-André Lureau
This helps debugging clipboard serial sync issues. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20220912102455.111765-2-marcandre.lureau@redhat.com> [ kraxel: code style fix ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/cocoa: Run qemu_init in the main threadAkihiko Odaki
This work is based on: https://patchew.org/QEMU/20220317125534.38706-1-philippe.mathieu.daude@gmail.com/ Simplify the initialization dance by running qemu_init() in the main thread before the Cocoa event loop starts. The secondary thread only runs only qemu_main_loop() and qemu_cleanup(). This fixes a case where addRemovableDevicesMenuItems() calls qmp_query_block() while expecting the main thread to still hold the BQL. Overriding the code after calling qemu_init() is done by dynamically replacing a function pointer variable, qemu_main when initializing ui/cocoa, which unifies the static implementation of main() for builds with ui/cocoa and ones without ui/cocoa. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Message-Id: <20220819132756.74641-2-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-23ui/console: Get tab completion working again in the SDL monitor vcCal Peake
Define a QEMU special key constant for the tab key and add an entry for it in the qcode_to_keysym table. This allows tab completion to work again in the SDL monitor virtual console, which has been broken ever since the migration from SDL1 to SDL2. Signed-off-by: Cal Peake <cp@absolutedigital.net> Message-Id: <7054816e-99c-7e2-6737-7cf98cc56e2@absolutedigital.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-09-22ui/curses: Avoid dynamic stack allocationPhilippe Mathieu-Daudé
Use autofree heap allocation instead of variable-length array on the stack. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20220819153931.3147384-11-peter.maydell@linaro.org
2022-08-18ui/console: fix qemu_console_resize() regressionMarc-André Lureau
The display may be corrupted when changing screen colour depth in qemu-system-ppc/MacOS since 7.0. Do not short-cut qemu_console_resize() if the surface is backed by vga vram. When the scanout isn't set, or it is already allocated, or opengl, and the size is fitting, we still avoid the reallocation & replace path. Fixes: commit cb8962c1 ("ui: do not create a surface when resizing a GL scanout") Reported-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Message-Id: <20220725115815.2461322-1-marcandre.lureau@redhat.com>
2022-08-01trivial: Fix duplicated wordsThomas Huth
Some files wrongly contain the same word twice in a row. One of them should be removed or replaced. Message-Id: <20220722145859.1952732-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2022-07-28ui: dbus-display requires CONFIG_GBMPaolo Bonzini
Without CONFIG_GBM, compiling dbus-display fails with ../ui/dbus.c: In function ‘dbus_create_context’: ../ui/dbus.c:47:20: error: ‘qemu_egl_rn_ctx’ undeclared (first use in this function); did you mean ‘qemu_egl_init_ctx’? 47 | qemu_egl_rn_ctx); | ^~~~~~~~~~~~~~~ | qemu_egl_init_ctx ../ui/dbus.c:47:20: note: each undeclared identifier is reported only once for each function it appears in and many other similar errors, because include/ui/egl-helpers.h only has these declaration if gbm is found on the system. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1108 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-07-19gtk: Add show_tabs=on|off command line option.Felix xq Queißner
The patch adds "show_tabs" command line option for GTK ui similar to "grab_on_hover". This option allows tabbed view mode to not have to be enabled by hand at each start of the VM. Signed-off-by: Felix "xq" Queißner <xq@random-projects.net> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220712133753.18937-1-xq@random-projects.net> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-19dbus-display: fix test race when initializing p2p connectionMarc-André Lureau
The D-Bus connection starts processing messages before QEMU has the time to set the object manager server. This is causing dbus-display-test to fail randomly with: ERROR:../tests/qtest/dbus-display-test.c:68:test_dbus_display_vm: assertion failed (qemu_dbus_display1_vm_get_name(QEMU_DBUS_DISPLAY1_VM(vm)) == "dbus-test"): (NULL == "dbus-test") ERROR Use the delayed message processing flag and method to avoid that situation. (the bus connection doesn't need a fix, as the initialization is done synchronously) Reported-by: Robinson, Cole <crobinso@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Tested-by: Cole Robinson <crobinso@redhat.com> Message-Id: <20220609152647.870373-1-marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2022-07-13ui/cocoa: Take refresh rate into accountAkihiko Odaki
Retrieve the refresh rate of the display and reflect it with dpy_set_ui_info() and update_displaychangelistener(), allowing the guest and DisplayChangeListener to consume the information. The information will be used as a hint how often the display should be updated. For example, when we run 30 Hz physical display updates it is pointless for the guest to update the screen at 60Hz frequency, the guest can spare some work instead. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20220702142519.12188-1-akihiko.odaki@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-07-13ui/cocoa: Fix switched_to_fullscreen warningPeter Delevoryas
I noticed this error while building QEMU on Mac OS X: [1040/1660] Compiling Objective-C object libcommon.fa.p/ui_cocoa.m.o ../ui/cocoa.m:803:17: warning: variable 'switched_to_fullscreen' set but not used [-Wunused-but-set-variable] static bool switched_to_fullscreen = false; ^ 1 warning generated. I think the behavior is fine if you remove "switched_to_fullscreen", I can still switch in and out of mouse grabbed mode and fullscreen mode with this change, and Command keycodes will only be passed to the guest if the mouse is grabbed, which I think is the right behavior. I'm not sure why a static piece of state was needed to handle that in the first place. Perhaps the refactoring of the flags-state-change fixed that by toggling the Command keycode on. I tested this with an Ubuntu core image on macOS 12.4 wget https://cdimage.ubuntu.com/ubuntu-core/18/stable/current/ubuntu-core-18-i386.img.xz xz -d ubuntu-core-18-i386.img.xz qemu-system-x86_64 -drive file=ubuntu-core-18.i386.img,format=raw Fixes: 6d73bb643aa7 ("ui/cocoa: Clear modifiers whenever possible") Signed-off-by: Peter Delevoryas <peter@pjd.dev> Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20220702044304.90553-1-peter@pjd.dev> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
2022-07-01ui/cocoa: Fix clipboard text releaseAkihiko Odaki
[-NSPasteboard dataForType:] returns an autoreleased NSString, and callings its release method will result in double-free when the global autorelease pool is released. Use NSAutoreleasePool to release it properly. Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <20220614212131.94696-1-akihiko.odaki@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-02 13:43:01 +0000