1. 12 11月, 2018 5 次提交
    • G
      ui/gtk: fix cursor in egl mode · f1aba960
      Gerd Hoffmann 提交于
      In egl mode the scale_x and scale_y variables are not set, so the
      scaling logic in the mouse motion event handler does not work.
      
      Fix that.  Also scale the cursor position in gd_egl_cursor_position().
      Reported-by: NChen Zhang <tgfbeta@icloud.com>
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      Tested-by: NChen Zhang <tgfbeta@icloud.com>
      Message-id: 20181107074949.13805-1-kraxel@redhat.com
      f1aba960
    • G
      pulseaudio: process audio data in smaller chunks · 6cdc2d18
      Gerd Hoffmann 提交于
      The rate of pulseaudio absorbing the audio stream is used to control the
      the rate of the guests audio stream.  When the emulated hardware uses
      small chunks (like intel-hda does) we need small chunks on the audio
      backend side too, otherwise that feedback loop doesn't work very well.
      
      Cc: Max Ehrlich <maxehr@umiacs.umd.edu>
      Cc: Martin Schrodt <martin@schrodt.org>
      Buglink: https://bugs.launchpad.net/bugs/1795527Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
      Message-id: 20181109142032.1628-1-kraxel@redhat.com
      6cdc2d18
    • M
      edid: silence a stringop-overflow warning · 627c865d
      Marc-André Lureau 提交于
      Simplify the code that doesn't need strncpy() since length of string
      is already computed.
      
      /home/elmarco/src/qemu/hw/display/edid-generate.c: In function 'edid_desc_text':
      /home/elmarco/src/qemu/hw/display/edid-generate.c:168:5: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
           strncpy((char *)(desc + 5), text, len);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      /home/elmarco/src/qemu/hw/display/edid-generate.c:164:11: note: length computed here
           len = strlen(text);
                 ^~~~~~~~~~~~
      cc1: all warnings being treated as errors
      Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
      Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
      Message-id: 20181110111623.31356-1-marcandre.lureau@redhat.com
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      627c865d
    • T
      bt: Mark the bluetooth subsystem as deprecated · c0188e69
      Thomas Huth 提交于
      It has been unmaintained since years, and there were only trivial or
      tree-wide changes to the related files since many years, so the
      code is likely very bitrotten and broken. For example the following
      segfaults as soon as as you press a key:
      
       qemu-system-x86_64 -usb -device usb-bt-dongle -bt hci -bt device:keyboard
      
      Since we are not aware of anybody using bluetooth with the current
      version of QEMU, let's mark the subsystem as deprecated, with a special
      request for the users to write to the qemu-devel mailing list in case
      they still use it (so we could revert the deprecation status in that
      case).
      Signed-off-by: NThomas Huth <thuth@redhat.com>
      Message-id: 1542016830-19189-1-git-send-email-thuth@redhat.com
      Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
      c0188e69
    • P
      Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging · 460f0236
      Peter Maydell 提交于
      slirp updates
      
      Peter Maydell (4):
        slirp: Don't pass possibly -1 fd to send()
        slirp: Use g_new() to allocate sockets in socreate()
        slirp: Remove code that handles socreate() failure
        slirp: fork_exec(): create and connect child socket before fork()
      
      # gpg: Signature made Sat 10 Nov 2018 14:08:53 GMT
      # gpg:                using RSA key E3F65A9E9560DB4C
      # gpg: Good signature from "Samuel Thibault <samuel.thibault@aquilenet.fr>"
      # gpg:                 aka "Samuel Thibault <sthibault@debian.org>"
      # gpg:                 aka "Samuel Thibault <samuel.thibault@gnu.org>"
      # gpg:                 aka "Samuel Thibault <samuel.thibault@inria.fr>"
      # gpg:                 aka "Samuel Thibault <samuel.thibault@labri.fr>"
      # gpg:                 aka "Samuel Thibault <samuel.thibault@ens-lyon.org>"
      # gpg:                 aka "Samuel Thibault <samuel.thibault@u-bordeaux.fr>"
      # gpg: WARNING: This key is not certified with sufficiently trusted signatures!
      # gpg:          It is not certain that the signature belongs to the owner.
      # Primary key fingerprint: 900C B024 B679 31D4 0F82  304B D017 8C76 7D06 9EE6
      #      Subkey fingerprint: 33FA 7B64 6195 01F8 CE9C  8F97 E3F6 5A9E 9560 DB4C
      
      * remotes/thibault/tags/samuel-thibault:
        slirp: fork_exec(): create and connect child socket before fork()
        slirp: Remove code that handles socreate() failure
        slirp: Use g_new() to allocate sockets in socreate()
        slirp: Don't pass possibly -1 fd to send()
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      460f0236
  2. 10 11月, 2018 4 次提交
  3. 09 11月, 2018 4 次提交
    • P
      Merge remote-tracking branch 'remotes/gkurz/tags/for-upstream' into staging · 160e5c22
      Peter Maydell 提交于
      Fixes a potential use-after-free issue that could be triggered by a
      misbehaving guest.
      
      # gpg: Signature made Thu 08 Nov 2018 20:36:48 GMT
      # gpg:                using RSA key 71D4D5E5822F73D6
      # gpg: Good signature from "Greg Kurz <groug@kaod.org>"
      # gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
      # gpg:                 aka "[jpeg image of size 3330]"
      # Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6
      
      * remotes/gkurz/tags/for-upstream:
        9p: write lock path in v9fs_co_open2()
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      160e5c22
    • G
      9p: write lock path in v9fs_co_open2() · 5b76ef50
      Greg Kurz 提交于
      The assumption that the fid cannot be used by any other operation is
      wrong. At least, nothing prevents a misbehaving client to create a
      file with a given fid, and to pass this fid to some other operation
      at the same time (ie, without waiting for the response to the creation
      request). The call to v9fs_path_copy() performed by the worker thread
      after the file was created can race with any access to the fid path
      performed by some other thread. This causes use-after-free issues that
      can be detected by ASAN with a custom 9p client.
      
      Unlike other operations that only read the fid path, v9fs_co_open2()
      does modify it. It should hence take the write lock.
      
      Cc: P J P <ppandit@redhat.com>
      Reported-by: Nzhibin hu <noirfate@gmail.com>
      Signed-off-by: NGreg Kurz <groug@kaod.org>
      5b76ef50
    • P
      Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-rc1' into staging · d3c2bbb1
      Peter Maydell 提交于
      A Single RISC-V Patch for 3.1-rc1
      
      This tag contains a single patch that I'd like to target for rc1: a fix
      for a memory leak that was detected by static code analysis.
      
      There are still three patch sets that I'd like to try to get up for 3.1:
      
      * The patch set Basian just published that contains fixes for a pair of
        issues he found when converting our port to decodetree.
      * An as-of-yet-unwritten fix to the third issue that Basian pointed out.
      * A fix to our fflags bug, which is currently coupled to some CSR
        refactoring that I don't think is OK for 3.1.
      
      I'm at Plumbers next week (and I think Alistair is there too?), but I'll
      try to find a way to squeeze in as much as possible.
      
      # gpg: Signature made Thu 08 Nov 2018 16:50:27 GMT
      # gpg:                using RSA key EF4CA1502CCBAB41
      # gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>"
      # gpg:                 aka "Palmer Dabbelt <palmer@sifive.com>"
      # gpg: WARNING: This key is not certified with a trusted signature!
      # gpg:          There is no indication that the signature belongs to the owner.
      # Primary key fingerprint: 00CE 76D1 8349 60DF CE88  6DF8 EF4C A150 2CCB AB41
      
      * remotes/riscv/tags/riscv-for-master-3.1-rc1:
        riscv: spike: Fix memory leak in the board init
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      d3c2bbb1
    • A
      riscv: spike: Fix memory leak in the board init · 00a014ac
      Alistair Francis 提交于
      Coverity caught a malloc() call that was never freed. This patch ensures
      that we free the memory but also updates the allocation to use
      g_strdup_printf() instead of malloc().
      Signed-off-by: NAlistair Francis <alistair.francis@wdc.com>
      Suggested-by: NPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: NPalmer Dabbelt <palmer@sifive.com>
      Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>
      00a014ac
  4. 08 11月, 2018 26 次提交
  5. 07 11月, 2018 1 次提交
    • P
      util/qemu-thread-posix: Fix qemu_thread_atexit* for OSX · a458774a
      Peter Maydell 提交于
      Our current implementation of qemu_thread_atexit* is broken on OSX.
      This is because it works by cerating a piece of thread-specific
      data with pthread_key_create() and using the destructor function
      for that data to run the notifier function passed to it by
      the caller of qemu_thread_atexit_add(). The expected use case
      is that the caller uses a __thread variable as the notifier,
      and uses the callback to clean up information that it is
      keeping per-thread in __thread variables.
      
      Unfortunately, on OSX this does not work, because on OSX
      a __thread variable may be destroyed (freed) before the
      pthread_key_create() destructor runs. (POSIX imposes no
      ordering constraint here; the OSX implementation happens
      to implement __thread variables in terms of pthread_key_create((),
      whereas Linux uses different mechanisms that mean the __thread
      variables will still be present when the pthread_key_create()
      destructor is run.)
      
      Fix this by switching to a scheme similar to the one qemu-thread-win32
      uses for qemu_thread_atexit: keep the thread's notifiers on a
      __thread variable, and run the notifiers on calls to
      qemu_thread_exit() and on return from the start routine passed
      to qemu_thread_start(). We do this with the pthread_cleanup_push()
      API.
      
      We take advantage of the qemu_thread_atexit_add() API
      permission not to run thread notifiers on process exit to
      avoid having to special case the main thread.
      Suggested-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
      Reviewed-by: NEric Blake <eblake@redhat.com>
      Message-Id: <20181105135538.28025-3-peter.maydell@linaro.org>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      a458774a