hw/qxl: guest bug on primary create with stride %4 != 0

Due to usage of pixman for rendering on all spice surfaces we have
pixman's requirement that the stride be word aligned. A guest not
honoring that can crash spice and qemu with it due to failure to create
a surface (in spice-server). Avoid this early on in primary surface
creation and offscreen surface creation.

Recently windows guests got odd width support which triggers a non word
aligned primary surface in 16bit color depth. Off screen surfaces have
always been word aligned, but doesn't hurt to check them here too.

Signed-off-by: Alon Levy <alevy@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
hw/qxl: qxl_send_events: nop if stopped

Added a trace point for easy logging.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=870972

Signed-off-by: Alon Levy <alevy@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
qxl: fix cursor reset

When resetting the qxl cursor notify the qemu displaystate too.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
qxl: call dpy_gfx_resize when entering vga mode

When entering vga mode the display size likely changes,
notify all displaychangelisteners about this.

Probably went unnoticed for a while as one if the first
things the guest does after leaving qxl native mode and
entering qxl vga mode is to set the vga video mode.  But
there is still a small window where qemu can operate on
stale data, leading to crashes now and then.

https://bugzilla.redhat.com/show_bug.cgi?id=865767

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
spice: switch to pixman

Switch over spice-display.c to use the pixman library
instead of the home-grown pflib bits.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
pflib: unused, remove it.

Replaced by pixman library.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
spice: fix initialization order

Register displaychangelistener last, after spice is fully initialized,
otherwise we may hit NULL pointer dereferences when qemu starts calling
our callbacks.

Commit e250d949feb1334828f27f0d145c35f29c4b7639 triggers this bug.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
usb: split packet result into actual_length + status

Since with the ehci and xhci controllers a single packet can be larger
then maxpacketsize, it is possible for the result of a single packet
to be both having transferred some data as well as the transfer to have
an error.

An example would be an input transfer from a bulk endpoint successfully
receiving 1 or more maxpacketsize packets from the device, followed
by a packet signalling halt.

While already touching all the devices and controllers handle_packet /
handle_data / handle_control code, also change the return type of
these functions to void, solely storing the status in the packet. To
make the code paths for regular versus async packet handling more
uniform.

This patch unfortunately is somewhat invasive, since makeing the qemu
usb core deal with this requires changes everywhere. This patch only
prepares the usb core for this, all the hcd / device changes are done
in such a way that there are no functional changes.

This patch has been tested with uhci and ehci hcds, together with usb-audio,
usb-hid and usb-storage devices, as well as with usb-redir redirection
with a wide variety of real devices.

Note that there is usually no need to directly set packet->actual_length
form devices handle_data callback, as that is done by usb_packet_copy()

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
usb-redir: Allow packets to have both data and an error-status

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ehci: Get rid of the magical PROC_ERR status

Instead make ehci_execute and ehci_fill_queue return the again value.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ehci: Add support for packets with both data and an error status

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
xhci: Add support for packets with both data and an error status

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
usb/combined-packet: Move freeing of combined to usb_combined_packet_remove()

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
xhci: Fix some DMA host endian bugs

The xhci device does correct endian switches on the results of some DMAs
but not all.  In particular, there are many DMAs of what are essentially
arrays of 32-bit integers which never get byteswapped.  This causes them
to be interpreted incorrectly on big-endian hosts, since (as per the xhci
spec) these arrays are always little-endian in guest memory.

This patch adds some helper functions to fix these bugs.  This may not be
all the endian bugs in the xhci code, but it's certainly some of them and
the Linux guest xhci driver certainly gets further with these fixes.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
ehci: fix migration

Commit 5010d4dc618b6b8e7c21129c487c06f6493f71fc reorganized vmstate to
split core + pci, but got two little details wrong.  Fix them.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
qemu-nbd: initialize main loop before block layer

qemu-nbd was broken because they initialized the block layer while
qemu_aio_context was still NULL.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
nbd: accept relative path to Unix socket

Adding the "is_unix" member now will simplify the parsing of NBD URIs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
nbd: accept URIs

The URI syntax is consistent with the Gluster syntax.  Export names
are specified in the path, preceded by one or more (otherwise unused)
slashes.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
nbd: fix nbd_server_stop crash when no server was running

This failed on the new assertion of qemu_set_fd_handler2:

qemu-system-x86_64: /home/pbonzini/work/upstream/qemu/iohandler.c:60: qemu_set_fd_handler2: Assertion `fd >= 0' failed.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
nbd: force read-only export for read-only devices

This is the desired behavior for HMP, but it is a better choice for QMP as well.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>