summaryrefslogtreecommitdiffstats
path: root/hw/input/virtio-input-hid.c
Commit message (Collapse)AuthorAgeFilesLines
* hw/input/virtio-input-hid.c: Don't undef CONFIG_CURSESPeter Maydell2020-07-241-1/+0Star
| | | | | | | | | | | | | virtio-input-hid.c undefines CONFIG_CURSES before including ui/console.h. However since commits e2f82e924d057935 and b0766612d16da18 that header does not have behaviour dependent on CONFIG_CURSES. Remove the now-unneeded undef. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20200723192457.28136-1-peter.maydell@linaro.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* qdev: Unrealize must not failMarkus Armbruster2020-05-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Devices may have component devices and buses. Device realization may fail. Realization is recursive: a device's realize() method realizes its components, and device_set_realized() realizes its buses (which should in turn realize the devices on that bus, except bus_set_realized() doesn't implement that, yet). When realization of a component or bus fails, we need to roll back: unrealize everything we realized so far. If any of these unrealizes failed, the device would be left in an inconsistent state. Must not happen. device_set_realized() lets it happen: it ignores errors in the roll back code starting at label child_realize_fail. Since realization is recursive, unrealization must be recursive, too. But how could a partly failed unrealize be rolled back? We'd have to re-realize, which can fail. This design is fundamentally broken. device_set_realized() does not roll back at all. Instead, it keeps unrealizing, ignoring further errors. It can screw up even for a device with no buses: if the lone dc->unrealize() fails, it still unregisters vmstate, and calls listeners' unrealize() callback. bus_set_realized() does not roll back either. Instead, it stops unrealizing. Fortunately, no unrealize method can fail, as we'll see below. To fix the design error, drop parameter @errp from all the unrealize methods. Any unrealize method that uses @errp now needs an update. This leads us to unrealize() methods that can fail. Merely passing it to another unrealize method cannot cause failure, though. Here are the ones that do other things with @errp: * virtio_serial_device_unrealize() Fails when qbus_set_hotplug_handler() fails, but still does all the other work. On failure, the device would stay realized with its resources completely gone. Oops. Can't happen, because qbus_set_hotplug_handler() can't actually fail here. Pass &error_abort to qbus_set_hotplug_handler() instead. * hw/ppc/spapr_drc.c's unrealize() Fails when object_property_del() fails, but all the other work is already done. On failure, the device would stay realized with its vmstate registration gone. Oops. Can't happen, because object_property_del() can't actually fail here. Pass &error_abort to object_property_del() instead. * spapr_phb_unrealize() Fails and bails out when remove_drcs() fails, but other work is already done. On failure, the device would stay realized with some of its resources gone. Oops. remove_drcs() fails only when chassis_from_bus()'s object_property_get_uint() fails, and it can't here. Pass &error_abort to remove_drcs() instead. Therefore, no unrealize method can fail before this patch. device_set_realized()'s recursive unrealization via bus uses object_property_set_bool(). Can't drop @errp there, so pass &error_abort. We similarly unrealize with object_property_set_bool() elsewhere, always ignoring errors. Pass &error_abort instead. Several unrealize methods no longer handle errors from other unrealize methods: virtio_9p_device_unrealize(), virtio_input_device_unrealize(), scsi_qdev_unrealize(), ... Much of the deleted error handling looks wrong anyway. One unrealize methods no longer ignore such errors: usb_ehci_pci_exit(). Several realize methods no longer ignore errors when rolling back: v9fs_device_realize_common(), pci_qdev_unrealize(), spapr_phb_realize(), usb_qdev_realize(), vfio_ccw_realize(), virtio_device_realize(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-17-armbru@redhat.com>
* qdev: set properties with device_class_set_props()Marc-André Lureau2020-01-241-3/+3
| | | | | | | | | | | | | | | | | | | | | The following patch will need to handle properties registration during class_init time. Let's use a device_class_set_props() setter. spatch --macro-file scripts/cocci-macro-file.h --sp-file ./scripts/coccinelle/qdev-set-props.cocci --keep-comments --in-place --dir . @@ typedef DeviceClass; DeviceClass *d; expression val; @@ - d->props = val + device_class_set_props(d, val) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20200110153039.1379601-20-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* Include hw/qdev-properties.h lessMarkus Armbruster2019-08-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | In my "build everything" tree, changing hw/qdev-properties.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Many places including hw/qdev-properties.h (directly or via hw/qdev.h) actually need only hw/qdev-core.h. Include hw/qdev-core.h there instead. hw/qdev.h is actually pointless: all it does is include hw/qdev-core.h and hw/qdev-properties.h, which in turn includes hw/qdev-core.h. Replace the remaining uses of hw/qdev.h by hw/qdev-properties.h. While there, delete a few superfluous inclusions of hw/qdev-core.h. Touching hw/qdev-properties.h now recompiles some 1200 objects. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190812052359.30071-22-armbru@redhat.com>
* Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster2019-06-121-0/+1
| | | | | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
* hw: convert virtio-input-hid device to keycodemapdbDaniel P. Berrange2018-01-291-127/+9Star
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace the keymap_qcode table with automatically generated tables. Missing entries in keymap_qcode now fixed: Q_KEY_CODE_ASTERISK -> KEY_KPASTERISK Q_KEY_CODE_KP_MULTIPLY -> KEY_KPASTERISK Q_KEY_CODE_STOP -> KEY_STOP Q_KEY_CODE_AGAIN -> KEY_AGAIN Q_KEY_CODE_PROPS -> KEY_PROPS Q_KEY_CODE_UNDO -> KEY_UNDO Q_KEY_CODE_FRONT -> KEY_FRONT Q_KEY_CODE_COPY -> KEY_COPY Q_KEY_CODE_OPEN -> KEY_OPEN Q_KEY_CODE_PASTE -> KEY_PASTE Q_KEY_CODE_FIND -> KEY_FIND Q_KEY_CODE_CUT -> KEY_CUT Q_KEY_CODE_LF -> KEY_LINEFEED Q_KEY_CODE_HELP -> KEY_HELP Q_KEY_CODE_COMPOSE -> KEY_COMPOSE Q_KEY_CODE_RO -> KEY_RO Q_KEY_CODE_HIRAGANA -> KEY_HIRAGANA Q_KEY_CODE_HENKAN -> KEY_HENKAN Q_KEY_CODE_YEN -> KEY_YEN Q_KEY_CODE_KP_COMMA -> KEY_KPCOMMA Q_KEY_CODE_KP_EQUALS -> KEY_KPEQUAL Q_KEY_CODE_POWER -> KEY_POWER Q_KEY_CODE_SLEEP -> KEY_SLEEP Q_KEY_CODE_WAKE -> KEY_WAKEUP Q_KEY_CODE_AUDIONEXT -> KEY_NEXTSONG Q_KEY_CODE_AUDIOPREV -> KEY_PREVIOUSSONG Q_KEY_CODE_AUDIOSTOP -> KEY_STOPCD Q_KEY_CODE_AUDIOPLAY -> KEY_PLAYPAUSE Q_KEY_CODE_AUDIOMUTE -> KEY_MUTE Q_KEY_CODE_VOLUMEUP -> KEY_VOLUMEUP Q_KEY_CODE_VOLUMEDOWN -> KEY_VOLUMEDOWN Q_KEY_CODE_MEDIASELECT -> KEY_MEDIA Q_KEY_CODE_MAIL -> KEY_MAIL Q_KEY_CODE_CALCULATOR -> KEY_CALC Q_KEY_CODE_COMPUTER -> KEY_COMPUTER Q_KEY_CODE_AC_HOME -> KEY_HOMEPAGE Q_KEY_CODE_AC_BACK -> KEY_BACK Q_KEY_CODE_AC_FORWARD -> KEY_FORWARD Q_KEY_CODE_AC_REFRESH -> KEY_REFRESH Q_KEY_CODE_AC_BOOKMARKS -> KEY_BOOKMARKS NB, the virtio-input device reports a bitmask to the guest driver that has a bit set for each Linux keycode that the host is able to send to the guest. Thus by adding these extra key mappings we are technically changing the host<->guest ABI. This would also happen any time we defined new mappings for QEMU keycodes in future. When a keycode is removed from the list of possible keycodes that host can send to the guest, it means that the guest OS will think it is possible to receive a key that in pratice can never be generated, which is harmless. When a keycode is added to the list of possible keycodes that the host can send to the guest, it means that the guest OS can see an unexpected event. The Linux virtio_input.c driver code simply forwards this event to the input_event() method in the Linux input subsystem. This in turn calls input_handle_event(), which then calls input_get_disposition(). This method checks if the input event is present in the permitted keys bitmap, and if not returns INPUT_IGNORE_EVENT. Thus the unexpected event will get dropped, which is harmless. If the guest OS reboots, or otherwise re-initializes the virt-input device, it will read the new keycode bitmap. No matter how many keys are defined, the config space has a fixed 128 byte bitmap. There is, however, a size field defiend which says how many bytes in the bitmap are used. So the guest OS reads the size of the bitmap, and then it reads the data from bitmap upto the designated size. So if the guest OS re-initializes at precisely the time that QEMU is migrated across versions, in the worst case, it could conceivably read the old size field, but then get the newly updated bitmap. If a key were added this is harmless, since it simply means it may not process the newly added key. If a key were removed, then it could be readnig a byte from the bitmap that was not initialized. Fortunately QEMU always memsets() the entire bitmap to 0, prior to setting keybits. Thus the guest OS will simply read zeros, which is again harmless. Based on this analysis, it is believed that there is no need to preserve the virtio-input-hid keymaps across migration, as the host<->guest ABI change is harmless and self-resolving at time of guest reboot. NB, this behaviour should perhaps be formalized in the virtio-input spec to declare how guest OS drivers should be written to be robust in their handling of the potentially changable key bitmaps. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Message-id: 20180117164118.8510-5-berrange@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* input: virtio: don't send mouse wheel event twiceMiika S2018-01-291-2/+4
| | | | | | | | | | | | | On Linux, a mouse event is generated for both down and up when mouse wheel is used. This caused virtio_input_send() to be called twice each time the wheel was used. This commit adds a check for the button down state and only calls virtio_input_send() when it is true. Signed-off-by: Miika S <miika9764@gmail.com> Message-Id: <20171222152531.1849-4-miika9764@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* input: add mouse side buttons to virtio inputMiika S2018-01-291-0/+2
| | | | | | Signed-off-by: Miika S <miika9764@gmail.com> Message-Id: <20171222152531.1849-3-miika9764@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: send rel-wheel events for wheel buttonsGerd Hoffmann2017-09-291-5/+114
| | | | | | | | | | | | | | | qemu uses wheel-up/down button events for mouse wheel input, however linux applications typically want REL_WHEEL events. This fixes wheel with linux guests. Tested with X11/wayland, and windows virtio-input driver. Based on a patch from Marc. Added property to enable/disable wheel axis. Cc: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170926113243.26081-1-kraxel@redhat.com
* qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)Markus Armbruster2017-09-041-2/+2
| | | | | | Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <1503564371-26090-14-git-send-email-armbru@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* ui: Support non-zero minimum values for absolute input axesPhilippe Voinov2017-05-111-2/+4
| | | | | | | | | | This patch refactors ui/input.c to support absolute axis minimum values other than 0. All dependent calls to qemu_input_queue_abs have been updated to explicitly supply 0 as the axis minimum value. Signed-off-by: Philippe Voinov <philippevoinov@gmail.com> Message-id: 20170505133952.29885-1-philippevoinov@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: fix emulated tablet axis rangesLadi Prosek2016-04-131-2/+2
| | | | | | | | | The reported maximum was wrong. The X and Y coordinates are 0-based so if size is 8000 maximum must be 7FFF. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1460128893-10244-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: add missing key mappingsLadi Prosek2016-04-131-0/+2
| | | | | | | | | | | | KEY_PAUSE is flat out missing. KEY_SYSRQ already has a keycode assigned but it's not what I'm seeing on my system. The mapping doesn't appear to have to be unique so both keycodes now map to KEY_SYSRQ which is what the "Keyboard PrintScreen", HID usage ID 0x46, translates to. Signed-off-by: Ladi Prosek <lprosek@redhat.com> Message-id: 1459343240-19483-1-git-send-email-lprosek@redhat.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* qapi: Don't special-case simple union wrappersEric Blake2016-03-181-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Simple unions were carrying a special case that hid their 'data' QMP member from the resulting C struct, via the hack method QAPISchemaObjectTypeVariant.simple_union_type(). But by using the work we started by unboxing flat union and alternate branches, coupled with the ability to visit the members of an implicit type, we can now expose the simple union's implicit type in qapi-types.h: | struct q_obj_ImageInfoSpecificQCow2_wrapper { | ImageInfoSpecificQCow2 *data; | }; | | struct q_obj_ImageInfoSpecificVmdk_wrapper { | ImageInfoSpecificVmdk *data; | }; ... | struct ImageInfoSpecific { | ImageInfoSpecificKind type; | union { /* union tag is @type */ | void *data; |- ImageInfoSpecificQCow2 *qcow2; |- ImageInfoSpecificVmdk *vmdk; |+ q_obj_ImageInfoSpecificQCow2_wrapper qcow2; |+ q_obj_ImageInfoSpecificVmdk_wrapper vmdk; | } u; | }; Doing this removes asymmetry between QAPI's QMP side and its C side (both sides now expose 'data'), and means that the treatment of a simple union as sugar for a flat union is now equivalent in both languages (previously the two approaches used a different layer of dereferencing, where the simple union could be converted to a flat union with equivalent C layout but different {} on the wire, or to an equivalent QMP wire form but with different C representation). Using the implicit type also lets us get rid of the simple_union_type() hack. Of course, now all clients of simple unions have to adjust from using su->u.member to using su->u.member.data; while this touches a number of files in the tree, some earlier cleanup patches helped minimize the change to the initialization of a temporary variable rather than every single member access. The generated qapi-visit.c code is also affected by the layout change: |@@ -7393,10 +7393,10 @@ void visit_type_ImageInfoSpecific_member | } | switch (obj->type) { | case IMAGE_INFO_SPECIFIC_KIND_QCOW2: |- visit_type_ImageInfoSpecificQCow2(v, "data", &obj->u.qcow2, &err); |+ visit_type_q_obj_ImageInfoSpecificQCow2_wrapper_members(v, &obj->u.qcow2, &err); | break; | case IMAGE_INFO_SPECIFIC_KIND_VMDK: |- visit_type_ImageInfoSpecificVmdk(v, "data", &obj->u.vmdk, &err); |+ visit_type_q_obj_ImageInfoSpecificVmdk_wrapper_members(v, &obj->u.vmdk, &err); | break; | default: | abort(); Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1458254921-17042-13-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* ui: Shorten references into InputEventEric Blake2016-03-051-13/+20
| | | | | | | | | | | | | | | | | | | An upcoming patch will alter how simple unions, like InputEvent, are laid out, which will impact all lines of the form 'evt->u.XXX' (expanding it to the longer 'evt->u.XXX.data'). For better legibility in that patch, and less need for line wrapping, it's better to use a temporary variable to reduce the effect of a layout change to just the variable initializations, rather than every reference within an InputEvent. There was one instance in hid.c:hid_pointer_event() where the code was referring to evt->u.rel inside the case label where evt->u.abs is the correct name; thankfully, both members of the union have the same type, so it happened to work, but it is now cleaner. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1457021813-10704-8-git-send-email-eblake@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
* qapi: rename input buttonsGerd Hoffmann2016-03-011-2/+2
| | | | | | | | | All lowercase, use-dash instead of CamelCase. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel P. Berrange <berrange@redhat.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com>
* virtio: Clean up includesPeter Maydell2016-01-291-0/+1
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-15-git-send-email-peter.maydell@linaro.org
* qapi: Change munging of CamelCase enum valuesEric Blake2015-12-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When munging enum values, the fact that we were passing the entire prefix + value through camel_to_upper() meant that enum values spelled with CamelCase could be turned into CAMEL_CASE. However, this provides a potential collision (both OneTwo and One-Two would munge into ONE_TWO) for enum types, when the same two names are valid side-by-side as QAPI member names. By changing the generation of enum constants to always be prefix + '_' + c_name(value, False).upper(), and ensuring that there are no case collisions (in the next patches), we no longer have to worry about names that would be distinct as QAPI members but collide as variant tag names, without having to think about what munging the heuristics in camel_to_upper() will actually perform on an enum value. Making the change will affect enums that did not follow coding conventions, using 'CamelCase' rather than desired 'lower-case'. Thankfully, there are only two culprits: InputButton and ErrorClass. We already tweaked ErrorClass to make it an alias of QapiErrorClass, where only the alias needs changing rather than the whole tree. So the bulk of this change is modifying INPUT_BUTTON_WHEEL_UP to the new INPUT_BUTTON_WHEELUP (and likewise for WHEELDOWN). That part of this commit may later need reverting if we rename the enum constants from 'WheelUp' to 'wheel-up' as part of moving x-input-send-event to a stable interface; but at least we have documentation bread crumbs in place to remind us (commit 513e7cd), and it matches the fact that SDL constants are also spelled SDL_BUTTON_WHEELUP. Suggested by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1447836791-369-27-git-send-email-eblake@redhat.com> [Commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* qapi: Don't let implicit enum MAX member collideEric Blake2015-12-171-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we guarantee the user doesn't have any enum values beginning with a single underscore, we can use that for our own purposes. Renaming ENUM_MAX to ENUM__MAX makes it obvious that the sentinel is generated. This patch was mostly generated by applying a temporary patch: |diff --git a/scripts/qapi.py b/scripts/qapi.py |index e6d014b..b862ec9 100644 |--- a/scripts/qapi.py |+++ b/scripts/qapi.py |@@ -1570,6 +1570,7 @@ const char *const %(c_name)s_lookup[] = { | max_index = c_enum_const(name, 'MAX', prefix) | ret += mcgen(''' | [%(max_index)s] = NULL, |+// %(max_index)s | }; | ''', | max_index=max_index) then running: $ cat qapi-{types,event}.c tests/test-qapi-types.c | sed -n 's,^// \(.*\)MAX,s|\1MAX|\1_MAX|g,p' > list $ git grep -l _MAX | xargs sed -i -f list The only things not generated are the changes in scripts/qapi.py. Rejecting enum members named 'MAX' is now useless, and will be dropped in the next patch. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1447836791-369-23-git-send-email-eblake@redhat.com> Reviewed-by: Juan Quintela <quintela@redhat.com> [Rebased to current master, commit message tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* input: Convert to new qapi union layoutEric Blake2015-11-021-13/+14
| | | | | | | | | | | | | | | | | We have two issues with our qapi union layout: 1) Even though the QMP wire format spells the tag 'type', the C code spells it 'kind', requiring some hacks in the generator. 2) The C struct uses an anonymous union, which places all tag values in the same namespace as all non-variant members. This leads to spurious collisions if a tag value matches a non-variant member's name. Make the conversion to the new layout for input-related code. Signed-off-by: Eric Blake <eblake@redhat.com> Message-Id: <1445898903-12082-20-git-send-email-eblake@redhat.com> [Commit message tweaked slightly] Signed-off-by: Markus Armbruster <armbru@redhat.com>
* virtio-input: fix segfault in virtio_input_hid_propertiesLin Ma2015-07-161-0/+1
| | | | | | | commit 5cce173 introduced virtio-input segfault, This patch fixes it. Signed-off-by: Lin Ma <lma@suse.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: add input routing supportGerd Hoffmann2015-07-031-0/+11
| | | | | | | Add display and head properties for input routing to virtio-input devices, update multiseat documentation. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* virtio-input: emulated devices [device]Gerd Hoffmann2015-05-291-0/+502
This patch adds the virtio-input-hid base class and virtio-{keyboard,mouse,tablet} subclasses building on the base class. They are hooked up to the qemu input core and deliver input events to the guest like all other hid devices (ps/2 kbd, usb tablet, ...). Using them is as simple as adding "-device virtio-tablet-device" to your command line, for use all transports except pci. virtio-pci support comes as separate patch, once virtio-pci got virtio 1.0 support. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>