[Qemu-devel] [GIT PULL 00/15] Stable branch update 2009-06-17

[Qemu-devel] [GIT PULL 00/15] Stable branch update 2009-06-17

[Glauber Costa]

Hi,

I've updated my repository at:

    git://git.kernel.org/pub/scm/virt/qemu/glommer/qemu-stable.git


The branch stable-0.10 contains proposed updates for the official stable
branch. Patches marked with "BACKPORT" are not clean cherry-picks, and as such,
should be reviewed with more care. The patches included are:


Andrea Arcangeli (1):
      fix qemu_aio_flush

Blue Swirl (2):
      BACKPORT: Register reset functions for e1000 and rtl8139
      BACKPORT: Update irqs on reset and device load

Christoph Hellwig (1):
      fix raw_pread_aligned return value

Eduardo Habkost (1):
      Fix vga_screen_dump_blank() PPM generation

Gleb Natapov (3):
      Minimal ethernet frame length is 64 bytes.
      Don't send all gratuitous packets at once.
      BACKPORT: Add rtc reset function.

Jan Kiszka (1):
      kvm: Fix IRQ injection into full queue

Jason Wessel (1):
      serial: fix lost character after sysrq

Kevin Wolf (1):
      e1000: Ignore reset command

Mark McLoughlin (1):
      Prevent CD-ROM media eject while device is locked

Nitin A Kamble (1):
      QEMU KVM: i386: Fix the cpu reset state

Stefan Weil (1):
      VNC: Fix memory allocation (wrong structure size).

aliguori (1):
      net: Fix -net socket,listen (Jan Kiszka)

diffstat is:
=======================
 aio.c                |    8 ++++++--
 block.c              |    9 ++++++++-
 block.h              |    2 +-
 hw/e1000.c           |   31 +++++++++++++++++++++++--------
 hw/hw.h              |    1 -
 hw/ide.c             |   26 ++++++++++++++++++--------
 hw/mc146818rtc.c     |   23 +++++++++++++++++++++++
 hw/rtl8139.c         |    6 +++++-
 hw/vga.c             |    5 +++--
 kvm-all.c            |    3 +--
 migration-exec.c     |   33 +++++++++++----------------------
 qemu-aio.h           |    7 ++++---
 savevm.c             |   12 +-----------
 target-i386/helper.c |   18 ++++++++++++------
 14 files changed, 116 insertions(+), 68 deletions(-)

[Qemu-devel] [PATCH 01/15] net: Fix -net socket, listen (Jan Kiszka)

[Glauber Costa]

From: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>

In case no symbolic name is provided when requesting VLAN connection via
listening TCP socket ('-net socket,listen=...'), qemu crashes. This
fixes the cause.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@7196 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 net.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net.c b/net.c
index ae54421..3938a02 100644
--- a/net.c
+++ b/net.c
@@ -1468,7 +1468,7 @@ static int net_socket_listen_init(VLANState *vlan,
     }
     s->vlan = vlan;
     s->model = strdup(model);
-    s->name = strdup(name);
+    s->name = name ? strdup(name) : NULL;
     s->fd = fd;
     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
     return 0;
-- 
1.6.2.2

[Qemu-devel] [PATCH 02/15] Minimal ethernet frame length is 64 bytes.

[Glauber Costa]

From: Gleb Natapov <gleb@redhat.com>

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 savevm.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/savevm.c b/savevm.c
index cd83350..5d3b142 100644
--- a/savevm.c
+++ b/savevm.c
@@ -103,12 +103,13 @@ static int announce_self_create(uint8_t *buf,
 
     /* FIXME: should we send a different packet (arp/rarp/ping)? */
 
+    memset(buf, 0, 64);
     memset(buf, 0xff, 6);         /* h_dst */
     memcpy(buf + 6, mac_addr, 6); /* h_src */
     memcpy(buf + 12, &proto, 2);  /* h_proto */
     memcpy(buf + 14, &magic, 4);  /* magic */
 
-    return 18; /* len */
+    return 64; /* len */
 }
 
 void qemu_announce_self(void)
-- 
1.6.2.2

[Qemu-devel] [PATCH 03/15] Don't send all gratuitous packets at once.

[Glauber Costa]

From: Gleb Natapov <gleb@redhat.com>

Use timer to separate them in time.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 savevm.c |   24 +++++++++++++++++++-----
 1 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/savevm.c b/savevm.c
index 5d3b142..e69f421 100644
--- a/savevm.c
+++ b/savevm.c
@@ -112,23 +112,37 @@ static int announce_self_create(uint8_t *buf,
     return 64; /* len */
 }
 
-void qemu_announce_self(void)
+static void qemu_announce_self_once(void *opaque)
 {
-    int i, j, len;
+    int i, len;
     VLANState *vlan;
     VLANClientState *vc;
     uint8_t buf[256];
+    static int count = SELF_ANNOUNCE_ROUNDS;
+    QEMUTimer *timer = *(QEMUTimer **)opaque;
 
     for (i = 0; i < MAX_NICS; i++) {
         if (!nd_table[i].used)
             continue;
         len = announce_self_create(buf, nd_table[i].macaddr);
         vlan = nd_table[i].vlan;
-        for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
-            for (j=0; j < SELF_ANNOUNCE_ROUNDS; j++)
-                vc->fd_read(vc->opaque, buf, len);
+	for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
+            vc->fd_read(vc->opaque, buf, len);
         }
     }
+    if (count--) {
+	    qemu_mod_timer(timer, qemu_get_clock(rt_clock) + 100);
+    } else {
+	    qemu_del_timer(timer);
+	    qemu_free_timer(timer);
+    }
+}
+
+void qemu_announce_self(void)
+{
+	static QEMUTimer *timer;
+	timer = qemu_new_timer(rt_clock, qemu_announce_self_once, &timer);
+	qemu_announce_self_once(&timer);
 }
 
 /***********************************************************/
-- 
1.6.2.2

[Qemu-devel] [PATCH 04/15] serial: fix lost character after sysrq

[Glauber Costa]

From: Jason Wessel <jason.wessel@windriver.com>

After creating an automated regression test to test the sysrq
responses while running a linux image in qemu, I found that the
simulated uart was eating the character right after the sysrq about
75% of the time.

The problem is that the qemu sets the LSR_DR (data ready) bit on a
serial break.  The automated tests can send a break and the sysrq
character quickly enough that the qemu serial fifo has a real
character available. When there is valid character in the fifo, it
gets consumed by the serial driver in the guest OS.

The real hardware also appears to set the LSR_DR but always appears to
have a null byte in this condition.  This patch changes the qemu
behavior to match the tested characteristics of a real 16550 chip.

Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/serial.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/hw/serial.c b/hw/serial.c
index ac089fc..113829c 100644
--- a/hw/serial.c
+++ b/hw/serial.c
@@ -586,6 +586,8 @@ static int serial_can_receive(SerialState *s)
 static void serial_receive_break(SerialState *s)
 {
     s->rbr = 0;
+    /* When the LSR_DR is set a null byte is pushed into the fifo */
+    fifo_put(s, RECV_FIFO, '\0');
     s->lsr |= UART_LSR_BI | UART_LSR_DR;
     serial_update_irq(s);
 }
-- 
1.6.2.2

[Qemu-devel] [PATCH 05/15] e1000: Ignore reset command

[Glauber Costa]

From: Kevin Wolf <mail@kevin-wolf.de>

When a reset is requested, the current e1000 emulation never clears the
reset bit which may cause a driver to hang. This patch masks the reset
bit out when setting the control registert, so the reset is immediately
completed.

Signed-off-by: Kevin Wolf <mail@kevin-wolf.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/e1000.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/e1000.c b/hw/e1000.c
index 940e893..8c1741f 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -190,6 +190,13 @@ rxbufsize(uint32_t v)
 }
 
 static void
+set_ctrl(E1000State *s, int index, uint32_t val)
+{
+    /* RST is self clearing */
+    s->mac_reg[CTRL] = val & ~E1000_CTRL_RST;
+}
+
+static void
 set_rx_control(E1000State *s, int index, uint32_t val)
 {
     s->mac_reg[RCTL] = val;
@@ -783,12 +790,12 @@ enum { NREADOPS = ARRAY_SIZE(macreg_readops) };
 static void (*macreg_writeops[])(E1000State *, int, uint32_t) = {
     putreg(PBA),	putreg(EERD),	putreg(SWSM),	putreg(WUFC),
     putreg(TDBAL),	putreg(TDBAH),	putreg(TXDCTL),	putreg(RDBAH),
-    putreg(RDBAL),	putreg(LEDCTL), putreg(CTRL),	putreg(VET),
+    putreg(RDBAL),	putreg(LEDCTL), putreg(VET),
     [TDLEN] = set_dlen,	[RDLEN] = set_dlen,	[TCTL] = set_tctl,
     [TDT] = set_tctl,	[MDIC] = set_mdic,	[ICS] = set_ics,
     [TDH] = set_16bit,	[RDH] = set_16bit,	[RDT] = set_rdt,
     [IMC] = set_imc,	[IMS] = set_ims,	[ICR] = set_icr,
-    [EECD] = set_eecd,	[RCTL] = set_rx_control,
+    [EECD] = set_eecd,	[RCTL] = set_rx_control, [CTRL] = set_ctrl,
     [RA ... RA+31] = &mac_writereg,
     [MTA ... MTA+127] = &mac_writereg,
     [VFTA ... VFTA+127] = &mac_writereg,
-- 
1.6.2.2

[Qemu-devel] [PATCH 06/15] VNC: Fix memory allocation (wrong structure size).

[Glauber Costa]

From: Stefan Weil <weil@mail.berlios.de>

Pointer vs addresses a VncDisplay structure,
so it is sufficient to allocate sizeof(VncDisplay)
or sizeof(*vs) bytes instead of the much larger
sizeof(VncState).

Maybe the misleading name should be fixed, too:
the code contains many places where vs is used,
sometimes it is a VncState *, sometimes it is a
VncDisplay *. vd would be a better name.

Signed-off-by: Stefan Weil <weil@mail.berlios.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 vnc.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/vnc.c b/vnc.c
index 783df80..1d8ebe7 100644
--- a/vnc.c
+++ b/vnc.c
@@ -2306,9 +2306,8 @@ static void vnc_listen_read(void *opaque)
 
 void vnc_display_init(DisplayState *ds)
 {
-    VncDisplay *vs;
+    VncDisplay *vs = qemu_mallocz(sizeof(*vs));
 
-    vs = qemu_mallocz(sizeof(VncState));
     dcl = qemu_mallocz(sizeof(DisplayChangeListener));
 
     ds->opaque = vs;
-- 
1.6.2.2

[Qemu-devel] [PATCH 07/15] fix raw_pread_aligned return value

[Glauber Costa]

From: Christoph Hellwig <hch@lst.de>

raw_pread_aligned currently returns the raw return value from
lseek/read, which is always -1 in case of an error.  But the
callers higher up the stack expect it to return the negated
errno just like raw_pwrite_aligned.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 block-raw-posix.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/block-raw-posix.c b/block-raw-posix.c
index 85ca704..af3d468 100644
--- a/block-raw-posix.c
+++ b/block-raw-posix.c
@@ -234,7 +234,7 @@ static int raw_pread_aligned(BlockDriverState *bs, int64_t offset,
 
 label__raw_read__success:
 
-    return ret;
+    return  (ret < 0) ? -errno : ret;
 }
 
 /*
-- 
1.6.2.2

[Qemu-devel] [PATCH 08/15] BACKPORT: Register reset functions for e1000 and rtl8139

[Glauber Costa]

From: Blue Swirl <blauwirbel@gmail.com>

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/e1000.c   |   21 ++++++++++++++-------
 hw/rtl8139.c |    4 +++-
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/hw/e1000.c b/hw/e1000.c
index 8c1741f..ba766e0 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -1058,6 +1058,18 @@ pci_e1000_uninit(PCIDevice *dev)
     return 0;
 }
 
+static void e1000_reset(void *opaque)
+{
+    E1000State *d = opaque;
+
+    memset(d->phy_reg, 0, sizeof d->phy_reg);
+    memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
+    memset(d->mac_reg, 0, sizeof d->mac_reg);
+    memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
+    d->rxbuf_min_shift = 1;
+    memset(&d->tx, 0, sizeof d->tx);
+}
+
 PCIDevice *
 pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
 {
@@ -1103,13 +1115,6 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
     checksum = (uint16_t) EEPROM_SUM - checksum;
     d->eeprom_data[EEPROM_CHECKSUM_REG] = checksum;
 
-    memset(d->phy_reg, 0, sizeof d->phy_reg);
-    memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
-    memset(d->mac_reg, 0, sizeof d->mac_reg);
-    memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
-    d->rxbuf_min_shift = 1;
-    memset(&d->tx, 0, sizeof d->tx);
-
     d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
                                  e1000_receive, e1000_can_receive,
                                  e1000_cleanup, d);
@@ -1119,6 +1124,8 @@ pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn)
 
     register_savevm(info_str, -1, 2, nic_save, nic_load, d);
     d->dev.unregister = pci_e1000_uninit;
+    qemu_register_reset(e1000_reset, d);
+    e1000_reset(d);
 
     return (PCIDevice *)d;
 }
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index 19c7623..42899a5 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -1170,8 +1170,9 @@ static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
     s->RxBufAddr = 0;
 }
 
-static void rtl8139_reset(RTL8139State *s)
+static void rtl8139_reset(void *opaque)
 {
+    RTL8139State *s = opaque;
     int i;
 
     /* restore MAC address */
@@ -3480,6 +3481,7 @@ PCIDevice *pci_rtl8139_init(PCIBus *bus, NICInfo *nd, int devfn)
 
     s->pci_dev = (PCIDevice *)d;
     memcpy(s->macaddr, nd->macaddr, 6);
+    qemu_register_reset(rtl8139_reset, s);
     rtl8139_reset(s);
     s->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name,
                                  rtl8139_receive, rtl8139_can_receive,
-- 
1.6.2.2

[Qemu-devel] [PATCH 09/15] BACKPORT: Update irqs on reset and device load

[Glauber Costa]

From: Blue Swirl <blauwirbel@gmail.com>

Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/e1000.c   |   10 +++++++++-
 hw/rtl8139.c |    2 ++
 2 files changed, 11 insertions(+), 1 deletions(-)

diff --git a/hw/e1000.c b/hw/e1000.c
index ba766e0..b1cf2b0 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -150,12 +150,18 @@ ioport_map(PCIDevice *pci_dev, int region_num, uint32_t addr,
 }
 
 static void
+update_irqs(E1000State *s)
+{
+    qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
+}
+
+static void
 set_interrupt_cause(E1000State *s, int index, uint32_t val)
 {
     if (val)
         val |= E1000_ICR_INT_ASSERTED;
     s->mac_reg[ICR] = val;
-    qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
+    update_irqs(s);
 }
 
 static void
@@ -970,6 +976,7 @@ nic_load(QEMUFile *f, void *opaque, int version_id)
         for (j = 0; j < mac_regarraystosave[i].size; j++)
             qemu_get_be32s(f,
                            s->mac_reg + mac_regarraystosave[i].array0 + j);
+    update_irqs(s);
     return 0;
 }
 
@@ -1068,6 +1075,7 @@ static void e1000_reset(void *opaque)
     memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
     d->rxbuf_min_shift = 1;
     memset(&d->tx, 0, sizeof d->tx);
+    update_irqs(d);
 }
 
 PCIDevice *
diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index 42899a5..c2f2921 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -3314,6 +3314,8 @@ static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
         s->cplus_enabled = s->CpCmd != 0;
     }
 
+    rtl8139_update_irq(s);
+
     return 0;
 }
 
-- 
1.6.2.2

[Qemu-devel] [PATCH 10/15] BACKPORT: Add rtc reset function.

[Glauber Costa]

From: Gleb Natapov <gleb@redhat.com>

On reset:
Periodic Interrupt Enable (PIE) bit is cleared to zero
Alarm Interrupt Enable (AIE) bit is cleared to zero
Update ended Interrupt Flag (UF) bit is cleared to zero
Interrupt Request status Flag (IRQF) bit is cleared to zero
Periodic Interrupt Flag (PF) bit is cleared to zero
Alarm Interrupt Flag (AF) bit is cleared to zero
Square Wave output Enable (SQWE) zero

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/mc146818rtc.c |   23 +++++++++++++++++++++++
 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c
index 5b08d72..30a74ee 100644
--- a/hw/mc146818rtc.c
+++ b/hw/mc146818rtc.c
@@ -56,6 +56,11 @@
 #define REG_B_UIE 0x10
 #define REG_B_DM  0x04
 
+#define REG_C_UF   0x10
+#define REG_C_IRQF 0x80
+#define REG_C_PF   0x40
+#define REG_C_AF   0x20
+
 struct RTCState {
     uint8_t cmos_data[128];
     uint8_t cmos_index;
@@ -527,6 +532,21 @@ static int rtc_load_td(QEMUFile *f, void *opaque, int version_id)
 }
 #endif
 
+static void rtc_reset(void *opaque)
+{
+    RTCState *s = opaque;
+
+    s->cmos_data[RTC_REG_B] &= ~(REG_B_PIE | REG_B_AIE);
+    s->cmos_data[RTC_REG_C] &= ~(REG_C_UF | REG_C_IRQF | REG_C_PF | REG_C_AF);
+
+    qemu_irq_lower(s->irq);
+
+#ifdef TARGET_I386
+    if (rtc_td_hack)
+	    s->irq_coalesced = 0;
+#endif
+}
+
 RTCState *rtc_init(int base, qemu_irq irq, int base_year)
 {
     RTCState *s;
@@ -560,6 +580,8 @@ RTCState *rtc_init(int base, qemu_irq irq, int base_year)
     if (rtc_td_hack)
         register_savevm("mc146818rtc-td", base, 1, rtc_save_td, rtc_load_td, s);
 #endif
+    qemu_register_reset(rtc_reset, s);
+
     return s;
 }
 
@@ -670,5 +692,6 @@ RTCState *rtc_mm_init(target_phys_addr_t base, int it_shift, qemu_irq irq,
     if (rtc_td_hack)
         register_savevm("mc146818rtc-td", base, 1, rtc_save_td, rtc_load_td, s);
 #endif
+    qemu_register_reset(rtc_reset, s);
     return s;
 }
-- 
1.6.2.2

[Qemu-devel] [PATCH 11/15] fix qemu_aio_flush

[Glauber Costa]

From: Andrea Arcangeli <aarcange@redhat.com>

qemu_aio_wait by invoking the bh or one of the aio completion
callbacks, could end up submitting new pending aio, breaking the
invariant that qemu_aio_flush returns only when no pending aio is
outstanding (possibly a problem for migration as such).

Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Kevin Wolf <kwolf@redhat.com>

Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 aio.c      |    8 ++++++--
 qemu-aio.h |    7 ++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/aio.c b/aio.c
index 11fbb6c..dc9b85d 100644
--- a/aio.c
+++ b/aio.c
@@ -103,11 +103,15 @@ void qemu_aio_flush(void)
     do {
         ret = 0;
 
+	/*
+	 * If there are pending emulated aio start them now so flush
+	 * will be able to return 1.
+	 */
+        qemu_aio_wait();
+
         LIST_FOREACH(node, &aio_handlers, node) {
             ret |= node->io_flush(node->opaque);
         }
-
-        qemu_aio_wait();
     } while (ret > 0);
 }
 
diff --git a/qemu-aio.h b/qemu-aio.h
index 7967829..f262344 100644
--- a/qemu-aio.h
+++ b/qemu-aio.h
@@ -24,9 +24,10 @@ typedef int (AioFlushHandler)(void *opaque);
  * outstanding AIO operations have been completed or cancelled. */
 void qemu_aio_flush(void);
 
-/* Wait for a single AIO completion to occur.  This function will until a
- * single AIO opeartion has completed.  It is intended to be used as a looping
- * primative when simulating synchronous IO based on asynchronous IO. */
+/* Wait for a single AIO completion to occur.  This function will wait
+ * until a single AIO event has completed and it will ensure something
+ * has moved before returning. This can issue new pending aio as
+ * result of executing I/O completion or bh callbacks. */
 void qemu_aio_wait(void);
 
 /* Register a file descriptor and associated callbacks.  Behaves very similarly
-- 
1.6.2.2

[Qemu-devel] [PATCH 12/15] QEMU KVM: i386: Fix the cpu reset state

[Glauber Costa]

From: Nitin A Kamble <nitin.a.kamble@intel.com>

As per the IA32 processor manual, the accessed bit is set to 1 in the
processor state after reset. qemu pc cpu_reset code was missing this
accessed bit setting.

Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 target-i386/helper.c |   18 ++++++++++++------
 1 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/target-i386/helper.c b/target-i386/helper.c
index e714994..981ee1f 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -494,17 +494,23 @@ void cpu_reset(CPUX86State *env)
     env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);
 
     cpu_x86_load_seg_cache(env, R_CS, 0xf000, 0xffff0000, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK | DESC_R_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
+                           DESC_R_MASK | DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
+                           DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
+                           DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
+                           DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
+                           DESC_A_MASK);
     cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffff,
-                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK);
+                           DESC_P_MASK | DESC_S_MASK | DESC_W_MASK |
+                           DESC_A_MASK);
 
     env->eip = 0xfff0;
     env->regs[R_EDX] = env->cpuid_version;
-- 
1.6.2.2

[Qemu-devel] [PATCH 13/15] kvm: Fix IRQ injection into full queue

[Glauber Costa]

From: Jan Kiszka <jan.kiszka@web.de>

User space may only inject interrupts during kvm_arch_pre_run if
ready_for_interrupt_injection is set in kvm_run. But that field is
updated on exit from KVM_RUN, so we must ensure that we enter the
kernel after potentially queuing an interrupt, otherwise we risk to
loose one - like it happens with the current code against latest
kernel modules (since kvm-86) that started to queue only a single
interrupt.

Fix the problem by reordering kvm_cpu_exec.

Credits go to Gleb Natapov for analyzing the issue in details.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 kvm-all.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/kvm-all.c b/kvm-all.c
index 541b200..8e72c6d 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -451,14 +451,13 @@ int kvm_cpu_exec(CPUState *env)
     dprintf("kvm_cpu_exec()\n");
 
     do {
-        kvm_arch_pre_run(env, run);
-
         if (env->exit_request) {
             dprintf("interrupt exit requested\n");
             ret = 0;
             break;
         }
 
+        kvm_arch_pre_run(env, run);
         ret = kvm_vcpu_ioctl(env, KVM_RUN, 0);
         kvm_arch_post_run(env, run);
 
-- 
1.6.2.2

[Qemu-devel] [PATCH 14/15] Prevent CD-ROM media eject while device is locked

[Glauber Costa]

From: Mark McLoughlin <markmc@redhat.com>

Section 10.8.25 ("START/STOP UNIT Command") of SFF-8020i states that
if the device is locked we should refuse to eject if the device is
locked.

ASC_MEDIA_REMOVAL_PREVENTED is the appropriate return in this case.

In order to stop itself from ejecting the media it is running from,
Fedora's installer (anaconda) requires the CDROMEJECT ioctl() to fail
if the drive has been previously locked.

See also https://bugzilla.redhat.com/501412

Signed-off-by: Mark McLoughlin <markmc@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 block.c  |    9 ++++++++-
 block.h  |    2 +-
 hw/ide.c |   26 ++++++++++++++++++--------
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/block.c b/block.c
index b68a8da..e5cd23d 100644
--- a/block.c
+++ b/block.c
@@ -1664,11 +1664,15 @@ int bdrv_media_changed(BlockDriverState *bs)
 /**
  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
  */
-void bdrv_eject(BlockDriverState *bs, int eject_flag)
+int bdrv_eject(BlockDriverState *bs, int eject_flag)
 {
     BlockDriver *drv = bs->drv;
     int ret;
 
+    if (bs->locked) {
+        return -EBUSY;
+    }
+
     if (!drv || !drv->bdrv_eject) {
         ret = -ENOTSUP;
     } else {
@@ -1677,7 +1681,10 @@ void bdrv_eject(BlockDriverState *bs, int eject_flag)
     if (ret == -ENOTSUP) {
         if (eject_flag)
             bdrv_close(bs);
+        ret = 0;
     }
+
+    return ret;
 }
 
 int bdrv_is_locked(BlockDriverState *bs)
diff --git a/block.h b/block.h
index 979781a..e1070e9 100644
--- a/block.h
+++ b/block.h
@@ -132,7 +132,7 @@ int bdrv_is_inserted(BlockDriverState *bs);
 int bdrv_media_changed(BlockDriverState *bs);
 int bdrv_is_locked(BlockDriverState *bs);
 void bdrv_set_locked(BlockDriverState *bs, int locked);
-void bdrv_eject(BlockDriverState *bs, int eject_flag);
+int bdrv_eject(BlockDriverState *bs, int eject_flag);
 void bdrv_set_change_cb(BlockDriverState *bs,
                         void (*change_cb)(void *opaque), void *opaque);
 void bdrv_get_format(BlockDriverState *bs, char *buf, int buf_size);
diff --git a/hw/ide.c b/hw/ide.c
index 6ad1d08..9b93e7f 100644
--- a/hw/ide.c
+++ b/hw/ide.c
@@ -359,6 +359,7 @@
 #define ASC_INCOMPATIBLE_FORMAT              0x30
 #define ASC_MEDIUM_NOT_PRESENT               0x3a
 #define ASC_SAVING_PARAMETERS_NOT_SUPPORTED  0x39
+#define ASC_MEDIA_REMOVAL_PREVENTED          0x53
 
 #define CFA_NO_ERROR            0x00
 #define CFA_MISC_ERROR          0x09
@@ -1818,18 +1819,27 @@ static void ide_atapi_cmd(IDEState *s)
         break;
     case GPCMD_START_STOP_UNIT:
         {
-            int start, eject;
+            int start, eject, err = 0;
             start = packet[4] & 1;
             eject = (packet[4] >> 1) & 1;
 
-            if (eject && !start) {
-                /* eject the disk */
-                bdrv_eject(s->bs, 1);
-            } else if (eject && start) {
-                /* close the tray */
-                bdrv_eject(s->bs, 0);
+            if (eject) {
+                err = bdrv_eject(s->bs, !start);
+            }
+
+            switch (err) {
+            case 0:
+                ide_atapi_cmd_ok(s);
+                break;
+            case -EBUSY:
+                ide_atapi_cmd_error(s, SENSE_NOT_READY,
+                                    ASC_MEDIA_REMOVAL_PREVENTED);
+                break;
+            default:
+                ide_atapi_cmd_error(s, SENSE_NOT_READY,
+                                    ASC_MEDIUM_NOT_PRESENT);
+                break;
             }
-            ide_atapi_cmd_ok(s);
         }
         break;
     case GPCMD_MECHANISM_STATUS:
-- 
1.6.2.2

[Qemu-devel] [PATCH 15/15] Fix vga_screen_dump_blank() PPM generation

[Glauber Costa]

From: Eduardo Habkost <ehabkost@redhat.com>

vga_screen_dump_blank() was not generating a valid PPM file: the width of the
image made no sense (why it was multiplied by sizeof(uint32_t)?), and there was
only one sample per pixel, instead of three.

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Glauber Costa <glommer@redhat.com>
---
 hw/vga.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/vga.c b/hw/vga.c
index 709d6bb..00a7ae5 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -2606,8 +2606,9 @@ static void vga_screen_dump_blank(VGAState *s, const char *filename)
 {
     FILE *f;
     unsigned int y, x, w, h;
+    unsigned char blank_sample[3] = { 0, 0, 0 };
 
-    w = s->last_scr_width * sizeof(uint32_t);
+    w = s->last_scr_width;
     h = s->last_scr_height;
 
     f = fopen(filename, "wb");
@@ -2616,7 +2617,7 @@ static void vga_screen_dump_blank(VGAState *s, const char *filename)
     fprintf(f, "P6\n%d %d\n%d\n", w, h, 255);
     for (y = 0; y < h; y++) {
         for (x = 0; x < w; x++) {
-            fputc(0, f);
+            fwrite(blank_sample, 3, 1, f);
         }
     }
     fclose(f);
-- 
1.6.2.2

[Qemu-devel] Re: [PATCH 09/15] BACKPORT: Update irqs on reset and device load

[Blue Swirl]

On 6/17/09, Glauber Costa <glommer@redhat.com> wrote:
> From: Blue Swirl <blauwirbel@gmail.com>
>

Please don't apply, I just reverted this from dev tree.

[Qemu-devel] Re: [PATCH 09/15] BACKPORT: Update irqs on reset and device load

[Glauber Costa]

On Wed, Jun 17, 2009 at 08:12:10PM +0300, Blue Swirl wrote:
> On 6/17/09, Glauber Costa <glommer@redhat.com> wrote:
> > From: Blue Swirl <blauwirbel@gmail.com>
> >
> 
> Please don't apply, I just reverted this from dev tree.
okay, will revert it from my tree too.

Re: [Qemu-devel] [GIT PULL 00/15] Stable branch update 2009-06-17

[Anthony Liguori]

Glauber Costa wrote:
> Hi,
>
> I've updated my repository at:
>
>     git://git.kernel.org/pub/scm/virt/qemu/glommer/qemu-stable.git
>
>   

I already have a lot of this in my queue.  I've started publishing this 
now at http://repo.or.cz/w/qemu/aliguori-queue.git

I've got most of your proposed changes there already.

However, your pull request is odd.  The head of stable-0.10 is:

commit 75204ffc5b401a0df1cd611f8c98224c4fd21960
Author: Jason Wessel <jason.wessel@windriver.com>
Date:   Mon May 18 10:00:27 2009 -0500

    serial: fix lost character after sysrq
   
Which you have listed below?

Best thing to do is wait for me to push things to the stable tree then 
requesting patches I may have missed.  Stable requires more testing so 
it sometimes lag master by a day or so.

Also note, I've started using -x with cherry pick..

Regards,

Anthony Liguori