Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* More KVM LAPIC fixes
* fix divide-by-zero regression on libiscsi SG devices
* fix qemu-char segfault
* add scripts/show-fixed-bugs.sh

# gpg: Signature made Thu 22 Sep 2016 19:20:57 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  kvm: fix events.flags (KVM_VCPUEVENT_VALID_SMM) overwritten by 0
  scripts: Add a script to check for bug URLs in the git log
  msmouse: Fix segfault caused by free the chr before chardev cleanup.
  iscsi: Fix divide-by-zero regression on raw SG devices
  kvm: apic: set APIC base as part of kvm_apic_put
  target-i386: introduce kvm_put_one_msr

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

6 files changed, 123 insertions, 16 deletions

diff --git a/backends/msmouse.c b/backends/msmouse.c
index aceb6dc475..85d08f753e 100644
--- a/backends/msmouse.c
+++ b/backends/msmouse.c
@@ -139,7 +139,6 @@ static void msmouse_chr_close (struct CharDriverState *chr)
 
     qemu_input_handler_unregister(mouse->hs);
     g_free(mouse);
-    g_free(chr);
 }
 
 static QemuInputHandler msmouse_handler = {
diff --git a/block/iscsi.c b/block/iscsi.c
index c4a0937419..8a940317d6 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1813,19 +1813,22 @@ static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
 
     IscsiLun *iscsilun = bs->opaque;
     uint64_t max_xfer_len = iscsilun->use_16_for_rw ? 0xffffffff : 0xffff;
+    unsigned int block_size = MAX(BDRV_SECTOR_SIZE, iscsilun->block_size);
 
-    bs->bl.request_alignment = iscsilun->block_size;
+    assert(iscsilun->block_size >= BDRV_SECTOR_SIZE || bs->sg);
+
+    bs->bl.request_alignment = block_size;
 
     if (iscsilun->bl.max_xfer_len) {
         max_xfer_len = MIN(max_xfer_len, iscsilun->bl.max_xfer_len);
     }
 
-    if (max_xfer_len * iscsilun->block_size < INT_MAX) {
+    if (max_xfer_len * block_size < INT_MAX) {
         bs->bl.max_transfer = max_xfer_len * iscsilun->block_size;
     }
 
     if (iscsilun->lbp.lbpu) {
-        if (iscsilun->bl.max_unmap < 0xffffffff / iscsilun->block_size) {
+        if (iscsilun->bl.max_unmap < 0xffffffff / block_size) {
             bs->bl.max_pdiscard =
                 iscsilun->bl.max_unmap * iscsilun->block_size;
         }
@@ -1835,7 +1838,7 @@ static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
         bs->bl.pdiscard_alignment = iscsilun->block_size;
     }
 
-    if (iscsilun->bl.max_ws_len < 0xffffffff / iscsilun->block_size) {
+    if (iscsilun->bl.max_ws_len < 0xffffffff / block_size) {
         bs->bl.max_pwrite_zeroes =
             iscsilun->bl.max_ws_len * iscsilun->block_size;
     }
@@ -1846,7 +1849,7 @@ static void iscsi_refresh_limits(BlockDriverState *bs, Error **errp)
         bs->bl.pwrite_zeroes_alignment = iscsilun->block_size;
     }
     if (iscsilun->bl.opt_xfer_len &&
-        iscsilun->bl.opt_xfer_len < INT_MAX / iscsilun->block_size) {
+        iscsilun->bl.opt_xfer_len < INT_MAX / block_size) {
         bs->bl.opt_transfer = pow2floor(iscsilun->bl.opt_xfer_len *
                                         iscsilun->block_size);
     }
diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index feb00024f2..f57fed1cb0 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -15,6 +15,7 @@
 #include "hw/i386/apic_internal.h"
 #include "hw/pci/msi.h"
 #include "sysemu/kvm.h"
+#include "target-i386/kvm_i386.h"
 
 static inline void kvm_apic_set_reg(struct kvm_lapic_state *kapic,
                                     int reg_id, uint32_t val)
@@ -130,6 +131,7 @@ static void kvm_apic_put(void *data)
     struct kvm_lapic_state kapic;
     int ret;
 
+    kvm_put_apicbase(s->cpu, s->apicbase);
     kvm_put_apic_state(s, &kapic);
 
     ret = kvm_vcpu_ioctl(CPU(s->cpu), KVM_SET_LAPIC, &kapic);
diff --git a/scripts/show-fixed-bugs.sh b/scripts/show-fixed-bugs.sh
new file mode 100755
index 0000000000..36f306898f
--- /dev/null
+++ b/scripts/show-fixed-bugs.sh
@@ -0,0 +1,91 @@
+#!/bin/sh
+
+# This script checks the git log for URLs to the QEMU launchpad bugtracker
+# and optionally checks whether the corresponding bugs are not closed yet.
+
+show_help () {
+    echo "Usage:"
+    echo "  -s <commit>  : Start searching at this commit"
+    echo "  -e <commit>  : End searching at this commit"
+    echo "  -c           : Check if bugs are still open"
+    echo "  -b           : Open bugs in browser"
+}
+
+while getopts "s:e:cbh" opt; do
+   case "$opt" in
+    s)  start="$OPTARG" ;;
+    e)  end="$OPTARG" ;;
+    c)  check_if_open=1 ;;
+    b)  show_in_browser=1 ;;
+    h)  show_help ; exit 0 ;;
+    *)   echo "Use -h for help." ; exit 1 ;;
+   esac
+done
+
+if [ "x$start" = "x" ]; then
+    start=`git tag -l 'v[0-9]*\.[0-9]*\.0' | tail -n 2 | head -n 1`
+fi
+if [ "x$end" = "x" ]; then
+    end=`git tag -l  'v[0-9]*\.[0-9]*\.0' | tail -n 1`
+fi
+
+if [ "x$start" = "x" ] || [ "x$end" = "x" ]; then
+    echo "Could not determine start or end revision ... Please note that this"
+    echo "script must be run from a checked out git repository of QEMU."
+    exit 1
+fi
+
+echo "Searching git log for bugs in the range $start..$end"
+
+urlstr='https://bugs.launchpad.net/\(bugs\|qemu/+bug\)/'
+bug_urls=`git log $start..$end \
+  | sed -n '\,'"$urlstr"', s,\(.*\)\('"$urlstr"'\)\([0-9]*\).*,\2\4,p' \
+  | sort -u`
+
+echo Found bug URLs:
+for i in $bug_urls ; do echo " $i" ; done
+
+if [ "x$check_if_open" = "x1" ]; then
+    echo
+    echo "Checking which ones are still open..."
+    for i in $bug_urls ; do
+        if ! curl -s -L "$i" | grep "value status" | grep -q "Fix Released" ; then
+            echo " $i"
+            final_bug_urls="$final_bug_urls $i"
+        fi
+    done
+else
+    final_bug_urls=$bug_urls
+fi
+
+if [ "x$final_bug_urls" = "x" ]; then
+    echo "No open bugs found."
+elif [ "x$show_in_browser" = "x1" ]; then
+    # Try to determine which browser we should use
+    if [ "x$BROWSER" != "x" ]; then
+        bugbrowser="$BROWSER"
+    elif command -v xdg-open >/dev/null 2>&1; then
+        bugbrowser=xdg-open
+    elif command -v gnome-open >/dev/null 2>&1; then
+        bugbrowser=gnome-open
+    elif [ "`uname`" = "Darwin" ]; then
+        bugbrowser=open
+    elif command -v sensible-browser >/dev/null 2>&1; then
+        bugbrowser=sensible-browser
+    else
+        echo "Please set the BROWSER variable to the browser of your choice."
+        exit 1
+    fi
+    # Now show the bugs in the browser
+    first=1
+    for i in $final_bug_urls; do
+        "$bugbrowser" "$i"
+        if [ $first = 1 ]; then
+            # if it is the first entry, give the browser some time to start
+            # (to avoid messages like "Firefox is already running, but is
+            # not responding...")
+            sleep 4
+            first=0
+        fi
+    done
+fi
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index f1ad805665..a0e42b2c4e 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1532,6 +1532,22 @@ static void kvm_msr_entry_add(X86CPU *cpu, uint32_t index, uint64_t value)
     msrs->nmsrs++;
 }
 
+static int kvm_put_one_msr(X86CPU *cpu, int index, uint64_t value)
+{
+    kvm_msr_buf_reset(cpu);
+    kvm_msr_entry_add(cpu, index, value);
+
+    return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
+}
+
+void kvm_put_apicbase(X86CPU *cpu, uint64_t value)
+{
+    int ret;
+
+    ret = kvm_put_one_msr(cpu, MSR_IA32_APICBASE, value);
+    assert(ret == 1);
+}
+
 static int kvm_put_tscdeadline_msr(X86CPU *cpu)
 {
     CPUX86State *env = &cpu->env;
@@ -1541,10 +1557,7 @@ static int kvm_put_tscdeadline_msr(X86CPU *cpu)
         return 0;
     }
 
-    kvm_msr_buf_reset(cpu);
-    kvm_msr_entry_add(cpu, MSR_IA32_TSCDEADLINE, env->tsc_deadline);
-
-    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
+    ret = kvm_put_one_msr(cpu, MSR_IA32_TSCDEADLINE, env->tsc_deadline);
     if (ret < 0) {
         return ret;
     }
@@ -1567,11 +1580,8 @@ static int kvm_put_msr_feature_control(X86CPU *cpu)
         return 0;
     }
 
-    kvm_msr_buf_reset(cpu);
-    kvm_msr_entry_add(cpu, MSR_IA32_FEATURE_CONTROL,
-                      cpu->env.msr_ia32_feature_control);
-
-    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
+    ret = kvm_put_one_msr(cpu, MSR_IA32_FEATURE_CONTROL,
+                          cpu->env.msr_ia32_feature_control);
     if (ret < 0) {
         return ret;
     }
@@ -2442,6 +2452,7 @@ static int kvm_put_vcpu_events(X86CPU *cpu, int level)
     events.nmi.pad = 0;
 
     events.sipi_vector = env->sipi_vector;
+    events.flags = 0;
 
     if (has_msr_smbase) {
         events.smi.smm = !!(env->hflags & HF_SMM_MASK);
@@ -2461,7 +2472,6 @@ static int kvm_put_vcpu_events(X86CPU *cpu, int level)
         events.flags |= KVM_VCPUEVENT_VALID_SMM;
     }
 
-    events.flags = 0;
     if (level >= KVM_PUT_RESET_STATE) {
         events.flags |=
             KVM_VCPUEVENT_VALID_NMI_PENDING | KVM_VCPUEVENT_VALID_SIPI_VECTOR;
diff --git a/target-i386/kvm_i386.h b/target-i386/kvm_i386.h
index 42b00af1b1..36407e0a5d 100644
--- a/target-i386/kvm_i386.h
+++ b/target-i386/kvm_i386.h
@@ -41,4 +41,6 @@ int kvm_device_msix_set_vector(KVMState *s, uint32_t dev_id, uint32_t vector,
 int kvm_device_msix_assign(KVMState *s, uint32_t dev_id);
 int kvm_device_msix_deassign(KVMState *s, uint32_t dev_id);
 
+void kvm_put_apicbase(X86CPU *cpu, uint64_t value);
+
 #endif