[Spice-commits] 174 commits - MAINTAINERS Makefile Makefile.objs Makefile.target QMP/qom-fuse VERSION async.c balloon.c block.c block/nbd.c block/qcow2-cluster.c block/qcow2-snapshot.c block/qcow2.c block/raw-posix.c block/rbd.c block/stream.c block_int.h blockdev.c configure cpu-all.h cputlb.c cputlb.h darwin-user/commpage.c darwin-user/ioctls.h darwin-user/ioctls_types.h darwin-user/machload.c darwin-user/main.c darwin-user/mmap.c darwin-user/qemu.h darwin-user/signal.c darwin-user/syscall.c darwin-user/syscalls.h default-configs/i386-darwin-user.mak default-configs/ppc-darwin-user.mak docs/specs exec-all.h exec.c fpu/softfloat-macros.h fpu/softfloat.c fpu/softfloat.h hmp-commands.hx hmp.c hw/e1000.c hw/e1000_hw.h hw/eepro100.c hw/fdc.c hw/hda-audio.c hw/highbank.c hw/i82374.c hw/i82378.c hw/ide hw/isa.h hw/pc_sysfw.c hw/ppc_prep.c hw/ppce500_spin.c hw/prep_pci.c hw/s390-virtio-bus.c hw/s390-virtio-bus.h hw/s390-virtio.c hw/spapr.c hw/spapr_hcall.c hw/spapr_llan.c hw/spapr_pci.c h w/spapr_pci.h hw/spapr_vio.c hw/spapr_vio.h hw/spapr_vscsi.c hw/spapr_vty.c hw/usb hw/vga.c hw/virtio-serial-bus.c hw/virtio.c iohandler.c main-loop.c main-loop.h memory.h net/slirp.c os-posix.c osdep.h pc-bios/README pc-bios/openbios-ppc pc-bios/openbios-sparc32 pc-bios/openbios-sparc64 pc-bios/qemu-icon.bmp qapi-schema-guest.json qapi-schema.json qapi/qmp-core.h qapi/qmp-registry.c qemu-barrier.h qemu-doc.texi qemu-ga.c qemu-tech.texi qemu-timer.c qemu-timer.h qemu-tool.c qga/channel-posix.c qga/commands-posix.c qga/guest-agent-core.h qmp-commands.hx rules.mak scripts/tracetool scripts/tracetool.py slirp/libslirp.h slirp/slirp.c target-arm/cpu-qom.h target-arm/cpu.c target-arm/cpu.h target-arm/helper.c target-arm/translate.c target-i386/cpu.c target-i386/cpu.h target-i386/helper.c target-m68k/cpu-qom.h target-m68k/cpu.c target-m68k/cpu.h target-m68k/helper.c target-mips/cpu-qom.h target-mips/cpu.c target-mips/cpu.h target-mips/translate.c target-ppc/helper.c target-ppc/tra nslate_init.c target-s390x/kvm.c target-sh4/cpu-qom.h target-sh4/cpu.c target-sh4/cpu.h target-sh4/translate.c tests/libqtest.c tests/qemu-iotests thunk.h

Gerd Hoffmann kraxel at kemper.freedesktop.org
Thu May 3 01:48:14 PDT 2012


 MAINTAINERS                           |   52 -
 Makefile                              |    9 
 Makefile.objs                         |   22 
 Makefile.target                       |   45 
 QMP/qom-fuse                          |  138 ++
 VERSION                               |    2 
 async.c                               |    8 
 balloon.c                             |    2 
 block.c                               |   35 
 block/nbd.c                           |    2 
 block/qcow2-cluster.c                 |   25 
 block/qcow2-snapshot.c                |    2 
 block/qcow2.c                         |    3 
 block/raw-posix.c                     |    8 
 block/rbd.c                           |   89 +
 block/stream.c                        |   22 
 block_int.h                           |   19 
 blockdev.c                            |   26 
 configure                             |   70 -
 cpu-all.h                             |    2 
 cputlb.c                              |  364 +++++++
 cputlb.h                              |   45 
 darwin-user/commpage.c                |  357 -------
 darwin-user/ioctls.h                  |    4 
 darwin-user/ioctls_types.h            |    1 
 darwin-user/machload.c                |  902 -------------------
 darwin-user/main.c                    | 1027 ----------------------
 darwin-user/mmap.c                    |  409 --------
 darwin-user/qemu.h                    |  178 ---
 darwin-user/signal.c                  |  452 ---------
 darwin-user/syscall.c                 | 1566 ----------------------------------
 darwin-user/syscalls.h                |  384 --------
 default-configs/i386-darwin-user.mak  |    1 
 default-configs/ppc-darwin-user.mak   |    3 
 docs/specs/qcow2.txt                  |    2 
 exec-all.h                            |   12 
 exec.c                                |  455 +--------
 fpu/softfloat-macros.h                |   18 
 fpu/softfloat.c                       |  122 +-
 fpu/softfloat.h                       |   13 
 hmp-commands.hx                       |    8 
 hmp.c                                 |    4 
 hw/e1000.c                            |  167 ++-
 hw/e1000_hw.h                         |   12 
 hw/eepro100.c                         |   28 
 hw/fdc.c                              |   17 
 hw/hda-audio.c                        |  243 ++++-
 hw/highbank.c                         |   15 
 hw/i82374.c                           |    5 
 hw/i82378.c                           |    5 
 hw/ide/core.c                         |    7 
 hw/isa.h                              |    5 
 hw/pc_sysfw.c                         |    8 
 hw/ppc_prep.c                         |   40 
 hw/ppce500_spin.c                     |    3 
 hw/prep_pci.c                         |   17 
 hw/s390-virtio-bus.c                  |   26 
 hw/s390-virtio-bus.h                  |    4 
 hw/s390-virtio.c                      |   17 
 hw/spapr.c                            |    7 
 hw/spapr_hcall.c                      |    2 
 hw/spapr_llan.c                       |    5 
 hw/spapr_pci.c                        |   49 -
 hw/spapr_pci.h                        |    5 
 hw/spapr_vio.c                        |   54 -
 hw/spapr_vio.h                        |   13 
 hw/spapr_vscsi.c                      |    5 
 hw/spapr_vty.c                        |    5 
 hw/usb/core.c                         |    1 
 hw/usb/desc.c                         |   32 
 hw/usb/desc.h                         |    1 
 hw/usb/dev-audio.c                    |    1 
 hw/usb/dev-bluetooth.c                |    1 
 hw/usb/dev-hub.c                      |    1 
 hw/usb/dev-network.c                  |    1 
 hw/usb/dev-serial.c                   |    1 
 hw/usb/dev-smartcard-reader.c         |    1 
 hw/usb/dev-storage.c                  |    6 
 hw/usb/dev-wacom.c                    |    1 
 hw/usb/hcd-ehci.c                     |   23 
 hw/usb/hcd-uhci.c                     |    1 
 hw/usb/hcd-xhci.c                     |  192 ++--
 hw/usb/host-linux.c                   |   12 
 hw/usb/redirect.c                     |    9 
 hw/vga.c                              |    4 
 hw/virtio-serial-bus.c                |   57 +
 hw/virtio.c                           |   11 
 iohandler.c                           |    4 
 main-loop.c                           |   32 
 main-loop.h                           |    2 
 memory.h                              |   29 
 net/slirp.c                           |    3 
 os-posix.c                            |    4 
 osdep.h                               |    7 
 pc-bios/README                        |    2 
 pc-bios/openbios-ppc                  |binary
 pc-bios/openbios-sparc32              |binary
 pc-bios/openbios-sparc64              |binary
 pc-bios/qemu-icon.bmp                 |binary
 qapi-schema-guest.json                |   25 
 qapi-schema.json                      |   12 
 qapi/qmp-core.h                       |    1 
 qapi/qmp-registry.c                   |   14 
 qemu-barrier.h                        |   35 
 qemu-doc.texi                         |   90 -
 qemu-ga.c                             |  334 ++++++-
 qemu-tech.texi                        |    3 
 qemu-timer.c                          |  127 +-
 qemu-timer.h                          |   14 
 qemu-tool.c                           |    4 
 qga/channel-posix.c                   |   18 
 qga/commands-posix.c                  |  170 +--
 qga/guest-agent-core.h                |    3 
 qmp-commands.hx                       |    4 
 rules.mak                             |    3 
 scripts/tracetool.py                  |    4 
 scripts/tracetool/__init__.py         |   19 
 scripts/tracetool/backend/__init__.py |    8 
 scripts/tracetool/format/__init__.py  |    8 
 slirp/libslirp.h                      |    1 
 slirp/slirp.c                         |    7 
 target-arm/cpu-qom.h                  |    2 
 target-arm/cpu.c                      |    6 
 target-arm/cpu.h                      |    7 
 target-arm/helper.c                   |    4 
 target-arm/translate.c                |    8 
 target-i386/cpu.c                     |  318 ++++++
 target-i386/cpu.h                     |    2 
 target-i386/helper.c                  |    2 
 target-m68k/cpu-qom.h                 |   70 +
 target-m68k/cpu.c                     |  170 +++
 target-m68k/cpu.h                     |    3 
 target-m68k/helper.c                  |  165 +--
 target-mips/cpu-qom.h                 |   74 +
 target-mips/cpu.c                     |   69 +
 target-mips/cpu.h                     |    9 
 target-mips/translate.c               |    5 
 target-ppc/helper.c                   |   50 +
 target-ppc/translate_init.c           |   26 
 target-s390x/kvm.c                    |   15 
 target-sh4/cpu-qom.h                  |   70 +
 target-sh4/cpu.c                      |   90 +
 target-sh4/cpu.h                      |    2 
 target-sh4/translate.c                |   28 
 tests/libqtest.c                      |    7 
 tests/qemu-iotests/030                |   85 +
 tests/qemu-iotests/030.out            |    4 
 tests/qemu-iotests/035                |   72 +
 tests/qemu-iotests/035.out            |  392 ++++++++
 tests/qemu-iotests/common.rc          |    1 
 tests/qemu-iotests/group              |    1 
 thunk.h                               |    2 
 152 files changed, 3872 insertions(+), 6902 deletions(-)

New commits:
commit 58a331bab950e9a12da8b17b57e11927893eaf5e
Merge: 9bf6b71... d5b406d...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed May 2 14:49:53 2012 -0500

    Merge remote-tracking branch 'kwolf/for-anthony' into staging
    
    * kwolf/for-anthony:
      ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop
      rbd: add discard support
      qcow2: fix the return value -ENOENT -> -EEXIST
      qcow2: Don't hold cache references across yield
      qcow2: Remove unused parameter in do_alloc_cluster_offset
      qemu-iotests: Many parallel allocating I/O requests
      docs: fix one issue in qcow2 specs
      block/qcow2: Add missing GCC_FMT_ATTR to function report_unsupported()
      qemu-iotests: ignore fragmentation information for qed

commit d5b406d95b4259baf622f73e1ffad6ee144633b8
Author: Alexander Graf <agraf at suse.de>
Date:   Thu Apr 26 12:45:07 2012 +0200

    ATA: Allow WIN_SECURITY_FREEZE_LOCK as nop
    
    When using Windows 8 with an AHCI disk drive, it issues a blue screen.
    The reason is that WIN_SECURITY_FREEZE_LOCK / CFA_WEAR_LEVEL is not
    supported by our ATA implementation, but Windows expects it to be there.
    
    Since without security stuff implemented, the lock would be a nop anyway
    and CFA_WEAR_LEVEL already is treated as a nop, let's just allow the cmd
    for HD drives as well. That way Windows is happy.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/hw/ide/core.c b/hw/ide/core.c
index a5216a6..9785d5f 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1035,7 +1035,7 @@ static const uint8_t ide_cmd_table[0x100] = {
     [WIN_IDENTIFY]                      = ALL_OK,
     [WIN_SETFEATURES]                   = ALL_OK,
     [IBM_SENSE_CONDITION]               = CFA_OK,
-    [CFA_WEAR_LEVEL]                    = CFA_OK,
+    [CFA_WEAR_LEVEL]                    = HD_CFA_OK,
     [WIN_READ_NATIVE_MAX]               = ALL_OK,
 };
 
@@ -1350,6 +1350,11 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         break;
     case CFA_ERASE_SECTORS:
     case CFA_WEAR_LEVEL:
+#if 0
+    /* This one has the same ID as CFA_WEAR_LEVEL and is required for
+       Windows 8 to work with AHCI */
+    case WIN_SECURITY_FREEZE_LOCK:
+#endif
         if (val == CFA_WEAR_LEVEL)
             s->nsector = 0;
         if (val == CFA_ERASE_SECTORS)
commit 787f31330eb51ef7621d7c316b90262c7bb5d6d3
Author: Josh Durgin <josh.durgin at dreamhost.com>
Date:   Mon Apr 30 23:16:45 2012 -0700

    rbd: add discard support
    
    Change the write flag to an operation type in RBDAIOCB, and make the
    buffer optional since discard doesn't use it.
    
    Discard is first included in librbd 0.1.2 (which is in Ceph 0.46).
    If librbd is too old, leave out qemu_rbd_aio_discard entirely,
    so the old behavior is preserved.
    
    Signed-off-by: Josh Durgin <josh.durgin at dreamhost.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/rbd.c b/block/rbd.c
index 6cd8448..1280d66 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -44,6 +44,13 @@
  * leading "\".
  */
 
+/* rbd_aio_discard added in 0.1.2 */
+#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 2)
+#define LIBRBD_SUPPORTS_DISCARD
+#else
+#undef LIBRBD_SUPPORTS_DISCARD
+#endif
+
 #define OBJ_MAX_SIZE (1UL << OBJ_DEFAULT_OBJ_ORDER)
 
 #define RBD_MAX_CONF_NAME_SIZE 128
@@ -53,13 +60,19 @@
 #define RBD_MAX_SNAP_NAME_SIZE 128
 #define RBD_MAX_SNAPS 100
 
+typedef enum {
+    RBD_AIO_READ,
+    RBD_AIO_WRITE,
+    RBD_AIO_DISCARD
+} RBDAIOCmd;
+
 typedef struct RBDAIOCB {
     BlockDriverAIOCB common;
     QEMUBH *bh;
     int ret;
     QEMUIOVector *qiov;
     char *bounce;
-    int write;
+    RBDAIOCmd cmd;
     int64_t sector_num;
     int error;
     struct BDRVRBDState *s;
@@ -371,7 +384,8 @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
 
     r = rcb->ret;
 
-    if (acb->write) {
+    if (acb->cmd == RBD_AIO_WRITE ||
+        acb->cmd == RBD_AIO_DISCARD) {
         if (r < 0) {
             acb->ret = r;
             acb->error = 1;
@@ -605,7 +619,7 @@ static void rbd_aio_bh_cb(void *opaque)
 {
     RBDAIOCB *acb = opaque;
 
-    if (!acb->write) {
+    if (acb->cmd == RBD_AIO_READ) {
         qemu_iovec_from_buffer(acb->qiov, acb->bounce, acb->qiov->size);
     }
     qemu_vfree(acb->bounce);
@@ -616,12 +630,25 @@ static void rbd_aio_bh_cb(void *opaque)
     qemu_aio_release(acb);
 }
 
-static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,
-                                           int64_t sector_num,
-                                           QEMUIOVector *qiov,
-                                           int nb_sectors,
-                                           BlockDriverCompletionFunc *cb,
-                                           void *opaque, int write)
+static int rbd_aio_discard_wrapper(rbd_image_t image,
+                                   uint64_t off,
+                                   uint64_t len,
+                                   rbd_completion_t comp)
+{
+#ifdef LIBRBD_SUPPORTS_DISCARD
+    return rbd_aio_discard(image, off, len, comp);
+#else
+    return -ENOTSUP;
+#endif
+}
+
+static BlockDriverAIOCB *rbd_start_aio(BlockDriverState *bs,
+                                       int64_t sector_num,
+                                       QEMUIOVector *qiov,
+                                       int nb_sectors,
+                                       BlockDriverCompletionFunc *cb,
+                                       void *opaque,
+                                       RBDAIOCmd cmd)
 {
     RBDAIOCB *acb;
     RADOSCB *rcb;
@@ -633,16 +660,20 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,
     BDRVRBDState *s = bs->opaque;
 
     acb = qemu_aio_get(&rbd_aio_pool, bs, cb, opaque);
-    acb->write = write;
+    acb->cmd = cmd;
     acb->qiov = qiov;
-    acb->bounce = qemu_blockalign(bs, qiov->size);
+    if (cmd == RBD_AIO_DISCARD) {
+        acb->bounce = NULL;
+    } else {
+        acb->bounce = qemu_blockalign(bs, qiov->size);
+    }
     acb->ret = 0;
     acb->error = 0;
     acb->s = s;
     acb->cancelled = 0;
     acb->bh = NULL;
 
-    if (write) {
+    if (cmd == RBD_AIO_WRITE) {
         qemu_iovec_to_buffer(acb->qiov, acb->bounce);
     }
 
@@ -664,10 +695,18 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,
         goto failed;
     }
 
-    if (write) {
+    switch (cmd) {
+    case RBD_AIO_WRITE:
         r = rbd_aio_write(s->image, off, size, buf, c);
-    } else {
+        break;
+    case RBD_AIO_READ:
         r = rbd_aio_read(s->image, off, size, buf, c);
+        break;
+    case RBD_AIO_DISCARD:
+        r = rbd_aio_discard_wrapper(s->image, off, size, c);
+        break;
+    default:
+        r = -EINVAL;
     }
 
     if (r < 0) {
@@ -690,7 +729,8 @@ static BlockDriverAIOCB *qemu_rbd_aio_readv(BlockDriverState *bs,
                                             BlockDriverCompletionFunc *cb,
                                             void *opaque)
 {
-    return rbd_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
+    return rbd_start_aio(bs, sector_num, qiov, nb_sectors, cb, opaque,
+                         RBD_AIO_READ);
 }
 
 static BlockDriverAIOCB *qemu_rbd_aio_writev(BlockDriverState *bs,
@@ -700,7 +740,8 @@ static BlockDriverAIOCB *qemu_rbd_aio_writev(BlockDriverState *bs,
                                              BlockDriverCompletionFunc *cb,
                                              void *opaque)
 {
-    return rbd_aio_rw_vector(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
+    return rbd_start_aio(bs, sector_num, qiov, nb_sectors, cb, opaque,
+                         RBD_AIO_WRITE);
 }
 
 static int qemu_rbd_co_flush(BlockDriverState *bs)
@@ -850,6 +891,18 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
     return snap_count;
 }
 
+#ifdef LIBRBD_SUPPORTS_DISCARD
+static BlockDriverAIOCB* qemu_rbd_aio_discard(BlockDriverState *bs,
+                                              int64_t sector_num,
+                                              int nb_sectors,
+                                              BlockDriverCompletionFunc *cb,
+                                              void *opaque)
+{
+    return rbd_start_aio(bs, sector_num, NULL, nb_sectors, cb, opaque,
+                         RBD_AIO_DISCARD);
+}
+#endif
+
 static QEMUOptionParameter qemu_rbd_create_options[] = {
     {
      .name = BLOCK_OPT_SIZE,
@@ -880,6 +933,10 @@ static BlockDriver bdrv_rbd = {
     .bdrv_aio_writev        = qemu_rbd_aio_writev,
     .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
 
+#ifdef LIBRBD_SUPPORTS_DISCARD
+    .bdrv_aio_discard       = qemu_rbd_aio_discard,
+#endif
+
     .bdrv_snapshot_create   = qemu_rbd_snap_create,
     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
     .bdrv_snapshot_list     = qemu_rbd_snap_list,
commit 647cc472232608f268fe48da78bea81e6d01b1ea
Author: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
Date:   Thu Apr 26 16:11:37 2012 +0800

    qcow2: fix the return value -ENOENT -> -EEXIST
    
    Signed-off-by: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index 42f971b..4561a2a 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -331,7 +331,7 @@ int qcow2_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
 
     /* Check that the ID is unique */
     if (find_snapshot_by_id(bs, sn_info->id_str) >= 0) {
-        return -ENOENT;
+        return -EEXIST;
     }
 
     /* Populate sn with passed data */
commit 7242411460eb1cd6e850d51ef15ae734b59e2edf
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 24 16:10:56 2012 +0200

    qcow2: Don't hold cache references across yield
    
    If cache references are held while the coroutine has yielded, the cache
    may get used up and abort() when it can't find a free entry.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index 7edc043..353889d 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -853,6 +853,7 @@ int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
                                       n_start, n_end);
 
     /* Find L2 entry for the first involved cluster */
+again:
     ret = get_cluster_table(bs, offset, &l2_table, &l2_index);
     if (ret < 0) {
         return ret;
@@ -862,7 +863,6 @@ int qcow2_alloc_cluster_offset(BlockDriverState *bs, uint64_t offset,
      * Calculate the number of clusters to look for. We stop at L2 table
      * boundaries to keep things simple.
      */
-again:
     nb_clusters = MIN(size_to_clusters(s, n_end << BDRV_SECTOR_BITS),
                       s->l2_size - l2_index);
 
@@ -896,6 +896,18 @@ again:
 
     cluster_offset &= L2E_OFFSET_MASK;
 
+    /*
+     * The L2 table isn't used any more after this. As long as the cache works
+     * synchronously, it's important to release it before calling
+     * do_alloc_cluster_offset, which may yield if we need to wait for another
+     * request to complete. If we still had the reference, we could use up the
+     * whole cache with sleeping requests.
+     */
+    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
+    if (ret < 0) {
+        return ret;
+    }
+
     /* If there is something left to allocate, do that now */
     *m = (QCowL2Meta) {
         .cluster_offset     = cluster_offset,
@@ -947,11 +959,6 @@ again:
     }
 
     /* Some cleanup work */
-    ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-    if (ret < 0) {
-        goto fail_put;
-    }
-
     sectors = (keep_clusters + nb_clusters) << (s->cluster_bits - 9);
     if (sectors > n_end) {
         sectors = n_end;
@@ -963,8 +970,6 @@ again:
     return 0;
 
 fail:
-    qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);
-fail_put:
     if (m->nb_clusters > 0) {
         QLIST_REMOVE(m, next_in_flight);
     }
commit 60651f901ae5717ae1a7a30f32230c9b3fdbf60b
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 24 16:10:03 2012 +0200

    qcow2: Remove unused parameter in do_alloc_cluster_offset
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index a747a88..7edc043 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -759,7 +759,7 @@ out:
  * restarted, but the whole request should not be failed.
  */
 static int do_alloc_cluster_offset(BlockDriverState *bs, uint64_t guest_offset,
-    uint64_t *host_offset, unsigned int *nb_clusters, uint64_t *l2_table)
+    uint64_t *host_offset, unsigned int *nb_clusters)
 {
     BDRVQcowState *s = bs->opaque;
     int64_t cluster_offset;
@@ -919,7 +919,7 @@ again:
 
         /* Allocate, if necessary at a given offset in the image file */
         ret = do_alloc_cluster_offset(bs, alloc_offset, &alloc_cluster_offset,
-                                      &nb_clusters, l2_table);
+                                      &nb_clusters);
         if (ret == -EAGAIN) {
             goto again;
         } else if (ret < 0) {
commit dad5e5768e06ac7a22d0e7541ca8c6b6c42015a0
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 24 16:30:23 2012 +0200

    qemu-iotests: Many parallel allocating I/O requests
    
    This test case manages to let qcow2 abort because its cache is used up
    and it can't find free cache entries for new requests any more.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/035 b/tests/qemu-iotests/035
new file mode 100755
index 0000000..56616a1
--- /dev/null
+++ b/tests/qemu-iotests/035
@@ -0,0 +1,72 @@
+#!/bin/bash
+#
+# Let a few AIO requests run in parallel and have them access different L2
+# tables so that the cache has a chance to get used up.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# creator
+owner=kwolf at redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+
+_cleanup()
+{
+	_cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+
+_supported_fmt generic
+_supported_proto generic
+_supported_os Linux
+
+
+size=6G
+CLUSTER_SIZE=512
+
+echo
+echo "creating image"
+_make_test_img $size
+
+function generate_requests() {
+    for i in $(seq 0 63); do
+        echo "aio_write ${i}M 512"
+        echo "aio_write ${i}M 512"
+        echo "aio_write ${i}M 512"
+    done
+}
+
+generate_requests | $QEMU_IO $TEST_IMG | _filter_qemu_io |\
+	sed -e 's/bytes at offset [0-9]*/bytes at offset XXX/g'
+
+echo
+echo "checking image for errors"
+_check_test_img
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/035.out b/tests/qemu-iotests/035.out
new file mode 100644
index 0000000..de205f4
--- /dev/null
+++ b/tests/qemu-iotests/035.out
@@ -0,0 +1,392 @@
+QA output created by 035
+
+creating image
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 
+qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io>
  qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> qemu-io> wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 512/512 bytes at offset XXX
+512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+checking image for errors
+No errors were found on the image.
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index 5934829..36ebf1a 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -41,3 +41,4 @@
 032 rw auto
 033 rw auto
 034 rw auto backing
+035 rw auto quick
commit bf3f363a5b52e6f246bcab74dafffa61d6e4d2a7
Author: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
Date:   Tue Apr 24 15:11:27 2012 +0800

    docs: fix one issue in qcow2 specs
    
    Signed-off-by: Zhi Yong Wu <wuzhy at linux.vnet.ibm.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/docs/specs/qcow2.txt b/docs/specs/qcow2.txt
index 65e6325..87bf785 100644
--- a/docs/specs/qcow2.txt
+++ b/docs/specs/qcow2.txt
@@ -262,7 +262,7 @@ Standard Cluster Descriptor:
         56 - 61:    Reserved (set to 0)
 
 
-Compressed Clusters Descriptor (x = 62 - (cluster_size - 8)):
+Compressed Clusters Descriptor (x = 62 - (cluster_bits - 8)):
 
     Bit  0 -  x:    Host cluster offset. This is usually _not_ aligned to a
                     cluster boundary!
commit b9531b6eed93c9e1769d6f371c4da5d1f955e0d1
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Apr 23 22:54:38 2012 +0200

    block/qcow2: Add missing GCC_FMT_ATTR to function report_unsupported()
    
    Cc: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2.c b/block/qcow2.c
index ad46c03..8c60a6f 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -182,7 +182,8 @@ static void cleanup_unknown_header_ext(BlockDriverState *bs)
     }
 }
 
-static void report_unsupported(BlockDriverState *bs, const char *fmt, ...)
+static void GCC_FMT_ATTR(2, 3) report_unsupported(BlockDriverState *bs,
+    const char *fmt, ...)
 {
     char msg[64];
     va_list ap;
commit a5126c759d12afe3011eab74fef9cea19dbd729f
Author: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
Date:   Mon Apr 23 17:14:16 2012 +0800

    qemu-iotests: ignore fragmentation information for qed
    
    We added image fragmentation statistics functions to qemu-img several days
    ago, those patches will cause "./check -qed" failed. This patch will ignore
    fragmentation statistics information of qed format, and then "./check -qed"
    will work.
    
    Signed-off-by: Dong Xu Wang <wdongxu at linux.vnet.ibm.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index 4bc7420..e535874 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -130,6 +130,7 @@ _cleanup_test_img()
 _check_test_img()
 {
     $QEMU_IMG check -f $IMGFMT $TEST_IMG 2>&1 | \
+        grep -v "fragmented$" | \
     	sed -e 's/qemu-img\: This image format does not support checks/No errors were found on the image./'
 }
 
commit 9bf6b71a719f62af726d5a1fa4d705cfd5623f14
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed May 2 07:32:09 2012 -0500

    Update version for 1.1-rc0 release
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index 3e9c4a6..ac2282a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.50
+1.0.90
commit 563987d0a799f90b58a575b190a57546c335191b
Merge: 15a0f3b... 276eda5...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:48:01 2012 -0500

    Merge remote-tracking branch 'kiszka/queues/slirp' into staging
    
    * kiszka/queues/slirp:
      Declare state directory in smb.conf
      slirp: don't use "smb ports = 0" option

commit 15a0f3bf77cf60ae29484f0c0a26c679e4c688fd
Merge: 174210f... e120d44...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:46:52 2012 -0500

    Merge remote-tracking branch 'stefanha/tracing' into staging
    
    * stefanha/tracing:
      configure: check for supported Python 2.x versions
      tracetool: avoid pkgutil.iter_modules() Python 2.7 function
      tracetool: avoid str.rpartition() Python 2.5 function
      tracetool: use Python 2.4-compatible __import__() arguments
      tracetool: use Python 2.4-compatible exception handling syntax

commit 174210fe70d34a1ac70b98c1e4412934cbee2061
Merge: 725cbc6... 4170aea...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:46:39 2012 -0500

    Merge remote-tracking branch 'agraf/s390-for-upstream' into staging
    
    * agraf/s390-for-upstream:
      s390: reset avail and used index on reboot
      S390: dont call system_shutdown on disabled wait
      S390: remove default cdrom, sd-card and floppy support
      S390: support reboot for kvm on s390
      S390: reboot: reset device pages on reboot
      S390: fix error handling on kernel and initrd failures
      S390: fix kernel_commandline handling

commit 725cbc68d0430a8f999256342e300f4f960859cd
Merge: 6d051a0... c97feed...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:46:19 2012 -0500

    Merge remote-tracking branch 'stefanha/trivial-patches' into staging
    
    * stefanha/trivial-patches:
      iohandler: Use bool for boolean struct member and remove holes
      async: Use bool for boolean struct members and remove a hole
      configure: Fix creation of symbolic links for MinGW toolchain

commit 6d051a0c56fc8dd2101570225ce106a181d97449
Merge: 75e4e84... ddf1ddc...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:46:05 2012 -0500

    Merge remote-tracking branch 'agraf/ppc-for-upstream' into staging
    
    * agraf/ppc-for-upstream:
      linux-user: Fix invalid TARGET_ABI_BITS usage on ppc hosts
      target-ppc: Some support for dumping TLB_EMB TLBs
      ppce500_spin: Replace assert by hw_error (fixes compiler warning)
      pseries: Fix use of global CPU state
      pseries: Use the same interrupt swizzling for host bridges as p2p bridges
      pseries: Implement automatic PAPR VIO address allocation
      PPC: Fix up e500 cache size setting
      booke:Use MMU API for creating initial mapping for secondary cpus

commit 75e4e8475bd6ef2e57145f9d08b731f091a6c889
Merge: 6507470... f789aa7...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue May 1 18:44:03 2012 -0500

    Merge remote-tracking branch 'mdroth/qga-pull-4-27-12' into staging
    
    * mdroth/qga-pull-4-27-12:
      qemu-ga: persist tracking of fsfreeze state via filesystem
      qemu-ga: add a whitelist for fsfreeze-safe commands
      qemu-ga: improve recovery options for fsfreeze

commit 276eda5735824dd6cf66e1f0951aa8af97354540
Author: Nikolaus Rath <Nikolaus at rath.org>
Date:   Wed Apr 25 09:57:19 2012 -0400

    Declare state directory in smb.conf
    
    The smb.conf generated by the userspace networking does not include a state directory
    directive. Samba therefore falls back to the default value. Since the user generally
    does not have write access to this path, smbd immediately crashes.
    
    The "state directory" option was added in Samba 3.4.0 (commit
    http://gitweb.samba.org/?p=samba.git;a=commit;h=7b02e05eb64f3ffd7aa1cf027d10a7343c0da757).
    
    This patch adds the missing option.
    
    Signed-off-by: Nikolaus Rath <Nikolaus at rath.org>
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>

diff --git a/net/slirp.c b/net/slirp.c
index f49043b..96f5032 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -510,6 +510,7 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
             "socket address=127.0.0.1\n"
             "pid directory=%s\n"
             "lock directory=%s\n"
+            "state directory=%s\n"
             "log file=%s/log.smbd\n"
             "smb passwd file=%s/smbpasswd\n"
             "security = share\n"
@@ -522,6 +523,7 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
             s->smb_dir,
             s->smb_dir,
             s->smb_dir,
+            s->smb_dir,
             exported_dir
             );
     fclose(f);
commit de305b1387dad4473ae4cec48467d10d949e0f10
Author: Nikolaus Rath <Nikolaus at rath.org>
Date:   Wed Apr 25 18:51:27 2012 -0400

    slirp: don't use "smb ports = 0" option
    
    The "smb ports = 0" option causes recent samba versions to crash. It was
    introduced in commit 157777ef3e with log message "Samba 3 support".
    However, a value of 0 has never been officially supported by smb and is
    also not necessary: if stdin is a socket, smb does not try to listen on
    any ports and uses just stdin. This is necessary to support inetd based
    operation (otherwise smbd would always fail when called from inetd,
    because inetd already listens on the SMB port). Since samba has
    supported inetd operation since pre-3.x, it should be safe to rely on
    this feature. I have tested it with Samba 3.6.4 -- communication works
    fine, and smbd is not listening on any ports.
    
    I suspect the "smb ports = 0" hack may have been introduced when someone
    tested the qemu generated samba config from the command line with "smbd
    -i" and found it to fail (because then stdin isn't a socket).
    
    Signed-off-by: Nikolaus Rath <Nikolaus at rath.org>
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>

diff --git a/net/slirp.c b/net/slirp.c
index 18e07ba..f49043b 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -507,7 +507,6 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
     fprintf(f,
             "[global]\n"
             "private dir=%s\n"
-            "smb ports=0\n"
             "socket address=127.0.0.1\n"
             "pid directory=%s\n"
             "lock directory=%s\n"
commit ddf1ddcf65866e2dd8e5d515bc636617fb2e15ee
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Apr 30 22:58:55 2012 +0000

    linux-user: Fix invalid TARGET_ABI_BITS usage on ppc hosts
    
    When trying to evaluate the size of the _host_ type size for olddev_t,
    we need to expose the host's pointer size, not the guest pointer size.
    
    This usage got introduced accidently in commit b754e4fc1.
    
    Fix things by not using TARGET_.*, but rather use host sizeof()
    information, which gives us the correct size.
    
    Reported-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/thunk.h b/thunk.h
index c295766..87025c3 100644
--- a/thunk.h
+++ b/thunk.h
@@ -113,7 +113,7 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
       defined(HOST_PARISC) || defined(HOST_SPARC64)
             return 4;
 #elif defined(HOST_PPC)
-            return TARGET_ABI_BITS / 8;
+            return sizeof(void *);
 #else
             return 2;
 #endif
commit a738816212614e63aca04e75a22c753644d15f4e
Author: François Revol <revol at free.fr>
Date:   Tue Apr 24 06:48:34 2012 +0000

    target-ppc: Some support for dumping TLB_EMB TLBs
    
    Add mmubooke_dump_mmu().
    
    TODO: Add printing of individual flags.
    
    Signed-off-by: François Revol <revol at free.fr>
    [agraf: fix coding style]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/helper.c b/target-ppc/helper.c
index c610ce3..e97e496 100644
--- a/target-ppc/helper.c
+++ b/target-ppc/helper.c
@@ -1466,6 +1466,53 @@ static const char *book3e_tsize_to_str[32] = {
     "1T", "2T"
 };
 
+static void mmubooke_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
+                                 CPUPPCState *env)
+{
+    ppcemb_tlb_t *entry;
+    int i;
+
+    if (kvm_enabled() && !env->kvm_sw_tlb) {
+        cpu_fprintf(f, "Cannot access KVM TLB\n");
+        return;
+    }
+
+    cpu_fprintf(f, "\nTLB:\n");
+    cpu_fprintf(f, "Effective          Physical           Size PID   Prot     "
+                "Attr\n");
+
+    entry = &env->tlb.tlbe[0];
+    for (i = 0; i < env->nb_tlb; i++, entry++) {
+        target_phys_addr_t ea, pa;
+        target_ulong mask;
+        uint64_t size = (uint64_t)entry->size;
+        char size_buf[20];
+
+        /* Check valid flag */
+        if (!(entry->prot & PAGE_VALID)) {
+            continue;
+        }
+
+        mask = ~(entry->size - 1);
+        ea = entry->EPN & mask;
+        pa = entry->RPN & mask;
+#if (TARGET_PHYS_ADDR_BITS >= 36)
+        /* Extend the physical address to 36 bits */
+        pa |= (target_phys_addr_t)(entry->RPN & 0xF) << 32;
+#endif
+        size /= 1024;
+        if (size >= 1024) {
+            snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "M", size / 1024);
+        } else {
+            snprintf(size_buf, sizeof(size_buf), "%3" PRId64 "k", size);
+        }
+        cpu_fprintf(f, "0x%016" PRIx64 " 0x%016" PRIx64 " %s %-5u %08x %08x\n",
+                    (uint64_t)ea, (uint64_t)pa, size_buf, (uint32_t)entry->PID,
+                    entry->prot, entry->attr);
+    }
+
+}
+
 static void mmubooke206_dump_one_tlb(FILE *f, fprintf_function cpu_fprintf,
                                      CPUPPCState *env, int tlbn, int offset,
                                      int tlbsize)
@@ -1561,6 +1608,9 @@ static void mmubooks_dump_mmu(FILE *f, fprintf_function cpu_fprintf,
 void dump_mmu(FILE *f, fprintf_function cpu_fprintf, CPUPPCState *env)
 {
     switch (env->mmu_model) {
+    case POWERPC_MMU_BOOKE:
+        mmubooke_dump_mmu(f, cpu_fprintf, env);
+        break;
     case POWERPC_MMU_BOOKE206:
         mmubooke206_dump_mmu(f, cpu_fprintf, env);
         break;
commit 5f2c23e61a7cebed05a43dda127c83a21c681420
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Apr 28 17:52:31 2012 +0200

    ppce500_spin: Replace assert by hw_error (fixes compiler warning)
    
    The default case in function spin_read should never be reached,
    therefore the old code used assert(0) to abort QEMU.
    
    This does not work when QEMU is compiled with macro NDEBUG defined.
    In this case (and also when the compiler does not know that assert
    never returns), there is a compiler warning because of the missing
    return value.
    
    Using hw_error allows an improved error message and aborts always.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    [agraf: use __func__]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppce500_spin.c b/hw/ppce500_spin.c
index 95a2825..fddf219 100644
--- a/hw/ppce500_spin.c
+++ b/hw/ppce500_spin.c
@@ -179,7 +179,7 @@ static uint64_t spin_read(void *opaque, target_phys_addr_t addr, unsigned len)
     case 4:
         return ldl_p(spin_p);
     default:
-        assert(0);
+        hw_error("ppce500: unexpected %s with len = %u", __func__, len);
     }
 }
 
commit 73f7821baca8ec063ace277539bedeb286663965
Author: Peter Portante <peter.portante at redhat.com>
Date:   Mon Apr 23 07:27:56 2012 +0000

    pseries: Fix use of global CPU state
    
    Commit ed120055c7f9b26b5707d3ceabbe5a3f06aaf937 (Implement PAPR VPA
    functions for pSeries shared processor partitions) introduced the
    deregister_dtl() function and typo "emv" as name of its argument.
    This went unnoticed because the code in that function can access the
    global variable "env" so that no build failure resulted.
    
    Fix the argument to read "env". Resolves LP#986241.
    
    Signed-off-by: Peter Portante <peter.portante at redhat.com>
    Acked-by: Andreas Färber <afaerber at suse.de>
    [agraf: fixed typo in commit message]
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 634763e..94bb504 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -482,7 +482,7 @@ static target_ulong register_dtl(CPUPPCState *env, target_ulong addr)
     return H_SUCCESS;
 }
 
-static target_ulong deregister_dtl(CPUPPCState *emv, target_ulong addr)
+static target_ulong deregister_dtl(CPUPPCState *env, target_ulong addr)
 {
     env->dispatch_trace_log = 0;
     env->dtl_size = 0;
commit 7fb0bd3473dfb2bb1768072ebbfa5771e8c8af4a
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Wed Apr 25 17:55:42 2012 +0000

    pseries: Use the same interrupt swizzling for host bridges as p2p bridges
    
    Currently the pseries PCI code uses a somewhat strange scheme of PCI irq
    allocation - one per slot up to a maximum that's greater than the usual 4.
    This scheme more or less worked, because we were able to tell the guest the
    irq mapping in the device tree, however it's a bit odd and may break
    assumptions in the future.  Worse, the array used to construct the dev
    tree interrupt map was mis-sized, we got away with it only because it
    happened that our SPAPR_PCI_NUM_LSI value was greater than 7.
    
    This patch changes the pseries PCI code to use the same interrupt swizzling
    scheme as is standardized for PCI to PCI bridges.  This makes for better
    consistency, deals better with any devices which use multiple interrupt
    pins and will make life easier in the future when we add passthrough of
    what may be either a host bridge or a PCI to PCI bridge.  This won't break
    existing guests, because they don't assume a particular mapping scheme for
    host bridges, but just follow what we tell them in the device tree (also
    updated to match, of course).  This patch also fixes the allocation of the
    irq map.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/spapr_pci.c b/hw/spapr_pci.c
index a564c00..25b400a 100644
--- a/hw/spapr_pci.c
+++ b/hw/spapr_pci.c
@@ -198,16 +198,20 @@ static void rtas_write_pci_config(sPAPREnvironment *spapr,
     finish_write_pci_config(spapr, 0, addr, size, val, rets);
 }
 
+static int pci_spapr_swizzle(int slot, int pin)
+{
+    return (slot + pin) % PCI_NUM_PINS;
+}
+
 static int pci_spapr_map_irq(PCIDevice *pci_dev, int irq_num)
 {
     /*
      * Here we need to convert pci_dev + irq_num to some unique value
-     * which is less than number of IRQs on the specific bus (now it
-     * is 16).  At the moment irq_num == device_id (number of the
-     * slot?)
-     * FIXME: we should swizzle in fn and irq_num
+     * which is less than number of IRQs on the specific bus (4).  We
+     * use standard PCI swizzling, that is (slot number + pin number)
+     * % 4.
      */
-    return (pci_dev->devfn >> 3) % SPAPR_PCI_NUM_LSI;
+    return pci_spapr_swizzle(PCI_SLOT(pci_dev->devfn), irq_num);
 }
 
 static void pci_spapr_set_irq(void *opaque, int irq_num, int level)
@@ -304,13 +308,13 @@ static int spapr_phb_init(SysBusDevice *s)
                            phb->busname ? phb->busname : phb->dtbusname,
                            pci_spapr_set_irq, pci_spapr_map_irq, phb,
                            &phb->memspace, &phb->iospace,
-                           PCI_DEVFN(0, 0), SPAPR_PCI_NUM_LSI);
+                           PCI_DEVFN(0, 0), PCI_NUM_PINS);
     phb->host_state.bus = bus;
 
     QLIST_INSERT_HEAD(&spapr->phbs, phb, list);
 
     /* Initialize the LSI table */
-    for (i = 0; i < SPAPR_PCI_NUM_LSI; i++) {
+    for (i = 0; i < PCI_NUM_PINS; i++) {
         qemu_irq qirq;
         uint32_t num;
 
@@ -392,8 +396,7 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
                                uint32_t xics_phandle,
                                void *fdt)
 {
-    PCIBus *bus = phb->host_state.bus;
-    int bus_off, i;
+    int bus_off, i, j;
     char nodename[256];
     uint32_t bus_range[] = { cpu_to_be32(0), cpu_to_be32(0xff) };
     struct {
@@ -415,8 +418,8 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
     };
     uint64_t bus_reg[] = { cpu_to_be64(phb->buid), 0 };
     uint32_t interrupt_map_mask[] = {
-        cpu_to_be32(b_ddddd(-1)|b_fff(0)), 0x0, 0x0, 0x0};
-    uint32_t interrupt_map[bus->nirq][7];
+        cpu_to_be32(b_ddddd(-1)|b_fff(0)), 0x0, 0x0, cpu_to_be32(-1)};
+    uint32_t interrupt_map[PCI_SLOT_MAX * PCI_NUM_PINS][7];
 
     /* Start populating the FDT */
     sprintf(nodename, "pci@%" PRIx64, phb->buid);
@@ -450,19 +453,23 @@ int spapr_populate_pci_devices(sPAPRPHBState *phb,
      */
     _FDT(fdt_setprop(fdt, bus_off, "interrupt-map-mask",
                      &interrupt_map_mask, sizeof(interrupt_map_mask)));
-    for (i = 0; i < 7; i++) {
-        uint32_t *irqmap = interrupt_map[i];
-        irqmap[0] = cpu_to_be32(b_ddddd(i)|b_fff(0));
-        irqmap[1] = 0;
-        irqmap[2] = 0;
-        irqmap[3] = 0;
-        irqmap[4] = cpu_to_be32(xics_phandle);
-        irqmap[5] = cpu_to_be32(phb->lsi_table[i % SPAPR_PCI_NUM_LSI].dt_irq);
-        irqmap[6] = cpu_to_be32(0x8);
+    for (i = 0; i < PCI_SLOT_MAX; i++) {
+        for (j = 0; j < PCI_NUM_PINS; j++) {
+            uint32_t *irqmap = interrupt_map[i*PCI_NUM_PINS + j];
+            int lsi_num = pci_spapr_swizzle(i, j);
+
+            irqmap[0] = cpu_to_be32(b_ddddd(i)|b_fff(0));
+            irqmap[1] = 0;
+            irqmap[2] = 0;
+            irqmap[3] = cpu_to_be32(j+1);
+            irqmap[4] = cpu_to_be32(xics_phandle);
+            irqmap[5] = cpu_to_be32(phb->lsi_table[lsi_num].dt_irq);
+            irqmap[6] = cpu_to_be32(0x8);
+        }
     }
     /* Write interrupt map */
     _FDT(fdt_setprop(fdt, bus_off, "interrupt-map", &interrupt_map,
-                     7 * sizeof(interrupt_map[0])));
+                     sizeof(interrupt_map)));
 
     return 0;
 }
diff --git a/hw/spapr_pci.h b/hw/spapr_pci.h
index 039f85b..f54c2e8 100644
--- a/hw/spapr_pci.h
+++ b/hw/spapr_pci.h
@@ -23,11 +23,10 @@
 #if !defined(__HW_SPAPR_PCI_H__)
 #define __HW_SPAPR_PCI_H__
 
+#include "hw/pci.h"
 #include "hw/pci_host.h"
 #include "hw/xics.h"
 
-#define SPAPR_PCI_NUM_LSI   16
-
 typedef struct sPAPRPHBState {
     SysBusDevice busdev;
     PCIHostState host_state;
@@ -43,7 +42,7 @@ typedef struct sPAPRPHBState {
     struct {
         uint32_t dt_irq;
         qemu_irq qirq;
-    } lsi_table[SPAPR_PCI_NUM_LSI];
+    } lsi_table[PCI_NUM_PINS];
 
     QLIST_ENTRY(sPAPRPHBState) list;
 } sPAPRPHBState;
commit d601fac478eee7391f3e7005a9321fbf38d74809
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Wed Apr 25 17:55:41 2012 +0000

    pseries: Implement automatic PAPR VIO address allocation
    
    PAPR virtual IO (VIO) devices require a unique, but otherwise arbitrary,
    "address" used as a token to the hypercalls which manipulate them.
    
    Currently the pseries machine code does an ok job of allocating these
    addresses when the legacy -net nic / -serial and so forth options are used
    but will fail to allocate them properly when using -device.
    
    Specifically, you can use -device if all addresses are explicitly assigned.
    Without explicit assignment, only one VIO device of each type (network,
    console, SCSI) will be assigned properly, any further ones will attempt
    to take the same address leading to a fatal error.
    
    This patch fixes the situation by adding a proper address allocator to the
    VIO "bus" code.  This is used both by -device and the legacy options and
    default devices.  Addresses can still be explicitly assigned with -device
    options if desired.
    
    This patch changes the (guest visible) numbering of VIO devices, but since
    their addresses are discovered using the device tree and already differ
    from the numbering found on existing PowerVM systems, this does not break
    compatibility.
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/spapr.c b/hw/spapr.c
index bfaf260..cca20f9 100644
--- a/hw/spapr.c
+++ b/hw/spapr.c
@@ -631,8 +631,7 @@ static void ppc_spapr_init(ram_addr_t ram_size,
 
     for (i = 0; i < MAX_SERIAL_PORTS; i++) {
         if (serial_hds[i]) {
-            spapr_vty_create(spapr->vio_bus, SPAPR_VTY_BASE_ADDRESS + i,
-                             serial_hds[i]);
+            spapr_vty_create(spapr->vio_bus, serial_hds[i]);
         }
     }
 
@@ -650,14 +649,14 @@ static void ppc_spapr_init(ram_addr_t ram_size,
         }
 
         if (strcmp(nd->model, "ibmveth") == 0) {
-            spapr_vlan_create(spapr->vio_bus, 0x1000 + i, nd);
+            spapr_vlan_create(spapr->vio_bus, nd);
         } else {
             pci_nic_init_nofail(&nd_table[i], nd->model, NULL);
         }
     }
 
     for (i = 0; i <= drive_get_max_bus(IF_SCSI); i++) {
-        spapr_vscsi_create(spapr->vio_bus, 0x2000 + i);
+        spapr_vscsi_create(spapr->vio_bus);
     }
 
     if (rma_size < (MIN_RMA_SLOF << 20)) {
diff --git a/hw/spapr_llan.c b/hw/spapr_llan.c
index e18d2eb..8313043 100644
--- a/hw/spapr_llan.c
+++ b/hw/spapr_llan.c
@@ -204,12 +204,11 @@ static int spapr_vlan_init(VIOsPAPRDevice *sdev)
     return 0;
 }
 
-void spapr_vlan_create(VIOsPAPRBus *bus, uint32_t reg, NICInfo *nd)
+void spapr_vlan_create(VIOsPAPRBus *bus, NICInfo *nd)
 {
     DeviceState *dev;
 
     dev = qdev_create(&bus->bus, "spapr-vlan");
-    qdev_prop_set_uint32(dev, "reg", reg);
 
     qdev_set_nic_properties(dev, nd);
 
@@ -480,7 +479,7 @@ static target_ulong h_multicast_ctrl(CPUPPCState *env, sPAPREnvironment *spapr,
 }
 
 static Property spapr_vlan_properties[] = {
-    DEFINE_SPAPR_PROPERTIES(VIOsPAPRVLANDevice, sdev, 0x1000, 0x10000000),
+    DEFINE_SPAPR_PROPERTIES(VIOsPAPRVLANDevice, sdev, 0x10000000),
     DEFINE_NIC_PROPERTIES(VIOsPAPRVLANDevice, nicconf),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/hw/spapr_vio.c b/hw/spapr_vio.c
index fccf48b..315ab80 100644
--- a/hw/spapr_vio.c
+++ b/hw/spapr_vio.c
@@ -620,28 +620,22 @@ static void rtas_quiesce(sPAPREnvironment *spapr, uint32_t token,
     rtas_st(rets, 0, 0);
 }
 
-static int spapr_vio_check_reg(VIOsPAPRDevice *sdev)
+static VIOsPAPRDevice *reg_conflict(VIOsPAPRDevice *dev)
 {
-    VIOsPAPRDevice *other_sdev;
+    VIOsPAPRBus *bus = DO_UPCAST(VIOsPAPRBus, bus, dev->qdev.parent_bus);
     DeviceState *qdev;
-    VIOsPAPRBus *sbus;
-
-    sbus = DO_UPCAST(VIOsPAPRBus, bus, sdev->qdev.parent_bus);
+    VIOsPAPRDevice *other;
 
     /*
-     * Check two device aren't given clashing addresses by the user (or some
-     * other mechanism). We have to open code this because we have to check
-     * for matches with devices other than us.
+     * Check for a device other than the given one which is already
+     * using the requested address. We have to open code this because
+     * the given dev might already be in the list.
      */
-    QTAILQ_FOREACH(qdev, &sbus->bus.children, sibling) {
-        other_sdev = DO_UPCAST(VIOsPAPRDevice, qdev, qdev);
+    QTAILQ_FOREACH(qdev, &bus->bus.children, sibling) {
+        other = DO_UPCAST(VIOsPAPRDevice, qdev, qdev);
 
-        if (other_sdev != sdev && other_sdev->reg == sdev->reg) {
-            fprintf(stderr, "vio: %s and %s devices conflict at address %#x\n",
-                    object_get_typename(OBJECT(sdev)),
-                    object_get_typename(OBJECT(qdev)),
-                    sdev->reg);
-            return -EEXIST;
+        if (other != dev && other->reg == dev->reg) {
+            return other;
         }
     }
 
@@ -667,11 +661,30 @@ static int spapr_vio_busdev_init(DeviceState *qdev)
     VIOsPAPRDevice *dev = (VIOsPAPRDevice *)qdev;
     VIOsPAPRDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
     char *id;
-    int ret;
 
-    ret = spapr_vio_check_reg(dev);
-    if (ret) {
-        return ret;
+    if (dev->reg != -1) {
+        /*
+         * Explicitly assigned address, just verify that no-one else
+         * is using it.  other mechanism). We have to open code this
+         * rather than using spapr_vio_find_by_reg() because sdev
+         * itself is already in the list.
+         */
+        VIOsPAPRDevice *other = reg_conflict(dev);
+
+        if (other) {
+            fprintf(stderr, "vio: %s and %s devices conflict at address %#x\n",
+                    object_get_typename(OBJECT(qdev)),
+                    object_get_typename(OBJECT(&other->qdev)),
+                    dev->reg);
+            return -1;
+        }
+    } else {
+        /* Need to assign an address */
+        VIOsPAPRBus *bus = DO_UPCAST(VIOsPAPRBus, bus, dev->qdev.parent_bus);
+
+        do {
+            dev->reg = bus->next_reg++;
+        } while (reg_conflict(dev));
     }
 
     /* Don't overwrite ids assigned on the command line */
@@ -731,6 +744,7 @@ VIOsPAPRBus *spapr_vio_bus_init(void)
 
     qbus = qbus_create(&spapr_vio_bus_info, dev, "spapr-vio");
     bus = DO_UPCAST(VIOsPAPRBus, bus, qbus);
+    bus->next_reg = 0x1000;
 
     /* hcall-vio */
     spapr_register_hypercall(H_VIO_SIGNAL, h_vio_signal);
diff --git a/hw/spapr_vio.h b/hw/spapr_vio.h
index 10ab359..87816e4 100644
--- a/hw/spapr_vio.h
+++ b/hw/spapr_vio.h
@@ -32,8 +32,6 @@ enum VIOsPAPR_TCEAccess {
     SPAPR_TCE_RW = 3,
 };
 
-#define SPAPR_VTY_BASE_ADDRESS     0x30000000
-
 #define TYPE_VIO_SPAPR_DEVICE "vio-spapr-device"
 #define VIO_SPAPR_DEVICE(obj) \
      OBJECT_CHECK(VIOsPAPRDevice, (obj), TYPE_VIO_SPAPR_DEVICE)
@@ -82,13 +80,14 @@ struct VIOsPAPRDevice {
     VIOsPAPR_CRQ crq;
 };
 
-#define DEFINE_SPAPR_PROPERTIES(type, field, default_reg, default_dma_window) \
-        DEFINE_PROP_UINT32("reg", type, field.reg, default_reg), \
+#define DEFINE_SPAPR_PROPERTIES(type, field, default_dma_window)       \
+        DEFINE_PROP_UINT32("reg", type, field.reg, -1),                \
         DEFINE_PROP_UINT32("dma-window", type, field.rtce_window_size, \
                            default_dma_window)
 
 struct VIOsPAPRBus {
     BusState bus;
+    uint32_t next_reg;
     int (*init)(VIOsPAPRDevice *dev);
     int (*devnode)(VIOsPAPRDevice *dev, void *fdt, int node_off);
 };
@@ -119,9 +118,9 @@ int spapr_vio_send_crq(VIOsPAPRDevice *dev, uint8_t *crq);
 
 VIOsPAPRDevice *vty_lookup(sPAPREnvironment *spapr, target_ulong reg);
 void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len);
-void spapr_vty_create(VIOsPAPRBus *bus, uint32_t reg, CharDriverState *chardev);
-void spapr_vlan_create(VIOsPAPRBus *bus, uint32_t reg, NICInfo *nd);
-void spapr_vscsi_create(VIOsPAPRBus *bus, uint32_t reg);
+void spapr_vty_create(VIOsPAPRBus *bus, CharDriverState *chardev);
+void spapr_vlan_create(VIOsPAPRBus *bus, NICInfo *nd);
+void spapr_vscsi_create(VIOsPAPRBus *bus);
 
 VIOsPAPRDevice *spapr_vty_get_default(VIOsPAPRBus *bus);
 
diff --git a/hw/spapr_vscsi.c b/hw/spapr_vscsi.c
index 538e0b7..037867a 100644
--- a/hw/spapr_vscsi.c
+++ b/hw/spapr_vscsi.c
@@ -918,12 +918,11 @@ static int spapr_vscsi_init(VIOsPAPRDevice *dev)
     return 0;
 }
 
-void spapr_vscsi_create(VIOsPAPRBus *bus, uint32_t reg)
+void spapr_vscsi_create(VIOsPAPRBus *bus)
 {
     DeviceState *dev;
 
     dev = qdev_create(&bus->bus, "spapr-vscsi");
-    qdev_prop_set_uint32(dev, "reg", reg);
 
     qdev_init_nofail(dev);
 }
@@ -946,7 +945,7 @@ static int spapr_vscsi_devnode(VIOsPAPRDevice *dev, void *fdt, int node_off)
 }
 
 static Property spapr_vscsi_properties[] = {
-    DEFINE_SPAPR_PROPERTIES(VSCSIState, vdev, 0x2000, 0x10000000),
+    DEFINE_SPAPR_PROPERTIES(VSCSIState, vdev, 0x10000000),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/spapr_vty.c b/hw/spapr_vty.c
index a30c040..c9674f3 100644
--- a/hw/spapr_vty.c
+++ b/hw/spapr_vty.c
@@ -123,18 +123,17 @@ static target_ulong h_get_term_char(CPUPPCState *env, sPAPREnvironment *spapr,
     return H_SUCCESS;
 }
 
-void spapr_vty_create(VIOsPAPRBus *bus, uint32_t reg, CharDriverState *chardev)
+void spapr_vty_create(VIOsPAPRBus *bus, CharDriverState *chardev)
 {
     DeviceState *dev;
 
     dev = qdev_create(&bus->bus, "spapr-vty");
-    qdev_prop_set_uint32(dev, "reg", reg);
     qdev_prop_set_chr(dev, "chardev", chardev);
     qdev_init_nofail(dev);
 }
 
 static Property spapr_vty_properties[] = {
-    DEFINE_SPAPR_PROPERTIES(VIOsPAPRVTYDevice, sdev, SPAPR_VTY_BASE_ADDRESS, 0),
+    DEFINE_SPAPR_PROPERTIES(VIOsPAPRVTYDevice, sdev, 0),
     DEFINE_PROP_CHR("chardev", VIOsPAPRVTYDevice, chardev),
     DEFINE_PROP_END_OF_LIST(),
 };
commit 892c587f22fc97362a595d3c84669a39ce1cd2f5
Author: Alexander Graf <agraf at suse.de>
Date:   Thu Apr 19 15:34:06 2012 +0200

    PPC: Fix up e500 cache size setting
    
    When initializing the e500 code, we need to expose its
    cache line size for user and system mode, while the mmu
    details are only interesting for system emulation.
    
    Split the 2 switch statements apart, allowing us to #ifdef
    out the mmu parts for user mode emulation while keeping all
    cache information consistent.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index ba4b84d..6f61175 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -4461,33 +4461,36 @@ static void init_proc_e500 (CPUPPCState *env, int version)
                  &spr_read_spefscr, &spr_write_spefscr,
                  &spr_read_spefscr, &spr_write_spefscr,
                  0x00000000);
+#if !defined(CONFIG_USER_ONLY)
     /* Memory management */
-#if defined(CONFIG_USER_ONLY)
-    env->dcache_line_size = 32;
-    env->icache_line_size = 32;
-#else /* !defined(CONFIG_USER_ONLY) */
     env->nb_pids = 3;
     env->nb_ways = 2;
     env->id_tlbs = 0;
     switch (version) {
     case fsl_e500v1:
-        /* e500v1 */
         tlbncfg[0] = gen_tlbncfg(2, 1, 1, 0, 256);
         tlbncfg[1] = gen_tlbncfg(16, 1, 9, TLBnCFG_AVAIL | TLBnCFG_IPROT, 16);
-        env->dcache_line_size = 32;
-        env->icache_line_size = 32;
         break;
     case fsl_e500v2:
-        /* e500v2 */
         tlbncfg[0] = gen_tlbncfg(4, 1, 1, 0, 512);
         tlbncfg[1] = gen_tlbncfg(16, 1, 12, TLBnCFG_AVAIL | TLBnCFG_IPROT, 16);
-        env->dcache_line_size = 32;
-        env->icache_line_size = 32;
         break;
     case fsl_e500mc:
-        /* e500mc */
         tlbncfg[0] = gen_tlbncfg(4, 1, 1, 0, 512);
         tlbncfg[1] = gen_tlbncfg(64, 1, 12, TLBnCFG_AVAIL | TLBnCFG_IPROT, 64);
+        break;
+    default:
+        cpu_abort(env, "Unknown CPU: " TARGET_FMT_lx "\n", env->spr[SPR_PVR]);
+    }
+#endif
+    /* Cache sizes */
+    switch (version) {
+    case fsl_e500v1:
+    case fsl_e500v2:
+        env->dcache_line_size = 32;
+        env->icache_line_size = 32;
+        break;
+    case fsl_e500mc:
         env->dcache_line_size = 64;
         env->icache_line_size = 64;
         l1cfg0 |= 0x1000000; /* 64 byte cache block size */
@@ -4495,7 +4498,6 @@ static void init_proc_e500 (CPUPPCState *env, int version)
     default:
         cpu_abort(env, "Unknown CPU: " TARGET_FMT_lx "\n", env->spr[SPR_PVR]);
     }
-#endif
     gen_spr_BookE206(env, 0x000000DF, tlbncfg);
     /* XXX : not implemented */
     spr_register(env, SPR_HID0, "HID0",
commit 58f90f21f4d8e3b105b3e3669334f1b98141075c
Author: Bharat Bhushan <r65777 at freescale.com>
Date:   Mon Mar 26 17:56:46 2012 +0000

    booke:Use MMU API for creating initial mapping for secondary cpus
    
    Initial Mapping creation for secondary CPU in SMP was missing new MMU API.
    
    Signed-off-by: Bharat Bhushan <bharat.bhushan at freescale.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppce500_spin.c b/hw/ppce500_spin.c
index 960b7b0..95a2825 100644
--- a/hw/ppce500_spin.c
+++ b/hw/ppce500_spin.c
@@ -86,6 +86,7 @@ static void mmubooke_create_initial_mapping(CPUPPCState *env,
     tlb->mas2 = (va & TARGET_PAGE_MASK) | MAS2_M;
     tlb->mas7_3 = pa & TARGET_PAGE_MASK;
     tlb->mas7_3 |= MAS3_UR | MAS3_UW | MAS3_UX | MAS3_SR | MAS3_SW | MAS3_SX;
+    env->tlb_dirty = true;
 }
 
 static void spin_kick(void *data)
commit 65074706b9353bae7307fcfcbbf63a36f6896aa7
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Apr 30 22:58:55 2012 +0000

    linux-user: Fix undefined HOST_LONG_SIZE on PPC hosts
    
    On my PPC host, HOST_LONG_SIZE is not defined even after
    running configure. Use the normal C way of determining the
    long size instead.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: malc <av1474 at comtv.ru>

diff --git a/thunk.h b/thunk.h
index 5be8f91..87025c3 100644
--- a/thunk.h
+++ b/thunk.h
@@ -113,7 +113,7 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
       defined(HOST_PARISC) || defined(HOST_SPARC64)
             return 4;
 #elif defined(HOST_PPC)
-            return HOST_LONG_SIZE;
+            return sizeof(void *);
 #else
             return 2;
 #endif
commit 30d70e71b3250ab4a0e3209836e1153f1e5e04ba
Author: malc <av1474 at comtv.ru>
Date:   Tue May 1 23:41:08 2012 +0400

    Revert "Remove stray HOST_LONG_SIZE"
    
    This reverts commit b754e4fc1e8e68af975c545c38ebc3b001ebc98f.

diff --git a/thunk.h b/thunk.h
index c295766..5be8f91 100644
--- a/thunk.h
+++ b/thunk.h
@@ -113,7 +113,7 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
       defined(HOST_PARISC) || defined(HOST_SPARC64)
             return 4;
 #elif defined(HOST_PPC)
-            return TARGET_ABI_BITS / 8;
+            return HOST_LONG_SIZE;
 #else
             return 2;
 #endif
commit e120d449e1b39ec508c297b963ce452628dd37c3
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Fri Apr 27 13:11:39 2012 +0100

    configure: check for supported Python 2.x versions
    
    The tracetool code requires Python 2.4, which was released in 2004.
    Check for a supported Python version so we can give a clear error
    message.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Reviewed-by: Lluís Vilanova <vilanova at ac.upc.edu>

diff --git a/configure b/configure
index 3c72fa0..b4f1379 100755
--- a/configure
+++ b/configure
@@ -1239,9 +1239,10 @@ fi
 
 # Note that if the Python conditional here evaluates True we will exit
 # with status 1 which is a shell 'false' value.
-if ! "$python" -c 'import sys; sys.exit(sys.version_info[0] >= 3)'; then
-  echo "Python 2 required but '$python' is version 3 or better."
-  echo "Use --python=/path/to/python to specify a Python 2."
+if ! "$python" -c 'import sys; sys.exit(sys.version_info < (2,4) or sys.version_info >= (3,))'; then
+  echo "Cannot use '$python', Python 2.4 or later is required."
+  echo "Note that Python 3 or later is not yet supported."
+  echo "Use --python=/path/to/python to specify a supported Python."
   exit 1
 fi
 
commit 9943e0ec38786125ce1bbaf82ba6c3cadb976ba6
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Mon Apr 30 12:00:23 2012 +0100

    tracetool: avoid pkgutil.iter_modules() Python 2.7 function
    
    The pkgutil.iter_modules() function provides a way to enumerate child
    modules.  Unfortunately it's missing in Python <2.7 so we must implement
    similar behavior ourselves.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Reviewed-by: Lluís Vilanova <vilanova at ac.upc.edu>

diff --git a/scripts/tracetool/backend/__init__.py b/scripts/tracetool/backend/__init__.py
index 34b7ed8..be43472 100644
--- a/scripts/tracetool/backend/__init__.py
+++ b/scripts/tracetool/backend/__init__.py
@@ -37,7 +37,7 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha at linux.vnet.ibm.com"
 
 
-import pkgutil
+import os
 
 import tracetool
 
@@ -45,7 +45,11 @@ import tracetool
 def get_list():
     """Get a list of (name, description) pairs."""
     res = [("nop", "Tracing disabled.")]
-    for _, modname, _ in pkgutil.iter_modules(tracetool.backend.__path__):
+    modnames = []
+    for filename in os.listdir(tracetool.backend.__path__[0]):
+        if filename.endswith('.py') and filename != '__init__.py':
+            modnames.append(filename.rsplit('.', 1)[0])
+    for modname in modnames:
         module = tracetool.try_import("tracetool.backend." + modname)
 
         # just in case; should never fail unless non-module files are put there
diff --git a/scripts/tracetool/format/__init__.py b/scripts/tracetool/format/__init__.py
index 0e4baf0..3c2a0d8 100644
--- a/scripts/tracetool/format/__init__.py
+++ b/scripts/tracetool/format/__init__.py
@@ -41,7 +41,7 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha at linux.vnet.ibm.com"
 
 
-import pkgutil
+import os
 
 import tracetool
 
@@ -49,7 +49,11 @@ import tracetool
 def get_list():
     """Get a list of (name, description) pairs."""
     res = []
-    for _, modname, _ in pkgutil.iter_modules(tracetool.format.__path__):
+    modnames = []
+    for filename in os.listdir(tracetool.format.__path__[0]):
+        if filename.endswith('.py') and filename != '__init__.py':
+            modnames.append(filename.rsplit('.', 1)[0])
+    for modname in modnames:
         module = tracetool.try_import("tracetool.format." + modname)
 
         # just in case; should never fail unless non-module files are put there
commit b3ef0ade57ff29e33d3204ca2f48b1e36108116e
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Fri Apr 27 15:12:04 2012 +0100

    tracetool: avoid str.rpartition() Python 2.5 function
    
    The str.rpartition() function is related to str.split() and is used for
    splitting strings.  It was introduced in Python 2.5 and therefore cannot
    be used in tracetool as Python 2.4 compatibility is required.
    
    Replace the code using str.rsplit().
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Reviewed-by: Lluís Vilanova <vilanova at ac.upc.edu>

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 49858c9..175df08 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -64,14 +64,17 @@ class Arguments:
         res = []
         for arg in arg_str.split(","):
             arg = arg.strip()
-            parts = arg.split()
-            head, sep, tail = parts[-1].rpartition("*")
-            parts = parts[:-1]
-            if tail == "void":
-                assert len(parts) == 0 and sep == ""
+            if arg == 'void':
                 continue
-            arg_type = " ".join(parts + [ " ".join([head, sep]).strip() ]).strip()
-            res.append((arg_type, tail))
+
+            if '*' in arg:
+                arg_type, identifier = arg.rsplit('*', 1)
+                arg_type += '*'
+                identifier = identifier.strip()
+            else:
+                arg_type, identifier = arg.rsplit(None, 1)
+
+            res.append((arg_type, identifier))
         return Arguments(res)
 
     def __iter__(self):
commit 45d6c787751650ac332447444c192201dfc526af
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Fri Apr 27 14:24:41 2012 +0100

    tracetool: use Python 2.4-compatible __import__() arguments
    
    In Python 2.5 keyword arguments were added to __import__().  Avoid using
    them to achieve Python 2.4 compatibility.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Reviewed-by: Lluís Vilanova <vilanova at ac.upc.edu>

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 74fe21b..49858c9 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -204,7 +204,7 @@ def try_import(mod_name, attr_name = None, attr_default = None):
     object or attribute value.
     """
     try:
-        module = __import__(mod_name, fromlist=["__package__"])
+        module = __import__(mod_name, globals(), locals(), ["__package__"])
         if attr_name is None:
             return True, module
         return True, getattr(module, str(attr_name), attr_default)
commit 662da3854e3f490223373b40afdcfcc339d14aa5
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 10:39:42 2012 +0100

    tracetool: use Python 2.4-compatible exception handling syntax
    
    The newer "except <exception-type> as <exception>:" syntax is not
    supported by Python 2.4, we need to use "except <exception-type>,
    <exception>:".
    
    Tested all trace backends with Python 2.4.
    
    Reported-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Reviewed-by: Lluís Vilanova <vilanova at ac.upc.edu>

diff --git a/scripts/tracetool.py b/scripts/tracetool.py
index cacfd99..c003cf6 100755
--- a/scripts/tracetool.py
+++ b/scripts/tracetool.py
@@ -70,7 +70,7 @@ def main(args):
 
     try:
         opts, args = getopt.getopt(args[1:], "", long_opts)
-    except getopt.GetoptError as err:
+    except getopt.GetoptError, err:
         error_opt(str(err))
 
     check_backend = False
@@ -131,7 +131,7 @@ def main(args):
     try:
         tracetool.generate(sys.stdin, arg_format, arg_backend,
                            binary = binary, probe_prefix = probe_prefix)
-    except tracetool.TracetoolError as e:
+    except tracetool.TracetoolError, e:
         error_opt(str(e))
 
 if __name__ == "__main__":
commit 4170aea1a77d7adf9e35ab4d3c17086c38ca6c09
Author: Jens Freimann <jfrei at linux.vnet.ibm.com>
Date:   Thu Apr 26 09:03:36 2012 +0000

    s390: reset avail and used index on reboot
    
    reset the guest vring avail/used idx fields, otherwise it's possible
    that old values remain in memory which would cause a reboot to fail
    with a "Guest moved used index" message
    
    Signed-off-by: Jens Freimann <jfrei at linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390-virtio-bus.c b/hw/s390-virtio-bus.c
index 74419b3..63ccd5c 100644
--- a/hw/s390-virtio-bus.c
+++ b/hw/s390-virtio-bus.c
@@ -63,6 +63,23 @@ static void s390_virtio_bus_reset(void *opaque)
     bus->next_ring = bus->dev_page + TARGET_PAGE_SIZE;
 }
 
+void s390_virtio_reset_idx(VirtIOS390Device *dev)
+{
+    int i;
+    target_phys_addr_t idx_addr;
+    uint8_t num_vq;
+
+    num_vq = s390_virtio_device_num_vq(dev);
+    for (i = 0; i < num_vq; i++) {
+        idx_addr = virtio_queue_get_avail_addr(dev->vdev, i) +
+            VIRTIO_VRING_AVAIL_IDX_OFFS;
+        stw_phys(idx_addr, 0);
+        idx_addr = virtio_queue_get_used_addr(dev->vdev, i) +
+            VIRTIO_VRING_USED_IDX_OFFS;
+        stw_phys(idx_addr, 0);
+    }
+}
+
 VirtIOS390Bus *s390_virtio_bus_init(ram_addr_t *ram_size)
 {
     VirtIOS390Bus *bus;
@@ -121,7 +138,7 @@ static int s390_virtio_device_init(VirtIOS390Device *dev, VirtIODevice *vdev)
     virtio_bind_device(vdev, &virtio_s390_bindings, dev);
     dev->host_features = vdev->get_features(vdev, dev->host_features);
     s390_virtio_device_sync(dev);
-
+    s390_virtio_reset_idx(dev);
     if (dev->qdev.hotplugged) {
         CPUS390XState *env = s390_cpu_addr2state(0);
         s390_virtio_irq(env, VIRTIO_PARAM_DEV_ADD, dev->dev_offs);
diff --git a/hw/s390-virtio-bus.h b/hw/s390-virtio-bus.h
index 0e60bc0..49e6c46 100644
--- a/hw/s390-virtio-bus.h
+++ b/hw/s390-virtio-bus.h
@@ -34,6 +34,8 @@
 #define VIRTIO_VQCONFIG_LEN		24
 
 #define VIRTIO_RING_LEN			(TARGET_PAGE_SIZE * 3)
+#define VIRTIO_VRING_AVAIL_IDX_OFFS 2
+#define VIRTIO_VRING_USED_IDX_OFFS 2
 #define S390_DEVICE_PAGES		512
 
 #define VIRTIO_PARAM_MASK               0xff
@@ -90,3 +92,5 @@ VirtIOS390Device *s390_virtio_bus_find_vring(VirtIOS390Bus *bus,
                                              ram_addr_t mem, int *vq_num);
 VirtIOS390Device *s390_virtio_bus_find_mem(VirtIOS390Bus *bus, ram_addr_t mem);
 void s390_virtio_device_sync(VirtIOS390Device *dev);
+void s390_virtio_reset_idx(VirtIOS390Device *dev);
+
diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index d7dc857..c0e19fd 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -99,6 +99,7 @@ int s390_virtio_hypercall(CPUS390XState *env, uint64_t mem, uint64_t hypercall)
         virtio_reset(dev->vdev);
         stb_phys(dev->dev_offs + VIRTIO_DEV_OFFS_STATUS, 0);
         s390_virtio_device_sync(dev);
+        s390_virtio_reset_idx(dev);
         break;
     }
     case KVM_S390_VIRTIO_SET_STATUS:
commit eca3ed0343ba413937f34ad4f8c4822dc82924e5
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Sun Apr 22 23:52:25 2012 +0000

    S390: dont call system_shutdown on disabled wait
    
    A disabled wait usually indicates a guest problem. Dont shutdown the
    guest to allow guest dumping.
    Have some special cases, e.g. a quiesce disabled wait. In that case
    we want to shutdown.
    
    Long term solution might be a crashed/panic indication.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 956730d..90aad61 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -407,6 +407,12 @@ static int handle_instruction(CPUS390XState *env, struct kvm_run *run)
     return 0;
 }
 
+static bool is_special_wait_psw(CPUS390XState *env)
+{
+    /* signal quiesce */
+    return env->kvm_run->psw_addr == 0xfffUL;
+}
+
 static int handle_intercept(CPUS390XState *env)
 {
     struct kvm_run *run = env->kvm_run;
@@ -420,6 +426,12 @@ static int handle_intercept(CPUS390XState *env)
             r = handle_instruction(env, run);
             break;
         case ICPT_WAITPSW:
+            if (s390_del_running_cpu(env) == 0 &&
+                is_special_wait_psw(env)) {
+                qemu_system_shutdown_request();
+            }
+            r = EXCP_HALTED;
+            break;
         case ICPT_CPU_STOP:
             if (s390_del_running_cpu(env) == 0) {
                 qemu_system_shutdown_request();
commit ad0bbc560026fb21c5b3d07631457e3be84d0f42
Author: Einar Lueck <elelueck at de.ibm.com>
Date:   Sun Apr 22 23:52:24 2012 +0000

    S390: remove default cdrom, sd-card and floppy support
    
    This patch simply disables CDROM, SD card and floppy support for the
    s390 virtio machine. Without this patch, a default CDROM drive would
    get added which has currently no backing on s390.
    
    Signed-off-by: Einar Lueck <elelueck at de.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index d17602f..d7dc857 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -331,8 +331,11 @@ static QEMUMachine s390_machine = {
     .alias = "s390",
     .desc = "VirtIO based S390 machine",
     .init = s390_init,
+    .no_cdrom = 1,
+    .no_floppy = 1,
     .no_serial = 1,
     .no_parallel = 1,
+    .no_sdcard = 1,
     .use_virtcon = 1,
     .max_cpus = 255,
     .is_default = 1,
commit add142e0aa41daad86f650b68bac6b6a8e808f8d
Author: Jens Freimann <jfrei at linux.vnet.ibm.com>
Date:   Sun Apr 22 23:52:23 2012 +0000

    S390: support reboot for kvm on s390
    
    This patch adds reboot support for s390x-softmmu by calling
    the generic reboot support in kvm.
    
    Signed-off-by: Jens Freimann <jfrei at linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c
index 2b67231..956730d 100644
--- a/target-s390x/kvm.c
+++ b/target-s390x/kvm.c
@@ -452,8 +452,7 @@ int kvm_arch_handle_exit(CPUS390XState *env, struct kvm_run *run)
             ret = handle_intercept(env);
             break;
         case KVM_EXIT_S390_RESET:
-            fprintf(stderr, "RESET not implemented\n");
-            exit(1);
+            qemu_system_reset_request();
             break;
         default:
             fprintf(stderr, "Unknown KVM exit: %d\n", run->exit_reason);
commit eb3caa44b03f5d72a49a18c72443825b58168734
Author: Jens Freimann <jfrei at linux.vnet.ibm.com>
Date:   Sun Apr 22 23:52:21 2012 +0000

    S390: reboot: reset device pages on reboot
    
    This patch fixes reboot on s390 by resetting the device
    page on reboot.
    
    Signed-off-by: Jens Freimann <jfrei at linux.vnet.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390-virtio-bus.c b/hw/s390-virtio-bus.c
index be1f5f1..74419b3 100644
--- a/hw/s390-virtio-bus.c
+++ b/hw/s390-virtio-bus.c
@@ -57,6 +57,12 @@ static ram_addr_t s390_virtio_device_num_vq(VirtIOS390Device *dev);
 /* length of VirtIO device pages */
 const target_phys_addr_t virtio_size = S390_DEVICE_PAGES * TARGET_PAGE_SIZE;
 
+static void s390_virtio_bus_reset(void *opaque)
+{
+    VirtIOS390Bus *bus = opaque;
+    bus->next_ring = bus->dev_page + TARGET_PAGE_SIZE;
+}
+
 VirtIOS390Bus *s390_virtio_bus_init(ram_addr_t *ram_size)
 {
     VirtIOS390Bus *bus;
@@ -82,6 +88,7 @@ VirtIOS390Bus *s390_virtio_bus_init(ram_addr_t *ram_size)
     /* Allocate RAM for VirtIO device pages (descriptors, queues, rings) */
     *ram_size += S390_DEVICE_PAGES * TARGET_PAGE_SIZE;
 
+    qemu_register_reset(s390_virtio_bus_reset, bus);
     return bus;
 }
 
commit 118a89774346e6a406cd44f403cb043a417066c9
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Sun Apr 22 23:52:20 2012 +0000

    S390: fix error handling on kernel and initrd failures
    
    If the user specifies a non-existing or non-accessable kernel or initrd
    qemu does not fail, instead it ipls into the system, which then falls
    into a program check loop due to the zeroed memory with no kernel.
    Lets add some sanity checks.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index c79784c..d17602f 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -230,6 +230,11 @@ static void s390_init(ram_addr_t my_ram_size,
         if (kernel_size == -1UL) {
             kernel_size = load_image_targphys(kernel_filename, 0, ram_size);
         }
+        if (kernel_size == -1UL) {
+            fprintf(stderr, "qemu: could not load kernel '%s'\n",
+                    kernel_filename);
+            exit(1);
+        }
         /*
          * we can not rely on the ELF entry point, since up to 3.2 this
          * value was 0x800 (the SALIPL loader) and it wont work. For
@@ -269,6 +274,12 @@ static void s390_init(ram_addr_t my_ram_size,
         }
         initrd_size = load_image_targphys(initrd_filename, initrd_offset,
                                           ram_size - initrd_offset);
+        if (initrd_size == -1UL) {
+            fprintf(stderr, "qemu: could not load initrd '%s'\n",
+                    initrd_filename);
+            exit(1);
+        }
+
         /* we have to overwrite values in the kernel image, which are "rom" */
         memcpy(rom_ptr(INITRD_PARM_START), &initrd_offset, 8);
         memcpy(rom_ptr(INITRD_PARM_SIZE), &initrd_size, 8);
commit cc3c7384ac61728e9949d5e64c10664fe4510179
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Sun Apr 22 23:52:19 2012 +0000

    S390: fix kernel_commandline handling
    
    The current handling of kernel parameters is broken. The pointer
    is always valid, even if no -kernel or -append is specified.
    We must check if the kernel rom address is valid instead,
    otherwise qemu might segfault.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390-virtio.c b/hw/s390-virtio.c
index 1ebe70d..c79784c 100644
--- a/hw/s390-virtio.c
+++ b/hw/s390-virtio.c
@@ -274,7 +274,7 @@ static void s390_init(ram_addr_t my_ram_size,
         memcpy(rom_ptr(INITRD_PARM_SIZE), &initrd_size, 8);
     }
 
-    if (kernel_cmdline) {
+    if (rom_ptr(KERN_PARM_AREA)) {
         /* we have to overwrite values in the kernel image, which are "rom" */
         memcpy(rom_ptr(KERN_PARM_AREA), kernel_cmdline,
                strlen(kernel_cmdline) + 1);
commit b754e4fc1e8e68af975c545c38ebc3b001ebc98f
Author: malc <av1474 at comtv.ru>
Date:   Tue May 1 18:23:04 2012 +0400

    Remove stray HOST_LONG_SIZE
    
    Signed-off-by: malc <av1474 at comtv.ru>

diff --git a/thunk.h b/thunk.h
index 5be8f91..c295766 100644
--- a/thunk.h
+++ b/thunk.h
@@ -113,7 +113,7 @@ static inline int thunk_type_size(const argtype *type_ptr, int is_host)
       defined(HOST_PARISC) || defined(HOST_SPARC64)
             return 4;
 #elif defined(HOST_PPC)
-            return HOST_LONG_SIZE;
+            return TARGET_ABI_BITS / 8;
 #else
             return 2;
 #endif
commit 7d21dcc84b8c07918124a9c0708694d2fb013f65
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Tue May 1 10:56:46 2012 +0000

    pc-bios: update OpenBIOS images
    
    Update OpenBIOS images to SVN r1056.
    
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/pc-bios/README b/pc-bios/README
index 71f4871..6b64d68 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -12,7 +12,7 @@
   1275-1994 (referred to as Open Firmware) compliant firmware.
   The included images for PowerPC (for 32 and 64 bit PPC CPUs),
   Sparc32 and Sparc64 are built from OpenBIOS SVN revision
-  1047.
+  1056.
 
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
diff --git a/pc-bios/openbios-ppc b/pc-bios/openbios-ppc
index 83b7794..d4656db 100644
Binary files a/pc-bios/openbios-ppc and b/pc-bios/openbios-ppc differ
diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index 03353c9..4312c69 100644
Binary files a/pc-bios/openbios-sparc32 and b/pc-bios/openbios-sparc32 differ
diff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index c8972ac..b186105 100644
Binary files a/pc-bios/openbios-sparc64 and b/pc-bios/openbios-sparc64 differ
commit 560d375fe007203496520257526ec2090110afd7
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Mon Apr 30 18:00:55 2012 +0200

    configure: Add libraries for qemu-ga on Solaris
    
    Move socket-related Solaris libraries to $solarisnetlibs and use them
    for both $LIBS and $libs_qga.
    
    Fixes build on illumos without --disable-guest-agent.
    
    Signed-off-by: Lee Essen <lee.essen at nowonline.co.uk>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Reviewed-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/configure b/configure
index e3d7a94..3c72fa0 100755
--- a/configure
+++ b/configure
@@ -468,7 +468,9 @@ SunOS)
 # needed for TIOCWIN* defines in termios.h
   QEMU_CFLAGS="-D__EXTENSIONS__ $QEMU_CFLAGS"
   QEMU_CFLAGS="-std=gnu99 $QEMU_CFLAGS"
-  LIBS="-lsocket -lnsl -lresolv $LIBS"
+  solarisnetlibs="-lsocket -lnsl -lresolv"
+  LIBS="$solarisnetlibs $LIBS"
+  libs_qga="$solarisnetlibs $libs_qga"
 ;;
 AIX)
   aix="yes"
commit e61ab1da7e98357da47c54d8f893b9bd6ff2f7f9
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Mon Apr 30 18:00:54 2012 +0200

    qemu-ga: Implement alternative to O_ASYNC
    
    ga_channel_open() was using open flag O_ASYNC for SIGIO-driven I/O.
    This breaks on illumos, so fall back to POSIX I_SETSIG ioctl (SIGPOLL).
    
    Signed-off-by: Lee Essen <lee.essen at nowonline.co.uk>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Reviewed-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/qga/channel-posix.c b/qga/channel-posix.c
index 40f7658..57eea06 100644
--- a/qga/channel-posix.c
+++ b/qga/channel-posix.c
@@ -3,6 +3,10 @@
 #include "qemu_socket.h"
 #include "qga/channel.h"
 
+#ifdef CONFIG_SOLARIS
+#include <stropts.h>
+#endif
+
 #define GA_CHANNEL_BAUDRATE_DEFAULT B38400 /* for isa-serial channels */
 
 struct GAChannel {
@@ -123,11 +127,23 @@ static gboolean ga_channel_open(GAChannel *c, const gchar *path, GAChannelMethod
 
     switch (c->method) {
     case GA_CHANNEL_VIRTIO_SERIAL: {
-        int fd = qemu_open(path, O_RDWR | O_NONBLOCK | O_ASYNC);
+        int fd = qemu_open(path, O_RDWR | O_NONBLOCK
+#ifndef CONFIG_SOLARIS
+                           | O_ASYNC
+#endif
+                           );
         if (fd == -1) {
             g_critical("error opening channel: %s", strerror(errno));
             exit(EXIT_FAILURE);
         }
+#ifdef CONFIG_SOLARIS
+        ret = ioctl(fd, I_SETSIG, S_OUTPUT | S_INPUT | S_HIPRI);
+        if (ret == -1) {
+            g_critical("error setting event mask for channel: %s",
+                       strerror(errno));
+            exit(EXIT_FAILURE);
+        }
+#endif
         ret = ga_channel_client_add(c, fd);
         if (ret) {
             g_critical("error adding channel to main loop");
commit 3239ad04695f95ce060bdc2a0a6e1243d2068971
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Apr 29 19:15:02 2012 +0200

    main-loop: Calculate poll timeout using timeout argument
    
    The timeout argument was unused up to now,
    but it can be used to reduce the poll_timeout when it is infinite
    (negative value) or larger than timeout.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/main-loop.c b/main-loop.c
index 24cf540..eb3b6e6 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -425,7 +425,7 @@ static int os_host_main_loop_wait(uint32_t timeout)
     if (nfds >= 0) {
         ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv0);
         if (ret != 0) {
-            /* TODO. */
+            timeout = 0;
         }
     }
 
@@ -439,6 +439,10 @@ static int os_host_main_loop_wait(uint32_t timeout)
         poll_fds[n_poll_fds + i].events = G_IO_IN;
     }
 
+    if (poll_timeout < 0 || timeout < poll_timeout) {
+        poll_timeout = timeout;
+    }
+
     qemu_mutex_unlock_iothread();
     ret = g_poll(poll_fds, n_poll_fds + w->num, poll_timeout);
     qemu_mutex_lock_iothread();
commit 1b296044b6fa46757f755c86e05ed3bf99d78f26
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Apr 28 21:16:21 2012 +0200

    vga: Don't switch to 1 x 1 character text screen
    
    Initially, vga_get_text_resolution returns a text resolution of 1 x 1
    (vga register values are 0).
    
    This is visible during MIPS Malta boot with SDL. It also occurs with the
    i386 or x86_64 system emulation when it runs in single step mode:
    
    QEMU changes the size of the SDL window to the smallest possible value
    which is supported by the window manager. As this is not the calculated
    size, QEMU switches to scaled mode. When the BIOS or the VGA driver sets
    the normal text resolution, the window stays small and displays
    microscopic characters.
    
    Ignoring text resolutions of 1 x 1 or less avoids these problems.
    A similar workaround already exists for too large resolutions.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/hw/vga.c b/hw/vga.c
index f80860c..5824f85 100644
--- a/hw/vga.c
+++ b/hw/vga.c
@@ -1327,6 +1327,10 @@ static void vga_draw_text(VGACommonState *s, int full_update)
     line_offset = s->line_offset;
 
     vga_get_text_resolution(s, &width, &height, &cw, &cheight);
+    if ((height * width) <= 1) {
+        /* better than nothing: exit if transient size is too small */
+        return;
+    }
     if ((height * width) > CH_ATTR_SIZE) {
         /* better than nothing: exit if transient size is too big */
         return;
commit fd06257351683ba24ebebd9793df3fd0fb59988e
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Mon Apr 9 17:38:52 2012 +0000

    memory: move functions is_romd and section_addr to memory API
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/cputlb.h b/cputlb.h
index 80f9b66..2dc2c96 100644
--- a/cputlb.h
+++ b/cputlb.h
@@ -32,8 +32,6 @@ void tlb_set_dirty(CPUArchState *env, target_ulong vaddr);
 extern int tlb_flush_count;
 
 /* exec.c */
-target_phys_addr_t memory_region_section_addr(MemoryRegionSection *section,
-                                              target_phys_addr_t addr);
 void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr);
 target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
                                                    MemoryRegionSection *section,
@@ -43,9 +41,5 @@ target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
                                                    target_ulong *address);
 bool memory_region_is_unassigned(MemoryRegion *mr);
 
-static inline bool memory_region_is_romd(MemoryRegion *mr)
-{
-    return mr->rom_device && mr->readable;
-}
 #endif
 #endif
diff --git a/exec.c b/exec.c
index 62d4140..0607c9b 100644
--- a/exec.c
+++ b/exec.c
@@ -503,14 +503,6 @@ bool memory_region_is_unassigned(MemoryRegion *mr)
         && mr != &io_mem_watch;
 }
 
-target_phys_addr_t memory_region_section_addr(MemoryRegionSection *section,
-                                              target_phys_addr_t addr)
-{
-    addr -= section->offset_within_address_space;
-    addr += section->offset_within_region;
-    return addr;
-}
-
 #define mmap_lock() do { } while(0)
 #define mmap_unlock() do { } while(0)
 #endif
diff --git a/memory.h b/memory.h
index 53ff62b..740c48e 100644
--- a/memory.h
+++ b/memory.h
@@ -339,6 +339,19 @@ uint64_t memory_region_size(MemoryRegion *mr);
 bool memory_region_is_ram(MemoryRegion *mr);
 
 /**
+ * memory_region_is_romd: check whether a memory region is ROMD
+ *
+ * Returns %true is a memory region is ROMD and currently set to allow
+ * direct reads.
+ *
+ * @mr: the memory region being queried
+ */
+static inline bool memory_region_is_romd(MemoryRegion *mr)
+{
+    return mr->rom_device && mr->readable;
+}
+
+/**
  * memory_region_name: get a memory region's name
  *
  * Returns the string that was used to initialize the memory region.
@@ -666,6 +679,22 @@ void memory_region_set_alias_offset(MemoryRegion *mr,
 MemoryRegionSection memory_region_find(MemoryRegion *address_space,
                                        target_phys_addr_t addr, uint64_t size);
 
+/**
+ * memory_region_section_addr: get offset within MemoryRegionSection
+ *
+ * Returns offset within MemoryRegionSection
+ *
+ * @section: the memory region section being queried
+ * @addr: address in address space
+ */
+static inline target_phys_addr_t
+memory_region_section_addr(MemoryRegionSection *section,
+                           target_phys_addr_t addr)
+{
+    addr -= section->offset_within_address_space;
+    addr += section->offset_within_region;
+    return addr;
+}
 
 /**
  * memory_global_sync_dirty_bitmap: synchronize the dirty log for all memory
commit cc5bea608df30263f8d20facfd55d8b6ce15053d
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 14 14:56:48 2012 +0000

    cputlb: prepare private memory API for public consumption
    
    Fold is_ram_rom and is_ram_rom_romd() into callers.
    
    Change is_romd() and section_addr() to take MemoryRegion
    instead of MemoryRegionSection for consistency and
    use memory_region_ prefix.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/cputlb.c b/cputlb.c
index b7d8f07..7f40a62 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -260,13 +260,15 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
 #endif
 
     address = vaddr;
-    if (!is_ram_rom_romd(section)) {
+    if (!(memory_region_is_ram(section->mr) ||
+          memory_region_is_romd(section->mr))) {
         /* IO memory case (romd handled later) */
         address |= TLB_MMIO;
     }
-    if (is_ram_rom_romd(section)) {
+    if (memory_region_is_ram(section->mr) ||
+        memory_region_is_romd(section->mr)) {
         addend = (uintptr_t)memory_region_get_ram_ptr(section->mr)
-                                 + section_addr(section, paddr);
+        + memory_region_section_addr(section, paddr);
     } else {
         addend = 0;
     }
@@ -292,13 +294,13 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     }
     if (prot & PAGE_WRITE) {
         if ((memory_region_is_ram(section->mr) && section->readonly)
-            || is_romd(section)) {
+            || memory_region_is_romd(section->mr)) {
             /* Write access calls the I/O callback.  */
             te->addr_write = address | TLB_MMIO;
         } else if (memory_region_is_ram(section->mr)
                    && !cpu_physical_memory_is_dirty(
                            section->mr->ram_addr
-                           + section_addr(section, paddr))) {
+                           + memory_region_section_addr(section, paddr))) {
             te->addr_write = address | TLB_NOTDIRTY;
         } else {
             te->addr_write = address;
diff --git a/cputlb.h b/cputlb.h
index 0b0b764..80f9b66 100644
--- a/cputlb.h
+++ b/cputlb.h
@@ -32,8 +32,8 @@ void tlb_set_dirty(CPUArchState *env, target_ulong vaddr);
 extern int tlb_flush_count;
 
 /* exec.c */
-target_phys_addr_t section_addr(MemoryRegionSection *section,
-                                target_phys_addr_t addr);
+target_phys_addr_t memory_region_section_addr(MemoryRegionSection *section,
+                                              target_phys_addr_t addr);
 void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr);
 target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
                                                    MemoryRegionSection *section,
@@ -43,21 +43,9 @@ target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
                                                    target_ulong *address);
 bool memory_region_is_unassigned(MemoryRegion *mr);
 
-static inline bool is_ram_rom(MemoryRegionSection *s)
+static inline bool memory_region_is_romd(MemoryRegion *mr)
 {
-    return memory_region_is_ram(s->mr);
-}
-
-static inline bool is_romd(MemoryRegionSection *s)
-{
-    MemoryRegion *mr = s->mr;
-
     return mr->rom_device && mr->readable;
 }
-static inline bool is_ram_rom_romd(MemoryRegionSection *s)
-{
-    return is_ram_rom(s) || is_romd(s);
-}
-
 #endif
 #endif
diff --git a/exec.c b/exec.c
index e4bf6d7..62d4140 100644
--- a/exec.c
+++ b/exec.c
@@ -503,8 +503,8 @@ bool memory_region_is_unassigned(MemoryRegion *mr)
         && mr != &io_mem_watch;
 }
 
-target_phys_addr_t section_addr(MemoryRegionSection *section,
-                                target_phys_addr_t addr)
+target_phys_addr_t memory_region_section_addr(MemoryRegionSection *section,
+                                              target_phys_addr_t addr)
 {
     addr -= section->offset_within_address_space;
     addr += section->offset_within_region;
@@ -1477,7 +1477,7 @@ void tb_invalidate_phys_addr(target_phys_addr_t addr)
         return;
     }
     ram_addr = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
-        + section_addr(section, addr);
+        + memory_region_section_addr(section, addr);
     tb_invalidate_phys_page_range(ram_addr, ram_addr + 1, 0);
 }
 
@@ -1977,10 +1977,10 @@ target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
     target_phys_addr_t iotlb;
     CPUWatchpoint *wp;
 
-    if (is_ram_rom(section)) {
+    if (memory_region_is_ram(section->mr)) {
         /* Normal RAM.  */
         iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
-            + section_addr(section, paddr);
+            + memory_region_section_addr(section, paddr);
         if (!section->readonly) {
             iotlb |= phys_section_notdirty;
         } else {
@@ -1994,7 +1994,7 @@ target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
            We can't use the high bits of pd for this because
            IO_MEM_ROMD uses these as a ram address.  */
         iotlb = section - phys_sections;
-        iotlb += section_addr(section, paddr);
+        iotlb += memory_region_section_addr(section, paddr);
     }
 
     /* Make accesses to pages with watchpoints go via the
@@ -3517,7 +3517,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
         if (is_write) {
             if (!memory_region_is_ram(section->mr)) {
                 target_phys_addr_t addr1;
-                addr1 = section_addr(section, addr);
+                addr1 = memory_region_section_addr(section, addr);
                 /* XXX: could force cpu_single_env to NULL to avoid
                    potential bugs */
                 if (l >= 4 && ((addr1 & 3) == 0)) {
@@ -3539,7 +3539,7 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
             } else if (!section->readonly) {
                 ram_addr_t addr1;
                 addr1 = memory_region_get_ram_addr(section->mr)
-                    + section_addr(section, addr);
+                    + memory_region_section_addr(section, addr);
                 /* RAM case */
                 ptr = qemu_get_ram_ptr(addr1);
                 memcpy(ptr, buf, l);
@@ -3553,10 +3553,11 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
                 qemu_put_ram_ptr(ptr);
             }
         } else {
-            if (!is_ram_rom_romd(section)) {
+            if (!(memory_region_is_ram(section->mr) ||
+                  memory_region_is_romd(section->mr))) {
                 target_phys_addr_t addr1;
                 /* I/O case */
-                addr1 = section_addr(section, addr);
+                addr1 = memory_region_section_addr(section, addr);
                 if (l >= 4 && ((addr1 & 3) == 0)) {
                     /* 32 bit read access */
                     val = io_mem_read(section->mr, addr1, 4);
@@ -3576,7 +3577,8 @@ void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf,
             } else {
                 /* RAM case */
                 ptr = qemu_get_ram_ptr(section->mr->ram_addr
-                                       + section_addr(section, addr));
+                                       + memory_region_section_addr(section,
+                                                                    addr));
                 memcpy(buf, ptr, l);
                 qemu_put_ram_ptr(ptr);
             }
@@ -3603,12 +3605,13 @@ void cpu_physical_memory_write_rom(target_phys_addr_t addr,
             l = len;
         section = phys_page_find(page >> TARGET_PAGE_BITS);
 
-        if (!is_ram_rom_romd(section)) {
+        if (!(memory_region_is_ram(section->mr) ||
+              memory_region_is_romd(section->mr))) {
             /* do nothing */
         } else {
             unsigned long addr1;
             addr1 = memory_region_get_ram_addr(section->mr)
-                + section_addr(section, addr);
+                + memory_region_section_addr(section, addr);
             /* ROM/RAM case */
             ptr = qemu_get_ram_ptr(addr1);
             memcpy(ptr, buf, l);
@@ -3709,7 +3712,7 @@ void *cpu_physical_memory_map(target_phys_addr_t addr,
         }
         if (!todo) {
             raddr = memory_region_get_ram_addr(section->mr)
-                + section_addr(section, addr);
+                + memory_region_section_addr(section, addr);
         }
 
         len -= l;
@@ -3771,9 +3774,10 @@ static inline uint32_t ldl_phys_internal(target_phys_addr_t addr,
 
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
-    if (!is_ram_rom_romd(section)) {
+    if (!(memory_region_is_ram(section->mr) ||
+          memory_region_is_romd(section->mr))) {
         /* I/O case */
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         val = io_mem_read(section->mr, addr, 4);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
@@ -3788,7 +3792,7 @@ static inline uint32_t ldl_phys_internal(target_phys_addr_t addr,
         /* RAM case */
         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(section->mr)
                                 & TARGET_PAGE_MASK)
-                               + section_addr(section, addr));
+                               + memory_region_section_addr(section, addr));
         switch (endian) {
         case DEVICE_LITTLE_ENDIAN:
             val = ldl_le_p(ptr);
@@ -3829,9 +3833,10 @@ static inline uint64_t ldq_phys_internal(target_phys_addr_t addr,
 
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
-    if (!is_ram_rom_romd(section)) {
+    if (!(memory_region_is_ram(section->mr) ||
+          memory_region_is_romd(section->mr))) {
         /* I/O case */
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
 
         /* XXX This is broken when device endian != cpu endian.
                Fix and add "endian" variable check */
@@ -3846,7 +3851,7 @@ static inline uint64_t ldq_phys_internal(target_phys_addr_t addr,
         /* RAM case */
         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(section->mr)
                                 & TARGET_PAGE_MASK)
-                               + section_addr(section, addr));
+                               + memory_region_section_addr(section, addr));
         switch (endian) {
         case DEVICE_LITTLE_ENDIAN:
             val = ldq_le_p(ptr);
@@ -3895,9 +3900,10 @@ static inline uint32_t lduw_phys_internal(target_phys_addr_t addr,
 
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
-    if (!is_ram_rom_romd(section)) {
+    if (!(memory_region_is_ram(section->mr) ||
+          memory_region_is_romd(section->mr))) {
         /* I/O case */
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         val = io_mem_read(section->mr, addr, 2);
 #if defined(TARGET_WORDS_BIGENDIAN)
         if (endian == DEVICE_LITTLE_ENDIAN) {
@@ -3912,7 +3918,7 @@ static inline uint32_t lduw_phys_internal(target_phys_addr_t addr,
         /* RAM case */
         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(section->mr)
                                 & TARGET_PAGE_MASK)
-                               + section_addr(section, addr));
+                               + memory_region_section_addr(section, addr));
         switch (endian) {
         case DEVICE_LITTLE_ENDIAN:
             val = lduw_le_p(ptr);
@@ -3954,7 +3960,7 @@ void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
     if (!memory_region_is_ram(section->mr) || section->readonly) {
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         if (memory_region_is_ram(section->mr)) {
             section = &phys_sections[phys_section_rom];
         }
@@ -3962,7 +3968,7 @@ void stl_phys_notdirty(target_phys_addr_t addr, uint32_t val)
     } else {
         unsigned long addr1 = (memory_region_get_ram_addr(section->mr)
                                & TARGET_PAGE_MASK)
-            + section_addr(section, addr);
+            + memory_region_section_addr(section, addr);
         ptr = qemu_get_ram_ptr(addr1);
         stl_p(ptr, val);
 
@@ -3986,7 +3992,7 @@ void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
     if (!memory_region_is_ram(section->mr) || section->readonly) {
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         if (memory_region_is_ram(section->mr)) {
             section = &phys_sections[phys_section_rom];
         }
@@ -4000,7 +4006,7 @@ void stq_phys_notdirty(target_phys_addr_t addr, uint64_t val)
     } else {
         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(section->mr)
                                 & TARGET_PAGE_MASK)
-                               + section_addr(section, addr));
+                               + memory_region_section_addr(section, addr));
         stq_p(ptr, val);
     }
 }
@@ -4015,7 +4021,7 @@ static inline void stl_phys_internal(target_phys_addr_t addr, uint32_t val,
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
     if (!memory_region_is_ram(section->mr) || section->readonly) {
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         if (memory_region_is_ram(section->mr)) {
             section = &phys_sections[phys_section_rom];
         }
@@ -4032,7 +4038,7 @@ static inline void stl_phys_internal(target_phys_addr_t addr, uint32_t val,
     } else {
         unsigned long addr1;
         addr1 = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
-            + section_addr(section, addr);
+            + memory_region_section_addr(section, addr);
         /* RAM case */
         ptr = qemu_get_ram_ptr(addr1);
         switch (endian) {
@@ -4088,7 +4094,7 @@ static inline void stw_phys_internal(target_phys_addr_t addr, uint32_t val,
     section = phys_page_find(addr >> TARGET_PAGE_BITS);
 
     if (!memory_region_is_ram(section->mr) || section->readonly) {
-        addr = section_addr(section, addr);
+        addr = memory_region_section_addr(section, addr);
         if (memory_region_is_ram(section->mr)) {
             section = &phys_sections[phys_section_rom];
         }
@@ -4105,7 +4111,7 @@ static inline void stw_phys_internal(target_phys_addr_t addr, uint32_t val,
     } else {
         unsigned long addr1;
         addr1 = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
-            + section_addr(section, addr);
+            + memory_region_section_addr(section, addr);
         /* RAM case */
         ptr = qemu_get_ram_ptr(addr1);
         switch (endian) {
commit 0cac1b66c88c4cd3ec1d358091486787837215a3
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Mon Apr 9 16:50:52 2012 +0000

    cputlb: move TLB handling to a separate file
    
    Move TLB handling and softmmu code load helpers to cputlb.c,
    compile only for softmmu targets.
    
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/Makefile.target b/Makefile.target
index 9f8cb0c..1582904 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -191,7 +191,7 @@ obj-$(CONFIG_REALLY_VIRTFS) += 9pfs/virtio-9p-device.o
 obj-$(CONFIG_KVM) += kvm.o kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
 obj-$(CONFIG_VGA) += vga.o
-obj-y += memory.o savevm.o
+obj-y += memory.o savevm.o cputlb.o
 LIBS+=-lz
 
 obj-i386-$(CONFIG_KVM) += hyperv.o
diff --git a/cputlb.c b/cputlb.c
new file mode 100644
index 0000000..b7d8f07
--- /dev/null
+++ b/cputlb.c
@@ -0,0 +1,362 @@
+/*
+ *  Common CPU TLB handling
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "config.h"
+#include "cpu.h"
+#include "exec-all.h"
+#include "memory.h"
+
+#include "cputlb.h"
+
+#define WANT_EXEC_OBSOLETE
+#include "exec-obsolete.h"
+
+//#define DEBUG_TLB
+//#define DEBUG_TLB_CHECK
+
+/* statistics */
+int tlb_flush_count;
+
+static const CPUTLBEntry s_cputlb_empty_entry = {
+    .addr_read  = -1,
+    .addr_write = -1,
+    .addr_code  = -1,
+    .addend     = -1,
+};
+
+/* NOTE:
+ * If flush_global is true (the usual case), flush all tlb entries.
+ * If flush_global is false, flush (at least) all tlb entries not
+ * marked global.
+ *
+ * Since QEMU doesn't currently implement a global/not-global flag
+ * for tlb entries, at the moment tlb_flush() will also flush all
+ * tlb entries in the flush_global == false case. This is OK because
+ * CPU architectures generally permit an implementation to drop
+ * entries from the TLB at any time, so flushing more entries than
+ * required is only an efficiency issue, not a correctness issue.
+ */
+void tlb_flush(CPUArchState *env, int flush_global)
+{
+    int i;
+
+#if defined(DEBUG_TLB)
+    printf("tlb_flush:\n");
+#endif
+    /* must reset current TB so that interrupts cannot modify the
+       links while we are modifying them */
+    env->current_tb = NULL;
+
+    for (i = 0; i < CPU_TLB_SIZE; i++) {
+        int mmu_idx;
+
+        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+            env->tlb_table[mmu_idx][i] = s_cputlb_empty_entry;
+        }
+    }
+
+    memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
+
+    env->tlb_flush_addr = -1;
+    env->tlb_flush_mask = 0;
+    tlb_flush_count++;
+}
+
+static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
+{
+    if (addr == (tlb_entry->addr_read &
+                 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
+        addr == (tlb_entry->addr_write &
+                 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
+        addr == (tlb_entry->addr_code &
+                 (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
+        *tlb_entry = s_cputlb_empty_entry;
+    }
+}
+
+void tlb_flush_page(CPUArchState *env, target_ulong addr)
+{
+    int i;
+    int mmu_idx;
+
+#if defined(DEBUG_TLB)
+    printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
+#endif
+    /* Check if we need to flush due to large pages.  */
+    if ((addr & env->tlb_flush_mask) == env->tlb_flush_addr) {
+#if defined(DEBUG_TLB)
+        printf("tlb_flush_page: forced full flush ("
+               TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
+               env->tlb_flush_addr, env->tlb_flush_mask);
+#endif
+        tlb_flush(env, 1);
+        return;
+    }
+    /* must reset current TB so that interrupts cannot modify the
+       links while we are modifying them */
+    env->current_tb = NULL;
+
+    addr &= TARGET_PAGE_MASK;
+    i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+        tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
+    }
+
+    tb_flush_jmp_cache(env, addr);
+}
+
+/* update the TLBs so that writes to code in the virtual page 'addr'
+   can be detected */
+void tlb_protect_code(ram_addr_t ram_addr)
+{
+    cpu_physical_memory_reset_dirty(ram_addr,
+                                    ram_addr + TARGET_PAGE_SIZE,
+                                    CODE_DIRTY_FLAG);
+}
+
+/* update the TLB so that writes in physical page 'phys_addr' are no longer
+   tested for self modifying code */
+void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
+                             target_ulong vaddr)
+{
+    cpu_physical_memory_set_dirty_flags(ram_addr, CODE_DIRTY_FLAG);
+}
+
+static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)
+{
+    return (tlbe->addr_write & (TLB_INVALID_MASK|TLB_MMIO|TLB_NOTDIRTY)) == 0;
+}
+
+void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
+                           uintptr_t length)
+{
+    uintptr_t addr;
+
+    if (tlb_is_dirty_ram(tlb_entry)) {
+        addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
+        if ((addr - start) < length) {
+            tlb_entry->addr_write |= TLB_NOTDIRTY;
+        }
+    }
+}
+
+static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
+{
+    ram_addr_t ram_addr;
+    void *p;
+
+    if (tlb_is_dirty_ram(tlb_entry)) {
+        p = (void *)(uintptr_t)((tlb_entry->addr_write & TARGET_PAGE_MASK)
+            + tlb_entry->addend);
+        ram_addr = qemu_ram_addr_from_host_nofail(p);
+        if (!cpu_physical_memory_is_dirty(ram_addr)) {
+            tlb_entry->addr_write |= TLB_NOTDIRTY;
+        }
+    }
+}
+
+void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
+{
+    CPUArchState *env;
+
+    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        int mmu_idx;
+
+        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+            unsigned int i;
+
+            for (i = 0; i < CPU_TLB_SIZE; i++) {
+                tlb_reset_dirty_range(&env->tlb_table[mmu_idx][i],
+                                      start1, length);
+            }
+        }
+    }
+}
+
+static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
+{
+    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY)) {
+        tlb_entry->addr_write = vaddr;
+    }
+}
+
+/* update the TLB corresponding to virtual page vaddr
+   so that it is no longer dirty */
+void tlb_set_dirty(CPUArchState *env, target_ulong vaddr)
+{
+    int i;
+    int mmu_idx;
+
+    vaddr &= TARGET_PAGE_MASK;
+    i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+        tlb_set_dirty1(&env->tlb_table[mmu_idx][i], vaddr);
+    }
+}
+
+/* Our TLB does not support large pages, so remember the area covered by
+   large pages and trigger a full TLB flush if these are invalidated.  */
+static void tlb_add_large_page(CPUArchState *env, target_ulong vaddr,
+                               target_ulong size)
+{
+    target_ulong mask = ~(size - 1);
+
+    if (env->tlb_flush_addr == (target_ulong)-1) {
+        env->tlb_flush_addr = vaddr & mask;
+        env->tlb_flush_mask = mask;
+        return;
+    }
+    /* Extend the existing region to include the new page.
+       This is a compromise between unnecessary flushes and the cost
+       of maintaining a full variable size TLB.  */
+    mask &= env->tlb_flush_mask;
+    while (((env->tlb_flush_addr ^ vaddr) & mask) != 0) {
+        mask <<= 1;
+    }
+    env->tlb_flush_addr &= mask;
+    env->tlb_flush_mask = mask;
+}
+
+/* Add a new TLB entry. At most one entry for a given virtual address
+   is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
+   supplied size is only used by tlb_flush_page.  */
+void tlb_set_page(CPUArchState *env, target_ulong vaddr,
+                  target_phys_addr_t paddr, int prot,
+                  int mmu_idx, target_ulong size)
+{
+    MemoryRegionSection *section;
+    unsigned int index;
+    target_ulong address;
+    target_ulong code_address;
+    uintptr_t addend;
+    CPUTLBEntry *te;
+    target_phys_addr_t iotlb;
+
+    assert(size >= TARGET_PAGE_SIZE);
+    if (size != TARGET_PAGE_SIZE) {
+        tlb_add_large_page(env, vaddr, size);
+    }
+    section = phys_page_find(paddr >> TARGET_PAGE_BITS);
+#if defined(DEBUG_TLB)
+    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
+           " prot=%x idx=%d pd=0x%08lx\n",
+           vaddr, paddr, prot, mmu_idx, pd);
+#endif
+
+    address = vaddr;
+    if (!is_ram_rom_romd(section)) {
+        /* IO memory case (romd handled later) */
+        address |= TLB_MMIO;
+    }
+    if (is_ram_rom_romd(section)) {
+        addend = (uintptr_t)memory_region_get_ram_ptr(section->mr)
+                                 + section_addr(section, paddr);
+    } else {
+        addend = 0;
+    }
+    iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, prot,
+                                            &address);
+
+    code_address = address;
+
+    index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    env->iotlb[mmu_idx][index] = iotlb - vaddr;
+    te = &env->tlb_table[mmu_idx][index];
+    te->addend = addend - vaddr;
+    if (prot & PAGE_READ) {
+        te->addr_read = address;
+    } else {
+        te->addr_read = -1;
+    }
+
+    if (prot & PAGE_EXEC) {
+        te->addr_code = code_address;
+    } else {
+        te->addr_code = -1;
+    }
+    if (prot & PAGE_WRITE) {
+        if ((memory_region_is_ram(section->mr) && section->readonly)
+            || is_romd(section)) {
+            /* Write access calls the I/O callback.  */
+            te->addr_write = address | TLB_MMIO;
+        } else if (memory_region_is_ram(section->mr)
+                   && !cpu_physical_memory_is_dirty(
+                           section->mr->ram_addr
+                           + section_addr(section, paddr))) {
+            te->addr_write = address | TLB_NOTDIRTY;
+        } else {
+            te->addr_write = address;
+        }
+    } else {
+        te->addr_write = -1;
+    }
+}
+
+/* NOTE: this function can trigger an exception */
+/* NOTE2: the returned address is not exactly the physical address: it
+   is the offset relative to phys_ram_base */
+tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
+{
+    int mmu_idx, page_index, pd;
+    void *p;
+    MemoryRegion *mr;
+
+    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
+    mmu_idx = cpu_mmu_index(env1);
+    if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
+                 (addr & TARGET_PAGE_MASK))) {
+#ifdef CONFIG_TCG_PASS_AREG0
+        cpu_ldub_code(env1, addr);
+#else
+        ldub_code(addr);
+#endif
+    }
+    pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
+    mr = iotlb_to_region(pd);
+    if (memory_region_is_unassigned(mr)) {
+#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC)
+        cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
+#else
+        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
+                  TARGET_FMT_lx "\n", addr);
+#endif
+    }
+    p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
+    return qemu_ram_addr_from_host_nofail(p);
+}
+
+#define MMUSUFFIX _cmmu
+#undef GETPC
+#define GETPC() ((uintptr_t)0)
+#define env cpu_single_env
+#define SOFTMMU_CODE_ACCESS
+
+#define SHIFT 0
+#include "softmmu_template.h"
+
+#define SHIFT 1
+#include "softmmu_template.h"
+
+#define SHIFT 2
+#include "softmmu_template.h"
+
+#define SHIFT 3
+#include "softmmu_template.h"
+
+#undef env
diff --git a/cputlb.h b/cputlb.h
new file mode 100644
index 0000000..0b0b764
--- /dev/null
+++ b/cputlb.h
@@ -0,0 +1,63 @@
+/*
+ *  Common CPU TLB handling
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef CPUTLB_H
+#define CPUTLB_H
+
+#if !defined(CONFIG_USER_ONLY)
+/* cputlb.c */
+void tlb_protect_code(ram_addr_t ram_addr);
+void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
+                             target_ulong vaddr);
+void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry, uintptr_t start,
+                           uintptr_t length);
+MemoryRegionSection *phys_page_find(target_phys_addr_t index);
+void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length);
+void tlb_set_dirty(CPUArchState *env, target_ulong vaddr);
+extern int tlb_flush_count;
+
+/* exec.c */
+target_phys_addr_t section_addr(MemoryRegionSection *section,
+                                target_phys_addr_t addr);
+void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr);
+target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
+                                                   MemoryRegionSection *section,
+                                                   target_ulong vaddr,
+                                                   target_phys_addr_t paddr,
+                                                   int prot,
+                                                   target_ulong *address);
+bool memory_region_is_unassigned(MemoryRegion *mr);
+
+static inline bool is_ram_rom(MemoryRegionSection *s)
+{
+    return memory_region_is_ram(s->mr);
+}
+
+static inline bool is_romd(MemoryRegionSection *s)
+{
+    MemoryRegion *mr = s->mr;
+
+    return mr->rom_device && mr->readable;
+}
+static inline bool is_ram_rom_romd(MemoryRegionSection *s)
+{
+    return is_ram_rom(s) || is_romd(s);
+}
+
+#endif
+#endif
diff --git a/exec-all.h b/exec-all.h
index 937d3ce..c1b7e1f 100644
--- a/exec-all.h
+++ b/exec-all.h
@@ -96,13 +96,22 @@ void QEMU_NORETURN cpu_loop_exit(CPUArchState *env1);
 int page_unprotect(target_ulong address, uintptr_t pc, void *puc);
 void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
                                    int is_cpu_write_access);
+#if !defined(CONFIG_USER_ONLY)
+/* cputlb.c */
 void tlb_flush_page(CPUArchState *env, target_ulong addr);
 void tlb_flush(CPUArchState *env, int flush_global);
-#if !defined(CONFIG_USER_ONLY)
 void tlb_set_page(CPUArchState *env, target_ulong vaddr,
                   target_phys_addr_t paddr, int prot,
                   int mmu_idx, target_ulong size);
 void tb_invalidate_phys_addr(target_phys_addr_t addr);
+#else
+static inline void tlb_flush_page(CPUArchState *env, target_ulong addr)
+{
+}
+
+static inline void tlb_flush(CPUArchState *env, int flush_global)
+{
+}
 #endif
 
 #define CODE_GEN_ALIGN           16 /* must be >= of the size of a icache line */
@@ -340,6 +349,7 @@ static inline tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong
     return addr;
 }
 #else
+/* cputlb.c */
 tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr);
 #endif
 
diff --git a/exec.c b/exec.c
index d93a14d..e4bf6d7 100644
--- a/exec.c
+++ b/exec.c
@@ -57,17 +57,17 @@
 #include "trace.h"
 #endif
 
+#include "cputlb.h"
+
 #define WANT_EXEC_OBSOLETE
 #include "exec-obsolete.h"
 
 //#define DEBUG_TB_INVALIDATE
 //#define DEBUG_FLUSH
-//#define DEBUG_TLB
 //#define DEBUG_UNASSIGNED
 
 /* make various TB consistency checks */
 //#define DEBUG_TB_CHECK
-//#define DEBUG_TLB_CHECK
 
 //#define DEBUG_IOPORT
 //#define DEBUG_SUBPAGE
@@ -227,9 +227,6 @@ int loglevel;
 static int log_append = 0;
 
 /* statistics */
-#if !defined(CONFIG_USER_ONLY)
-static int tlb_flush_count;
-#endif
 static int tb_flush_count;
 static int tb_phys_invalidate_count;
 
@@ -479,7 +476,7 @@ static void phys_page_set(target_phys_addr_t index, target_phys_addr_t nb,
     phys_page_set_level(&phys_map, &index, &nb, leaf, P_L2_LEVELS - 1);
 }
 
-static MemoryRegionSection *phys_page_find(target_phys_addr_t index)
+MemoryRegionSection *phys_page_find(target_phys_addr_t index)
 {
     PhysPageEntry lp = phys_map;
     PhysPageEntry *p;
@@ -499,7 +496,6 @@ not_found:
     return &phys_sections[s_index];
 }
 
-static
 bool memory_region_is_unassigned(MemoryRegion *mr)
 {
     return mr != &io_mem_ram && mr != &io_mem_rom
@@ -507,17 +503,14 @@ bool memory_region_is_unassigned(MemoryRegion *mr)
         && mr != &io_mem_watch;
 }
 
-static target_phys_addr_t section_addr(MemoryRegionSection *section,
-                                       target_phys_addr_t addr)
+target_phys_addr_t section_addr(MemoryRegionSection *section,
+                                target_phys_addr_t addr)
 {
     addr -= section->offset_within_address_space;
     addr += section->offset_within_region;
     return addr;
 }
 
-static void tlb_protect_code(ram_addr_t ram_addr);
-static void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
-                                    target_ulong vaddr);
 #define mmap_lock() do { } while(0)
 #define mmap_unlock() do { } while(0)
 #endif
@@ -1926,8 +1919,7 @@ CPUArchState *cpu_copy(CPUArchState *env)
 }
 
 #if !defined(CONFIG_USER_ONLY)
-
-static inline void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
+void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
 {
     unsigned int i;
 
@@ -1942,147 +1934,6 @@ static inline void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
             TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
 }
 
-static const CPUTLBEntry s_cputlb_empty_entry = {
-    .addr_read  = -1,
-    .addr_write = -1,
-    .addr_code  = -1,
-    .addend     = -1,
-};
-
-/* NOTE:
- * If flush_global is true (the usual case), flush all tlb entries.
- * If flush_global is false, flush (at least) all tlb entries not
- * marked global.
- *
- * Since QEMU doesn't currently implement a global/not-global flag
- * for tlb entries, at the moment tlb_flush() will also flush all
- * tlb entries in the flush_global == false case. This is OK because
- * CPU architectures generally permit an implementation to drop
- * entries from the TLB at any time, so flushing more entries than
- * required is only an efficiency issue, not a correctness issue.
- */
-void tlb_flush(CPUArchState *env, int flush_global)
-{
-    int i;
-
-#if defined(DEBUG_TLB)
-    printf("tlb_flush:\n");
-#endif
-    /* must reset current TB so that interrupts cannot modify the
-       links while we are modifying them */
-    env->current_tb = NULL;
-
-    for (i = 0; i < CPU_TLB_SIZE; i++) {
-        int mmu_idx;
-
-        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-            env->tlb_table[mmu_idx][i] = s_cputlb_empty_entry;
-        }
-    }
-
-    memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
-
-    env->tlb_flush_addr = -1;
-    env->tlb_flush_mask = 0;
-    tlb_flush_count++;
-}
-
-static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
-{
-    if (addr == (tlb_entry->addr_read &
-                 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
-        addr == (tlb_entry->addr_write &
-                 (TARGET_PAGE_MASK | TLB_INVALID_MASK)) ||
-        addr == (tlb_entry->addr_code &
-                 (TARGET_PAGE_MASK | TLB_INVALID_MASK))) {
-        *tlb_entry = s_cputlb_empty_entry;
-    }
-}
-
-void tlb_flush_page(CPUArchState *env, target_ulong addr)
-{
-    int i;
-    int mmu_idx;
-
-#if defined(DEBUG_TLB)
-    printf("tlb_flush_page: " TARGET_FMT_lx "\n", addr);
-#endif
-    /* Check if we need to flush due to large pages.  */
-    if ((addr & env->tlb_flush_mask) == env->tlb_flush_addr) {
-#if defined(DEBUG_TLB)
-        printf("tlb_flush_page: forced full flush ("
-               TARGET_FMT_lx "/" TARGET_FMT_lx ")\n",
-               env->tlb_flush_addr, env->tlb_flush_mask);
-#endif
-        tlb_flush(env, 1);
-        return;
-    }
-    /* must reset current TB so that interrupts cannot modify the
-       links while we are modifying them */
-    env->current_tb = NULL;
-
-    addr &= TARGET_PAGE_MASK;
-    i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
-    }
-
-    tb_flush_jmp_cache(env, addr);
-}
-
-/* update the TLBs so that writes to code in the virtual page 'addr'
-   can be detected */
-static void tlb_protect_code(ram_addr_t ram_addr)
-{
-    cpu_physical_memory_reset_dirty(ram_addr,
-                                    ram_addr + TARGET_PAGE_SIZE,
-                                    CODE_DIRTY_FLAG);
-}
-
-/* update the TLB so that writes in physical page 'phys_addr' are no longer
-   tested for self modifying code */
-static void tlb_unprotect_code_phys(CPUArchState *env, ram_addr_t ram_addr,
-                                    target_ulong vaddr)
-{
-    cpu_physical_memory_set_dirty_flags(ram_addr, CODE_DIRTY_FLAG);
-}
-
-static bool tlb_is_dirty_ram(CPUTLBEntry *tlbe)
-{
-    return (tlbe->addr_write & (TLB_INVALID_MASK|TLB_MMIO|TLB_NOTDIRTY)) == 0;
-}
-
-static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
-                                         uintptr_t start, uintptr_t length)
-{
-    uintptr_t addr;
-
-    if (tlb_is_dirty_ram(tlb_entry)) {
-        addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
-        if ((addr - start) < length) {
-            tlb_entry->addr_write |= TLB_NOTDIRTY;
-        }
-    }
-}
-
-static void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
-{
-    CPUArchState *env;
-
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        int mmu_idx;
-
-        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-            unsigned int i;
-
-            for (i = 0; i < CPU_TLB_SIZE; i++) {
-                tlb_reset_dirty_range(&env->tlb_table[mmu_idx][i],
-                                      start1, length);
-            }
-        }
-    }
-}
-
 /* Note: start and end must be within the same ram block.  */
 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
                                      int dirty_flags)
@@ -2116,83 +1967,6 @@ int cpu_physical_memory_set_dirty_tracking(int enable)
     return ret;
 }
 
-static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
-{
-    ram_addr_t ram_addr;
-    void *p;
-
-    if (tlb_is_dirty_ram(tlb_entry)) {
-        p = (void *)(uintptr_t)((tlb_entry->addr_write & TARGET_PAGE_MASK)
-            + tlb_entry->addend);
-        ram_addr = qemu_ram_addr_from_host_nofail(p);
-        if (!cpu_physical_memory_is_dirty(ram_addr)) {
-            tlb_entry->addr_write |= TLB_NOTDIRTY;
-        }
-    }
-}
-
-static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
-{
-    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY)) {
-        tlb_entry->addr_write = vaddr;
-    }
-}
-
-/* update the TLB corresponding to virtual page vaddr
-   so that it is no longer dirty */
-static inline void tlb_set_dirty(CPUArchState *env, target_ulong vaddr)
-{
-    int i;
-    int mmu_idx;
-
-    vaddr &= TARGET_PAGE_MASK;
-    i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        tlb_set_dirty1(&env->tlb_table[mmu_idx][i], vaddr);
-    }
-}
-
-/* Our TLB does not support large pages, so remember the area covered by
-   large pages and trigger a full TLB flush if these are invalidated.  */
-static void tlb_add_large_page(CPUArchState *env, target_ulong vaddr,
-                               target_ulong size)
-{
-    target_ulong mask = ~(size - 1);
-
-    if (env->tlb_flush_addr == (target_ulong)-1) {
-        env->tlb_flush_addr = vaddr & mask;
-        env->tlb_flush_mask = mask;
-        return;
-    }
-    /* Extend the existing region to include the new page.
-       This is a compromise between unnecessary flushes and the cost
-       of maintaining a full variable size TLB.  */
-    mask &= env->tlb_flush_mask;
-    while (((env->tlb_flush_addr ^ vaddr) & mask) != 0) {
-        mask <<= 1;
-    }
-    env->tlb_flush_addr &= mask;
-    env->tlb_flush_mask = mask;
-}
-
-static bool is_ram_rom(MemoryRegionSection *s)
-{
-    return memory_region_is_ram(s->mr);
-}
-
-static bool is_romd(MemoryRegionSection *s)
-{
-    MemoryRegion *mr = s->mr;
-
-    return mr->rom_device && mr->readable;
-}
-
-static bool is_ram_rom_romd(MemoryRegionSection *s)
-{
-    return is_ram_rom(s) || is_romd(s);
-}
-
-static
 target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
                                                    MemoryRegionSection *section,
                                                    target_ulong vaddr,
@@ -2239,91 +2013,7 @@ target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
     return iotlb;
 }
 
-/* Add a new TLB entry. At most one entry for a given virtual address
-   is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
-   supplied size is only used by tlb_flush_page.  */
-void tlb_set_page(CPUArchState *env, target_ulong vaddr,
-                  target_phys_addr_t paddr, int prot,
-                  int mmu_idx, target_ulong size)
-{
-    MemoryRegionSection *section;
-    unsigned int index;
-    target_ulong address;
-    target_ulong code_address;
-    uintptr_t addend;
-    CPUTLBEntry *te;
-    target_phys_addr_t iotlb;
-
-    assert(size >= TARGET_PAGE_SIZE);
-    if (size != TARGET_PAGE_SIZE) {
-        tlb_add_large_page(env, vaddr, size);
-    }
-    section = phys_page_find(paddr >> TARGET_PAGE_BITS);
-#if defined(DEBUG_TLB)
-    printf("tlb_set_page: vaddr=" TARGET_FMT_lx " paddr=0x" TARGET_FMT_plx
-           " prot=%x idx=%d pd=0x%08lx\n",
-           vaddr, paddr, prot, mmu_idx, pd);
-#endif
-
-    address = vaddr;
-    if (!is_ram_rom_romd(section)) {
-        /* IO memory case (romd handled later) */
-        address |= TLB_MMIO;
-    }
-    if (is_ram_rom_romd(section)) {
-        addend = (uintptr_t)memory_region_get_ram_ptr(section->mr)
-                                 + section_addr(section, paddr);
-    } else {
-        addend = 0;
-    }
-    iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, prot,
-                                            &address);
-
-    code_address = address;
-
-    index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    env->iotlb[mmu_idx][index] = iotlb - vaddr;
-    te = &env->tlb_table[mmu_idx][index];
-    te->addend = addend - vaddr;
-    if (prot & PAGE_READ) {
-        te->addr_read = address;
-    } else {
-        te->addr_read = -1;
-    }
-
-    if (prot & PAGE_EXEC) {
-        te->addr_code = code_address;
-    } else {
-        te->addr_code = -1;
-    }
-    if (prot & PAGE_WRITE) {
-        if ((memory_region_is_ram(section->mr) && section->readonly)
-            || is_romd(section)) {
-            /* Write access calls the I/O callback.  */
-            te->addr_write = address | TLB_MMIO;
-        } else if (memory_region_is_ram(section->mr)
-                   && !cpu_physical_memory_is_dirty(
-                           section->mr->ram_addr
-                           + section_addr(section, paddr))) {
-            te->addr_write = address | TLB_NOTDIRTY;
-        } else {
-            te->addr_write = address;
-        }
-    } else {
-        te->addr_write = -1;
-    }
-}
-
 #else
-
-void tlb_flush(CPUArchState *env, int flush_global)
-{
-}
-
-void tlb_flush_page(CPUArchState *env, target_ulong addr)
-{
-}
-
 /*
  * Walks guest process memory "regions" one by one
  * and calls callback function 'fn' for each region.
@@ -2580,11 +2270,6 @@ int page_unprotect(target_ulong address, uintptr_t pc, void *puc)
     mmap_unlock();
     return 0;
 }
-
-static inline void tlb_set_dirty(CPUArchState *env,
-                                 uintptr_t addr, target_ulong vaddr)
-{
-}
 #endif /* defined(CONFIG_USER_ONLY) */
 
 #if !defined(CONFIG_USER_ONLY)
@@ -4621,39 +4306,6 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
     tcg_dump_info(f, cpu_fprintf);
 }
 
-/* NOTE: this function can trigger an exception */
-/* NOTE2: the returned address is not exactly the physical address: it
-   is the offset relative to phys_ram_base */
-tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
-{
-    int mmu_idx, page_index, pd;
-    void *p;
-    MemoryRegion *mr;
-
-    page_index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    mmu_idx = cpu_mmu_index(env1);
-    if (unlikely(env1->tlb_table[mmu_idx][page_index].addr_code !=
-                 (addr & TARGET_PAGE_MASK))) {
-#ifdef CONFIG_TCG_PASS_AREG0
-        cpu_ldub_code(env1, addr);
-#else
-        ldub_code(addr);
-#endif
-    }
-    pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
-    mr = iotlb_to_region(pd);
-    if (memory_region_is_unassigned(mr)) {
-#if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC)
-        cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
-#else
-        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
-                  TARGET_FMT_lx "\n", addr);
-#endif
-    }
-    p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
-    return qemu_ram_addr_from_host_nofail(p);
-}
-
 /*
  * A helper function for the _utterly broken_ virtio device model to find out if
  * it's running on a big endian machine. Don't do this at home kids!
@@ -4668,24 +4320,4 @@ bool virtio_is_big_endian(void)
 #endif
 }
 
-#define MMUSUFFIX _cmmu
-#undef GETPC
-#define GETPC() ((uintptr_t)0)
-#define env cpu_single_env
-#define SOFTMMU_CODE_ACCESS
-
-#define SHIFT 0
-#include "softmmu_template.h"
-
-#define SHIFT 1
-#include "softmmu_template.h"
-
-#define SHIFT 2
-#include "softmmu_template.h"
-
-#define SHIFT 3
-#include "softmmu_template.h"
-
-#undef env
-
 #endif
commit e554861766d9ae84dd5720baa4869f4ed711506f
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 21 13:08:33 2012 +0000

    exec: prepare for splitting
    
    Make s_cputlb_empty_entry 'const'.
    
    Rename tlb_flush_jmp_cache() to tb_flush_jmp_cache().
    
    Refactor code to add cpu_tlb_reset_dirty_all(),
    memory_region_section_get_iotlb() and
    memory_region_is_unassigned().
    
    Remove unused cpu_tlb_update_dirty().
    
    Fix coding style in areas to be moved.
    
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/cpu-all.h b/cpu-all.h
index f7d6867..028528f 100644
--- a/cpu-all.h
+++ b/cpu-all.h
@@ -518,8 +518,6 @@ extern int mem_prealloc;
 /* Set if TLB entry is an IO callback.  */
 #define TLB_MMIO        (1 << 5)
 
-void cpu_tlb_update_dirty(CPUArchState *env);
-
 void dump_exec_info(FILE *f, fprintf_function cpu_fprintf);
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/exec.c b/exec.c
index 77d6866..d93a14d 100644
--- a/exec.c
+++ b/exec.c
@@ -499,6 +499,14 @@ not_found:
     return &phys_sections[s_index];
 }
 
+static
+bool memory_region_is_unassigned(MemoryRegion *mr)
+{
+    return mr != &io_mem_ram && mr != &io_mem_rom
+        && mr != &io_mem_notdirty && !mr->rom_device
+        && mr != &io_mem_watch;
+}
+
 static target_phys_addr_t section_addr(MemoryRegionSection *section,
                                        target_phys_addr_t addr)
 {
@@ -1919,7 +1927,7 @@ CPUArchState *cpu_copy(CPUArchState *env)
 
 #if !defined(CONFIG_USER_ONLY)
 
-static inline void tlb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
+static inline void tb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
 {
     unsigned int i;
 
@@ -1934,7 +1942,7 @@ static inline void tlb_flush_jmp_cache(CPUArchState *env, target_ulong addr)
             TB_JMP_PAGE_SIZE * sizeof(TranslationBlock *));
 }
 
-static CPUTLBEntry s_cputlb_empty_entry = {
+static const CPUTLBEntry s_cputlb_empty_entry = {
     .addr_read  = -1,
     .addr_write = -1,
     .addr_code  = -1,
@@ -1964,14 +1972,15 @@ void tlb_flush(CPUArchState *env, int flush_global)
        links while we are modifying them */
     env->current_tb = NULL;
 
-    for(i = 0; i < CPU_TLB_SIZE; i++) {
+    for (i = 0; i < CPU_TLB_SIZE; i++) {
         int mmu_idx;
+
         for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
             env->tlb_table[mmu_idx][i] = s_cputlb_empty_entry;
         }
     }
 
-    memset (env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
+    memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof (void *));
 
     env->tlb_flush_addr = -1;
     env->tlb_flush_mask = 0;
@@ -2014,10 +2023,11 @@ void tlb_flush_page(CPUArchState *env, target_ulong addr)
 
     addr &= TARGET_PAGE_MASK;
     i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++)
+    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         tlb_flush_entry(&env->tlb_table[mmu_idx][i], addr);
+    }
 
-    tlb_flush_jmp_cache(env, addr);
+    tb_flush_jmp_cache(env, addr);
 }
 
 /* update the TLBs so that writes to code in the virtual page 'addr'
@@ -2046,6 +2056,7 @@ static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
                                          uintptr_t start, uintptr_t length)
 {
     uintptr_t addr;
+
     if (tlb_is_dirty_ram(tlb_entry)) {
         addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend;
         if ((addr - start) < length) {
@@ -2054,13 +2065,29 @@ static inline void tlb_reset_dirty_range(CPUTLBEntry *tlb_entry,
     }
 }
 
+static void cpu_tlb_reset_dirty_all(ram_addr_t start1, ram_addr_t length)
+{
+    CPUArchState *env;
+
+    for (env = first_cpu; env != NULL; env = env->next_cpu) {
+        int mmu_idx;
+
+        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
+            unsigned int i;
+
+            for (i = 0; i < CPU_TLB_SIZE; i++) {
+                tlb_reset_dirty_range(&env->tlb_table[mmu_idx][i],
+                                      start1, length);
+            }
+        }
+    }
+}
+
 /* Note: start and end must be within the same ram block.  */
 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
                                      int dirty_flags)
 {
-    CPUArchState *env;
     uintptr_t length, start1;
-    int i;
 
     start &= TARGET_PAGE_MASK;
     end = TARGET_PAGE_ALIGN(end);
@@ -2079,15 +2106,7 @@ void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
             != (end - 1) - start) {
         abort();
     }
-
-    for(env = first_cpu; env != NULL; env = env->next_cpu) {
-        int mmu_idx;
-        for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-            for(i = 0; i < CPU_TLB_SIZE; i++)
-                tlb_reset_dirty_range(&env->tlb_table[mmu_idx][i],
-                                      start1, length);
-        }
-    }
+    cpu_tlb_reset_dirty_all(start1, length);
 }
 
 int cpu_physical_memory_set_dirty_tracking(int enable)
@@ -2112,21 +2131,11 @@ static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
     }
 }
 
-/* update the TLB according to the current state of the dirty bits */
-void cpu_tlb_update_dirty(CPUArchState *env)
-{
-    int i;
-    int mmu_idx;
-    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
-        for(i = 0; i < CPU_TLB_SIZE; i++)
-            tlb_update_dirty(&env->tlb_table[mmu_idx][i]);
-    }
-}
-
 static inline void tlb_set_dirty1(CPUTLBEntry *tlb_entry, target_ulong vaddr)
 {
-    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY))
+    if (tlb_entry->addr_write == (vaddr | TLB_NOTDIRTY)) {
         tlb_entry->addr_write = vaddr;
+    }
 }
 
 /* update the TLB corresponding to virtual page vaddr
@@ -2138,8 +2147,9 @@ static inline void tlb_set_dirty(CPUArchState *env, target_ulong vaddr)
 
     vaddr &= TARGET_PAGE_MASK;
     i = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
-    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++)
+    for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         tlb_set_dirty1(&env->tlb_table[mmu_idx][i], vaddr);
+    }
 }
 
 /* Our TLB does not support large pages, so remember the area covered by
@@ -2182,6 +2192,53 @@ static bool is_ram_rom_romd(MemoryRegionSection *s)
     return is_ram_rom(s) || is_romd(s);
 }
 
+static
+target_phys_addr_t memory_region_section_get_iotlb(CPUArchState *env,
+                                                   MemoryRegionSection *section,
+                                                   target_ulong vaddr,
+                                                   target_phys_addr_t paddr,
+                                                   int prot,
+                                                   target_ulong *address)
+{
+    target_phys_addr_t iotlb;
+    CPUWatchpoint *wp;
+
+    if (is_ram_rom(section)) {
+        /* Normal RAM.  */
+        iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
+            + section_addr(section, paddr);
+        if (!section->readonly) {
+            iotlb |= phys_section_notdirty;
+        } else {
+            iotlb |= phys_section_rom;
+        }
+    } else {
+        /* IO handlers are currently passed a physical address.
+           It would be nice to pass an offset from the base address
+           of that region.  This would avoid having to special case RAM,
+           and avoid full address decoding in every device.
+           We can't use the high bits of pd for this because
+           IO_MEM_ROMD uses these as a ram address.  */
+        iotlb = section - phys_sections;
+        iotlb += section_addr(section, paddr);
+    }
+
+    /* Make accesses to pages with watchpoints go via the
+       watchpoint trap routines.  */
+    QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
+        if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
+            /* Avoid trapping reads of pages with a write breakpoint. */
+            if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
+                iotlb = phys_section_watch + paddr;
+                *address |= TLB_MMIO;
+                break;
+            }
+        }
+    }
+
+    return iotlb;
+}
+
 /* Add a new TLB entry. At most one entry for a given virtual address
    is permitted. Only a single TARGET_PAGE_SIZE region is mapped, the
    supplied size is only used by tlb_flush_page.  */
@@ -2195,7 +2252,6 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     target_ulong code_address;
     uintptr_t addend;
     CPUTLBEntry *te;
-    CPUWatchpoint *wp;
     target_phys_addr_t iotlb;
 
     assert(size >= TARGET_PAGE_SIZE);
@@ -2220,38 +2276,10 @@ void tlb_set_page(CPUArchState *env, target_ulong vaddr,
     } else {
         addend = 0;
     }
-    if (is_ram_rom(section)) {
-        /* Normal RAM.  */
-        iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
-            + section_addr(section, paddr);
-        if (!section->readonly)
-            iotlb |= phys_section_notdirty;
-        else
-            iotlb |= phys_section_rom;
-    } else {
-        /* IO handlers are currently passed a physical address.
-           It would be nice to pass an offset from the base address
-           of that region.  This would avoid having to special case RAM,
-           and avoid full address decoding in every device.
-           We can't use the high bits of pd for this because
-           IO_MEM_ROMD uses these as a ram address.  */
-        iotlb = section - phys_sections;
-        iotlb += section_addr(section, paddr);
-    }
+    iotlb = memory_region_section_get_iotlb(env, section, vaddr, paddr, prot,
+                                            &address);
 
     code_address = address;
-    /* Make accesses to pages with watchpoints go via the
-       watchpoint trap routines.  */
-    QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
-        if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
-            /* Avoid trapping reads of pages with a write breakpoint. */
-            if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
-                iotlb = phys_section_watch + paddr;
-                address |= TLB_MMIO;
-                break;
-            }
-        }
-    }
 
     index = (vaddr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
     env->iotlb[mmu_idx][index] = iotlb - vaddr;
@@ -4614,13 +4642,12 @@ tb_page_addr_t get_page_addr_code(CPUArchState *env1, target_ulong addr)
     }
     pd = env1->iotlb[mmu_idx][page_index] & ~TARGET_PAGE_MASK;
     mr = iotlb_to_region(pd);
-    if (mr != &io_mem_ram && mr != &io_mem_rom
-        && mr != &io_mem_notdirty && !mr->rom_device
-        && mr != &io_mem_watch) {
+    if (memory_region_is_unassigned(mr)) {
 #if defined(TARGET_ALPHA) || defined(TARGET_MIPS) || defined(TARGET_SPARC)
         cpu_unassigned_access(env1, addr, 0, 1, 0, 4);
 #else
-        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x" TARGET_FMT_lx "\n", addr);
+        cpu_abort(env1, "Trying to execute code outside RAM or ROM at 0x"
+                  TARGET_FMT_lx "\n", addr);
 #endif
     }
     p = (void *)((uintptr_t)addr + env1->tlb_table[mmu_idx][page_index].addend);
commit e09db789abfeb94f431afe8e89481ac23ff4ea79
Merge: 58b5f5e... aa09c95...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Tue May 1 09:29:44 2012 +0000

    Merge branch 'maintainers-up' of git://repo.or.cz/qemu/afaerber
    
    * 'maintainers-up' of git://repo.or.cz/qemu/afaerber:
      MAINTAINERS: Document all stable trees
      MAINTAINERS: Fix SCM tree for virtio-9p
      MAINTAINERS: Indicate type of SCM
      MAINTAINERS: Fix TCI file pattern
      MAINTAINERS: Fix virtio-9p file pattern
      MAINTAINERS: Fix PC file pattern

commit 58b5f5e029207632b93bd211e746cf85d59c00ca
Merge: ee66107... 0adb124...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Tue May 1 09:29:23 2012 +0000

    Merge branch 'cocoa-for-upstream' of git://repo.or.cz/qemu/afaerber
    
    * 'cocoa-for-upstream' of git://repo.or.cz/qemu/afaerber:
      Drop darwin-user
      configure: add '--disable-cocoa' switch
      raw-posix: Do not use CONFIG_COCOA macro

commit ee6610785e4979770409fc675f7d889aa390aae5
Merge: 61d25e1... 6c84ce0...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Tue May 1 09:28:59 2012 +0000

    Merge branch 'prep-up' of git://repo.or.cz/qemu/afaerber
    
    * 'prep-up' of git://repo.or.cz/qemu/afaerber:
      prep: Move int-ack register from PReP to Raven PCI emulation
      prep: Initialize PC speaker
      isa: Add isa_bus_from_device() method
      fdc: Parametrize ISA base, IRQ and DMA
      i82378/i82374: Do not create DMA controller twice

commit 61d25e1548b5e5ec8b670e72e82a2a7b909f9d52
Merge: 42fe1c2... 894a84e...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Tue May 1 09:27:53 2012 +0000

    Merge branch 'qom-cpu-rest.v1' of git://github.com/afaerber/qemu-cpu
    
    * 'qom-cpu-rest.v1' of git://github.com/afaerber/qemu-cpu:
      Makefile: Simplify compilation of target-*/cpu.c
      target-mips: Start QOM'ifying CPU init
      target-mips: QOM'ify CPU
      target-m68k: Add QOM CPU subclasses
      target-m68k: Start QOM'ifying CPU init
      target-m68k: QOM'ify CPU reset
      target-m68k: QOM'ify CPU
      target-sh4: Start QOM'ifying CPU init
      target-sh4: QOM'ify CPU reset
      target-sh4: QOM'ify CPU
      MAINTAINERS: Downgrade target-mips and target-sh4 to Odd Fixes
      MAINTAINERS: Downgrade target-m68k to Odd Fixes

commit c97feed13cded953b11465829f66b9323a47a0f9
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Apr 29 19:08:46 2012 +0200

    iohandler: Use bool for boolean struct member and remove holes
    
    Using bool reduces the size of the structure and improves readability.
    Two holes in the structure were removed.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>

diff --git a/iohandler.c b/iohandler.c
index 5640d49..3c74de6 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -33,13 +33,13 @@
 #endif
 
 typedef struct IOHandlerRecord {
-    int fd;
     IOCanReadHandler *fd_read_poll;
     IOHandler *fd_read;
     IOHandler *fd_write;
-    int deleted;
     void *opaque;
     QLIST_ENTRY(IOHandlerRecord) next;
+    int fd;
+    bool deleted;
 } IOHandlerRecord;
 
 static QLIST_HEAD(, IOHandlerRecord) io_handlers =
commit 9b47b17e80cfd10e0598209ae9313de135000f61
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Apr 29 19:08:45 2012 +0200

    async: Use bool for boolean struct members and remove a hole
    
    Using bool reduces the size of the structure and improves readability.
    A hole in the structure was removed.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>

diff --git a/async.c b/async.c
index ecdaf15..85cc641 100644
--- a/async.c
+++ b/async.c
@@ -35,10 +35,10 @@ static struct QEMUBH *first_bh;
 struct QEMUBH {
     QEMUBHFunc *cb;
     void *opaque;
-    int scheduled;
-    int idle;
-    int deleted;
     QEMUBH *next;
+    bool scheduled;
+    bool idle;
+    bool deleted;
 };
 
 QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
commit 72b8b5a19a3087ffa5556b5d5b3fc13300ae35d5
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Mar 19 13:20:47 2012 +0100

    configure: Fix creation of symbolic links for MinGW toolchain
    
    The MinGW toolchain on w32/w64 hosts does not create symbolic links,
    but implements 'ln -s' similar to 'cp -r'.
    
    In incremental out of tree builds, this resulted in files which
    were not updated when their counterparts in the QEMU source tree
    changed. Especially for Makefile* this happened very often.
    
    With this patch, the 'symlinked' files are now always updated for
    out of tree builds. Similar code was already used for the symbolic
    link of libcacard/Makefile.
    
    The symlink macro always removes the target before it is created
    again, therefore the rm command for libcacard/Makefile was redundant
    and is removed now.
    
    Macro symlink is also used with directories. To remove them on w32
    hosts, a recursive rm is needed.
    
    v2:
    Quote arguments in shell function symlink, and also quote any argument
    which is passed to symlink and which contains macros. This should reduce
    the chance of accidents caused by rm -rf.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>

diff --git a/configure b/configure
index 25697bb..9d21302 100755
--- a/configure
+++ b/configure
@@ -41,8 +41,8 @@ compile_prog() {
 
 # symbolically link $1 to $2.  Portable version of "ln -sf".
 symlink() {
-  rm -f $2
-  ln -s $1 $2
+  rm -rf "$2"
+  ln -s "$1" "$2"
 }
 
 # check whether a command is available to this shell (may be either an
@@ -3435,7 +3435,7 @@ fi
 
 for d in libdis libdis-user; do
     mkdir -p $d
-    symlink $source_path/Makefile.dis $d/Makefile
+    symlink "$source_path/Makefile.dis" "$d/Makefile"
     echo > $d/config.mak
 done
 
@@ -3444,13 +3444,13 @@ if test "$linux" = "yes" ; then
   mkdir -p linux-headers
   case "$cpu" in
   i386|x86_64)
-    symlink $source_path/linux-headers/asm-x86 linux-headers/asm
+    symlink "$source_path/linux-headers/asm-x86" linux-headers/asm
     ;;
   ppcemb|ppc|ppc64)
-    symlink $source_path/linux-headers/asm-powerpc linux-headers/asm
+    symlink "$source_path/linux-headers/asm-powerpc" linux-headers/asm
     ;;
   s390x)
-    symlink $source_path/linux-headers/asm-s390 linux-headers/asm
+    symlink "$source_path/linux-headers/asm-s390" linux-headers/asm
     ;;
   esac
 fi
@@ -3515,7 +3515,7 @@ mkdir -p $target_dir/kvm
 if test "$target" = "arm-linux-user" -o "$target" = "armeb-linux-user" -o "$target" = "arm-bsd-user" -o "$target" = "armeb-bsd-user" ; then
   mkdir -p $target_dir/nwfpe
 fi
-symlink $source_path/Makefile.target $target_dir/Makefile
+symlink "$source_path/Makefile.target" "$target_dir/Makefile"
 
 
 echo "# Automatically generated by configure - do not modify" > $config_target_mak
@@ -3958,7 +3958,7 @@ do
 done
 mkdir -p $DIRS
 for f in $FILES ; do
-    if [ -e "$source_path/$f" ] && ! [ -e "$f" ]; then
+    if [ -e "$source_path/$f" ] && [ "$source_path" != `pwd` ]; then
         symlink "$source_path/$f" "$f"
     fi
 done
@@ -3981,7 +3981,7 @@ for hwlib in 32 64; do
   mkdir -p $d
   mkdir -p $d/ide
   mkdir -p $d/usb
-  symlink $source_path/Makefile.hw $d/Makefile
+  symlink "$source_path/Makefile.hw" "$d/Makefile"
   mkdir -p $d/9pfs
   echo "QEMU_CFLAGS+=-DTARGET_PHYS_ADDR_BITS=$hwlib" > $d/config.mak
 done
@@ -3989,7 +3989,6 @@ done
 if [ "$source_path" != `pwd` ]; then
     # out of tree build
     mkdir -p libcacard
-    rm -f libcacard/Makefile
     symlink "$source_path/libcacard/Makefile" libcacard/Makefile
 fi
 
@@ -3997,7 +3996,7 @@ d=libuser
 mkdir -p $d
 mkdir -p $d/trace
 mkdir -p $d/qom
-symlink $source_path/Makefile.user $d/Makefile
+symlink "$source_path/Makefile.user" "$d/Makefile"
 
 if test "$docs" = "yes" ; then
   mkdir -p QMP
commit 0adb124659cfadf9f0b5c99874c476116f0cf74f
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Apr 16 04:31:11 2012 +0000

    Drop darwin-user
    
    It's been orphaned, not compiling for a long time and despite Apple's
    drop of their Rosetta ppc emulation technology with Mac OS X Lion no one
    has stepped up to fix it.
    
    Testing necessary changes wrt QOM'ification thus is impossible, so we
    might as well remove it completely.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index cce37e7..c58465d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -570,11 +570,6 @@ M: Blue Swirl <blauwirbel at gmail.com>
 S: Maintained
 F: bsd-user/
 
-Darwin user
-M: qemu-devel at nongnu.org
-S: Orphan
-F: darwin-user/
-
 Linux user
 M: Riku Voipio <riku.voipio at iki.fi>
 S: Maintained
diff --git a/Makefile.target b/Makefile.target
index 1cf6943..7d68a25 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -162,34 +162,6 @@ obj-y += $(libobj-y)
 endif #CONFIG_LINUX_USER
 
 #########################################################
-# Darwin user emulator target
-
-ifdef CONFIG_DARWIN_USER
-
-$(call set-vpath, $(SRC_PATH)/darwin-user)
-
-QEMU_CFLAGS+=-I$(SRC_PATH)/darwin-user -I$(SRC_PATH)/darwin-user/$(TARGET_ARCH)
-
-# Leave some space for the regular program loading zone
-LDFLAGS+=-Wl,-segaddr,__STD_PROG_ZONE,0x1000 -image_base 0x0e000000
-
-LIBS+=-lmx
-
-obj-y = main.o commpage.o machload.o mmap.o signal.o syscall.o thunk.o \
-        gdbstub.o user-exec.o
-
-obj-i386-y += ioport-user.o
-
-$(obj-y) $(obj-$(TARGET_BASE_ARCH)-y): $(GENERATED_HEADERS)
-
-obj-y += $(addprefix ../, $(universal-obj-y))
-obj-y += $(addprefix ../libuser/, $(user-obj-y))
-obj-y += $(addprefix ../libdis-user/, $(libdis-y))
-obj-y += $(libobj-y)
-
-endif #CONFIG_DARWIN_USER
-
-#########################################################
 # BSD user emulator target
 
 ifdef CONFIG_BSD_USER
diff --git a/configure b/configure
index 0cf3bbb..e3d7a94 100755
--- a/configure
+++ b/configure
@@ -173,7 +173,6 @@ profiler="no"
 cocoa="no"
 softmmu="yes"
 linux_user="no"
-darwin_user="no"
 bsd_user="no"
 guest_base=""
 uname_release=""
@@ -424,7 +423,6 @@ Darwin)
   else
     QEMU_CFLAGS="-mdynamic-no-pic $QEMU_CFLAGS"
   fi
-  darwin_user="yes"
   cocoa="yes"
   audio_drv_list="coreaudio"
   audio_possible_drivers="coreaudio sdl fmod"
@@ -728,17 +726,12 @@ for opt do
   --disable-user)
       linux_user="no" ;
       bsd_user="no" ;
-      darwin_user="no"
   ;;
   --enable-user) ;;
   --disable-linux-user) linux_user="no"
   ;;
   --enable-linux-user) linux_user="yes"
   ;;
-  --disable-darwin-user) darwin_user="no"
-  ;;
-  --enable-darwin-user) darwin_user="yes"
-  ;;
   --disable-bsd-user) bsd_user="no"
   ;;
   --enable-bsd-user) bsd_user="yes"
@@ -967,10 +960,6 @@ unicore32-linux-user \
 s390x-linux-user \
 "
 fi
-# the following are Darwin specific
-if [ "$darwin_user" = "yes" ] ; then
-    default_target_list="$default_target_list i386-darwin-user ppc-darwin-user "
-fi
 # the following are BSD specific
 if [ "$bsd_user" = "yes" ] ; then
     default_target_list="${default_target_list}\
@@ -1072,8 +1061,6 @@ echo "  --enable-user            enable supported user emulation targets"
 echo "  --disable-user           disable all user emulation targets"
 echo "  --enable-linux-user      enable all linux usermode emulation targets"
 echo "  --disable-linux-user     disable all linux usermode emulation targets"
-echo "  --enable-darwin-user     enable all darwin usermode emulation targets"
-echo "  --disable-darwin-user    disable all darwin usermode emulation targets"
 echo "  --enable-bsd-user        enable all BSD usermode emulation targets"
 echo "  --disable-bsd-user       disable all BSD usermode emulation targets"
 echo "  --enable-guest-base      enable GUEST_BASE support for usermode"
@@ -3472,7 +3459,6 @@ esac
 target_softmmu="no"
 target_user_only="no"
 target_linux_user="no"
-target_darwin_user="no"
 target_bsd_user="no"
 case "$target" in
   ${target_arch2}-softmmu)
@@ -3486,14 +3472,6 @@ case "$target" in
     target_user_only="yes"
     target_linux_user="yes"
     ;;
-  ${target_arch2}-darwin-user)
-    if test "$darwin" != "yes" ; then
-      echo "ERROR: Target '$target' is only available on a Darwin host"
-      exit 1
-    fi
-    target_user_only="yes"
-    target_darwin_user="yes"
-    ;;
   ${target_arch2}-bsd-user)
     if test "$bsd" != "yes" ; then
       echo "ERROR: Target '$target' is only available on a BSD host"
@@ -3747,9 +3725,6 @@ fi
 if test "$target_linux_user" = "yes" ; then
   echo "CONFIG_LINUX_USER=y" >> $config_target_mak
 fi
-if test "$target_darwin_user" = "yes" ; then
-  echo "CONFIG_DARWIN_USER=y" >> $config_target_mak
-fi
 list=""
 if test ! -z "$gdb_xml_files" ; then
   for x in $gdb_xml_files; do
diff --git a/darwin-user/commpage.c b/darwin-user/commpage.c
deleted file mode 100644
index cc29bdd..0000000
--- a/darwin-user/commpage.c
+++ /dev/null
@@ -1,357 +0,0 @@
- /*
- *  Commpage syscalls
- *
- *  Copyright (c) 2006 Pierre d'Herbemont
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-
-#include <mach/message.h>
-#include <mach/mach.h>
-#include <mach/mach_time.h>
-#include <sys/time.h>
-#include <sys/mman.h>
-#include <libkern/OSAtomic.h>
-
-#include "qemu.h"
-
-//#define DEBUG_COMMPAGE
-
-#ifdef DEBUG_COMMPAGE
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); printf(__VA_ARGS__); } while(0)
-#else
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); } while(0)
-#endif
-
-/********************************************************************
- *   Commpage definitions
- */
-#ifdef TARGET_I386
-/* Reserve space for the commpage see xnu/osfmk/i386/cpu_capabilities.h */
-# define COMMPAGE_START (-16 * 4096) /* base address is -20 * 4096 */
-# define COMMPAGE_SIZE  (0x1240) /* _COMM_PAGE_AREA_LENGTH is 19 * 4096 */
-#elif defined(TARGET_PPC)
-/* Reserve space for the commpage see xnu/osfmk/ppc/cpu_capabilities.h */
-# define COMMPAGE_START (-8*4096)
-# define COMMPAGE_SIZE  (2*4096) /* its _COMM_PAGE_AREA_USED but _COMM_PAGE_AREA_LENGTH is 7*4096 */
-#endif
-
-void do_compare_and_swap32(void *cpu_env, int num);
-void do_compare_and_swap64(void *cpu_env, int num);
-void do_add_atomic_word32(void *cpu_env, int num);
-void do_cgettimeofday(void *cpu_env, int num, uint32_t arg1);
-void do_nanotime(void *cpu_env, int num);
-
-void unimpl_commpage(void *cpu_env, int num);
-
-typedef void (*commpage_8args_function_t)(uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7,
-                uint32_t arg8);
-typedef void (*commpage_indirect_function_t)(void *cpu_env, int num, uint32_t arg1,
-                uint32_t arg2, uint32_t arg3,  uint32_t arg4, uint32_t arg5,
-                uint32_t arg6, uint32_t arg7, uint32_t arg8);
-
-#define HAS_PTR  0x10
-#define NO_PTR   0x20
-#define CALL_DIRECT   0x1
-#define CALL_INDIRECT 0x2
-
-#define COMMPAGE_ENTRY(name, nargs, offset, func, options) \
-    { #name, offset, nargs, options, (commpage_8args_function_t)func }
-
-struct commpage_entry {
-    char * name;
-    int offset;
-    int nargs;
-    char options;
-    commpage_8args_function_t function;
-};
-
-static inline int commpage_code_num(struct commpage_entry *entry)
-{
-    if((entry->options & HAS_PTR))
-        return entry->offset + 4;
-    else
-        return entry->offset;
-}
-
-static inline int commpage_is_indirect(struct commpage_entry *entry)
-{
-    return !(entry->options & CALL_DIRECT);
-}
-
-/********************************************************************
- *   Commpage entry
- */
-static struct commpage_entry commpage_entries[] =
-{
-    COMMPAGE_ENTRY(compare_and_swap32,    0, 0x080,  do_compare_and_swap32, CALL_INDIRECT | HAS_PTR),
-    COMMPAGE_ENTRY(compare_and_swap64,    0, 0x0c0,  do_compare_and_swap64, CALL_INDIRECT | HAS_PTR),
-    COMMPAGE_ENTRY(enqueue,               0, 0x100,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(dequeue,               0, 0x140,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(memory_barrier,        0, 0x180,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(add_atomic_word32,     0, 0x1a0,  do_add_atomic_word32,  CALL_INDIRECT | HAS_PTR),
-    COMMPAGE_ENTRY(add_atomic_word64,     0, 0x1c0,  unimpl_commpage,       CALL_INDIRECT | HAS_PTR),
-
-    COMMPAGE_ENTRY(mach_absolute_time,    0, 0x200,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(spinlock_try,          1, 0x220,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(spinlock_lock,         1, 0x260,  OSSpinLockLock,        CALL_DIRECT),
-    COMMPAGE_ENTRY(spinlock_unlock,       1, 0x2a0,  OSSpinLockUnlock,      CALL_DIRECT),
-    COMMPAGE_ENTRY(pthread_getspecific,   0, 0x2c0,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(gettimeofday,          1, 0x2e0,  do_cgettimeofday,      CALL_INDIRECT),
-    COMMPAGE_ENTRY(sys_dcache_flush,      0, 0x4e0,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(sys_icache_invalidate, 0, 0x520,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(pthread_self,          0, 0x580,  unimpl_commpage,       CALL_INDIRECT),
-
-    COMMPAGE_ENTRY(relinquish,            0, 0x5c0,  unimpl_commpage,       CALL_INDIRECT),
-
-#ifdef TARGET_I386
-    COMMPAGE_ENTRY(bts,                   0, 0x5e0,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(btc,                   0, 0x5f0,  unimpl_commpage,       CALL_INDIRECT),
-#endif
-
-    COMMPAGE_ENTRY(bzero,                 2, 0x600,  bzero,                 CALL_DIRECT),
-    COMMPAGE_ENTRY(bcopy,                 3, 0x780,  bcopy,                 CALL_DIRECT),
-    COMMPAGE_ENTRY(memcpy,                3, 0x7a0,  memcpy,                CALL_DIRECT),
-
-#ifdef TARGET_I386
-    COMMPAGE_ENTRY(old_nanotime,          0, 0xf80,  do_nanotime,           CALL_INDIRECT),
-    COMMPAGE_ENTRY(memset_pattern,        0, 0xf80,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(long_copy,             0, 0x1200, unimpl_commpage,       CALL_INDIRECT),
-
-    COMMPAGE_ENTRY(sysintegrity,          0, 0x1600, unimpl_commpage,       CALL_INDIRECT),
-
-    COMMPAGE_ENTRY(nanotime,              0, 0x1700, do_nanotime,           CALL_INDIRECT),
-#elif TARGET_PPC
-    COMMPAGE_ENTRY(compare_and_swap32b,   0, 0xf80,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(compare_and_swap64b,   0, 0xfc0,  unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(memset_pattern,        0, 0x1000, unimpl_commpage,       CALL_INDIRECT),
-    COMMPAGE_ENTRY(bigcopy,               0, 0x1140, unimpl_commpage,       CALL_INDIRECT),
-#endif
-};
-
-
-/********************************************************************
- *   Commpage backdoor
- */
-static inline void print_commpage_entry(struct commpage_entry entry)
-{
-    printf("@0x%x %s\n", entry.offset, entry.name);
-}
-
-static inline void install_commpage_backdoor_for_entry(struct commpage_entry entry)
-{
-#ifdef TARGET_I386
-    char * commpage = (char*)(COMMPAGE_START+entry.offset);
-    int c = 0;
-    if(entry.options & HAS_PTR)
-    {
-        commpage[c++] = (COMMPAGE_START+entry.offset+4) & 0xff;
-        commpage[c++] = ((COMMPAGE_START+entry.offset+4) >> 8) & 0xff;
-        commpage[c++] = ((COMMPAGE_START+entry.offset+4) >> 16) & 0xff;
-        commpage[c++] = ((COMMPAGE_START+entry.offset+4) >> 24) & 0xff;
-    }
-    commpage[c++] = 0xcd;
-    commpage[c++] = 0x79; /* int 0x79 */
-    commpage[c++] = 0xc3; /* ret */
-#else
-    qerror("can't install the commpage on this arch\n");
-#endif
-}
-
-/********************************************************************
- *   Commpage initialization
- */
-void commpage_init(void)
-{
-#if (defined(__i386__) ^ defined(TARGET_I386)) || (defined(_ARCH_PPC) ^ defined(TARGET_PPC))
-    int i;
-    void * commpage = (void *)target_mmap( COMMPAGE_START, COMMPAGE_SIZE,
-                           PROT_WRITE | PROT_READ, MAP_ANONYMOUS | MAP_FIXED, -1, 0);
-    if((int)commpage != COMMPAGE_START)
-        qerror("can't allocate the commpage\n");
-
-    bzero(commpage, COMMPAGE_SIZE);
-
-    /* XXX: commpage data not handled */
-
-    for(i = 0; i < ARRAY_SIZE(commpage_entries); i++)
-        install_commpage_backdoor_for_entry(commpage_entries[i]);
-#else
-    /* simply map our pages so they can be executed
-       XXX: we don't really want to do that since in the ppc on ppc situation we may
-       not able to run commpages host optimized instructions (like G5's on a G5),
-       hence this is sometimes a broken fix. */
-    page_set_flags(COMMPAGE_START, COMMPAGE_START+COMMPAGE_SIZE, PROT_EXEC | PROT_READ | PAGE_VALID);
-#endif
-}
-
-/********************************************************************
- *   Commpage implementation
- */
-void do_compare_and_swap32(void *cpu_env, int num)
-{
-#ifdef TARGET_I386
-    uint32_t old = ((CPUX86State*)cpu_env)->regs[R_EAX];
-    uint32_t *value = (uint32_t*)((CPUX86State*)cpu_env)->regs[R_ECX];
-    DPRINTF("commpage: compare_and_swap32(%x,new,%p)\n", old, value);
-
-    if(old == tswap32(*value))
-    {
-        uint32_t new = ((CPUX86State*)cpu_env)->regs[R_EDX];
-        *value = tswap32(new);
-        /* set zf flag */
-        ((CPUX86State*)cpu_env)->eflags |= 0x40;
-    }
-    else
-    {
-        ((CPUX86State*)cpu_env)->regs[R_EAX] = tswap32(*value);
-        /* unset zf flag */
-        ((CPUX86State*)cpu_env)->eflags &= ~0x40;
-    }
-#else
-    qerror("do_compare_and_swap32 unimplemented");
-#endif
-}
-
-void do_compare_and_swap64(void *cpu_env, int num)
-{
-#ifdef TARGET_I386
-    /* OSAtomicCompareAndSwap64 is not available on non 64 bits ppc, here is a raw implementation */
-    uint64_t old, new, swapped_val;
-    uint64_t *value = (uint64_t*)((CPUX86State*)cpu_env)->regs[R_ESI];
-    old = (uint64_t)((uint64_t)((CPUX86State*)cpu_env)->regs[R_EDX]) << 32 | (uint64_t)((CPUX86State*)cpu_env)->regs[R_EAX];
-
-    DPRINTF("commpage: compare_and_swap64(%" PRIx64 ",new,%p)\n", old, value);
-    swapped_val = tswap64(*value);
-
-    if(old == swapped_val)
-    {
-        new = (uint64_t)((uint64_t)((CPUX86State*)cpu_env)->regs[R_ECX]) << 32 | (uint64_t)((CPUX86State*)cpu_env)->regs[R_EBX];
-        *value = tswap64(new);
-        /* set zf flag */
-        ((CPUX86State*)cpu_env)->eflags |= 0x40;
-    }
-    else
-    {
-        ((CPUX86State*)cpu_env)->regs[R_EAX] = (uint32_t)(swapped_val);
-        ((CPUX86State*)cpu_env)->regs[R_EDX] = (uint32_t)(swapped_val >> 32);
-        /* unset zf flag */
-        ((CPUX86State*)cpu_env)->eflags &= ~0x40;
-    }
-#else
-    qerror("do_compare_and_swap64 unimplemented");
-#endif
-}
-
-void do_add_atomic_word32(void *cpu_env, int num)
-{
-#ifdef TARGET_I386
-    uint32_t amt = ((CPUX86State*)cpu_env)->regs[R_EAX];
-    uint32_t *value = (uint32_t*)((CPUX86State*)cpu_env)->regs[R_EDX];
-    uint32_t swapped_value = tswap32(*value);
-
-    DPRINTF("commpage: add_atomic_word32(%x,%p)\n", amt, value);
-
-    /* old value in EAX */
-    ((CPUX86State*)cpu_env)->regs[R_EAX] = swapped_value;
-    *value = tswap32(swapped_value + amt);
-#else
-    qerror("do_add_atomic_word32 unimplemented");
-#endif
-}
-
-void do_cgettimeofday(void *cpu_env, int num, uint32_t arg1)
-{
-#ifdef TARGET_I386
-    extern int __commpage_gettimeofday(struct timeval *);
-    DPRINTF("commpage: gettimeofday(0x%x)\n", arg1);
-    struct timeval *time = (struct timeval *)arg1;
-    int ret = __commpage_gettimeofday(time);
-    tswap32s((uint32_t*)&time->tv_sec);
-    tswap32s((uint32_t*)&time->tv_usec);
-    ((CPUX86State*)cpu_env)->regs[R_EAX] = ret; /* Success */
-#else
-    qerror("do_gettimeofday unimplemented");
-#endif
-}
-
-void do_nanotime(void *cpu_env, int num)
-{
-#ifdef TARGET_I386
-    uint64_t t = mach_absolute_time();
-    ((CPUX86State*)cpu_env)->regs[R_EAX] = (int)(t & 0xffffffff);
-    ((CPUX86State*)cpu_env)->regs[R_EDX] = (int)((t >> 32) & 0xffffffff);
-#else
-    qerror("do_nanotime unimplemented");
-#endif
-}
-
-void unimpl_commpage(void *cpu_env, int num)
-{
-    qerror("qemu: commpage function 0x%x not implemented\n", num);
-}
-
-/********************************************************************
- *   do_commpage - called by the main cpu loop
- */
-void
-do_commpage(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7,
-                uint32_t arg8)
-{
-    int i, found = 0;
-
-    arg1 = tswap32(arg1);
-    arg2 = tswap32(arg2);
-    arg3 = tswap32(arg3);
-    arg4 = tswap32(arg4);
-    arg5 = tswap32(arg5);
-    arg6 = tswap32(arg6);
-    arg7 = tswap32(arg7);
-    arg8 = tswap32(arg8);
-
-    num = num-COMMPAGE_START-2;
-
-    for(i = 0; i < ARRAY_SIZE(commpage_entries); i++) {
-        if( num == commpage_code_num(&commpage_entries[i]) )
-        {
-            DPRINTF("commpage: %s %s\n", commpage_entries[i].name, commpage_is_indirect(&commpage_entries[i]) ? "[indirect]" : "[direct]");
-            found = 1;
-            if(commpage_is_indirect(&commpage_entries[i]))
-            {
-                commpage_indirect_function_t function = (commpage_indirect_function_t)commpage_entries[i].function;
-                function(cpu_env, num, arg1, arg2, arg3,
-                    arg4, arg5, arg6, arg7, arg8);
-            }
-            else
-            {
-                commpage_entries[i].function(arg1, arg2, arg3,
-                    arg4, arg5, arg6, arg7, arg8);
-            }
-            break;
-        }
-    }
-
-    if(!found)
-    {
-        gemu_log("qemu: commpage function 0x%x not defined\n", num);
-        gdb_handlesig (cpu_env, SIGTRAP);
-        exit(-1);
-    }
-}
diff --git a/darwin-user/ioctls.h b/darwin-user/ioctls.h
deleted file mode 100644
index dc73af2..0000000
--- a/darwin-user/ioctls.h
+++ /dev/null
@@ -1,4 +0,0 @@
-     /* emulated ioctl list */
-
-     IOCTL(TIOCGETA, IOC_R, MK_PTR(MK_STRUCT(STRUCT_termios)))
-     IOCTL(TIOCSETA, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios)))
diff --git a/darwin-user/ioctls_types.h b/darwin-user/ioctls_types.h
deleted file mode 100644
index 014561a..0000000
--- a/darwin-user/ioctls_types.h
+++ /dev/null
@@ -1 +0,0 @@
-STRUCT(termios, TYPE_INT, TYPE_INT, TYPE_INT, TYPE_INT, MK_ARRAY(TYPE_CHAR, 20), TYPE_INT, TYPE_INT)
diff --git a/darwin-user/machload.c b/darwin-user/machload.c
deleted file mode 100644
index 26dd293..0000000
--- a/darwin-user/machload.c
+++ /dev/null
@@ -1,902 +0,0 @@
-/*
- *  Mach-O object file loading
- *
- *  Copyright (c) 2006 Pierre d'Herbemont
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <stdio.h>
-#include <sys/types.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <errno.h>
-#include <unistd.h>
-#include <sys/mman.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "qemu.h"
-#include "disas.h"
-
-#include <mach-o/loader.h>
-#include <mach-o/fat.h>
-#include <mach-o/nlist.h>
-#include <mach-o/reloc.h>
-#include <mach-o/ppc/reloc.h>
-
-//#define DEBUG_MACHLOAD
-
-#ifdef DEBUG_MACHLOAD
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); printf(__VA_ARGS__); } while(0)
-#else
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); } while(0)
-#endif
-
-# define check_mach_header(x) (x.magic == MH_CIGAM)
-
-extern const char *interp_prefix;
-
-/* we don't have a good implementation for this */
-#define DONT_USE_DYLD_SHARED_MAP
-
-/* Pass extra arg to DYLD for debug */
-//#define ACTIVATE_DYLD_TRACE
-
-//#define OVERRIDE_DYLINKER
-
-#ifdef OVERRIDE_DYLINKER
-# ifdef TARGET_I386
-#  define DYLINKER_NAME "/Users/steg/qemu/tests/i386-darwin-env/usr/lib/dyld"
-# else
-#  define DYLINKER_NAME "/usr/lib/dyld"
-# endif
-#endif
-
-/* XXX: in an include */
-struct nlist_extended
-{
-    union {
-        char *n_name;
-        long  n_strx;
-    } n_un;
-    unsigned char n_type;
-    unsigned char n_sect;
-    short st_desc;
-    unsigned long st_value;
-    unsigned long st_size;
-};
-
-/* Print symbols in gdb */
-void *macho_text_sect = 0;
-int   macho_offset = 0;
-
-int load_object(const char *filename, struct target_pt_regs * regs, void ** mh);
-
-#ifdef TARGET_I386
-typedef struct mach_i386_thread_state {
-    unsigned int    eax;
-    unsigned int    ebx;
-    unsigned int    ecx;
-    unsigned int    edx;
-    unsigned int    edi;
-    unsigned int    esi;
-    unsigned int    ebp;
-    unsigned int    esp;
-    unsigned int    ss;
-    unsigned int    eflags;
-    unsigned int    eip;
-    unsigned int    cs;
-    unsigned int    ds;
-    unsigned int    es;
-    unsigned int    fs;
-    unsigned int    gs;
-} mach_i386_thread_state_t;
-
-void bswap_i386_thread_state(struct mach_i386_thread_state *ts)
-{
-    bswap32s((uint32_t*)&ts->eax);
-    bswap32s((uint32_t*)&ts->ebx);
-    bswap32s((uint32_t*)&ts->ecx);
-    bswap32s((uint32_t*)&ts->edx);
-    bswap32s((uint32_t*)&ts->edi);
-    bswap32s((uint32_t*)&ts->esi);
-    bswap32s((uint32_t*)&ts->ebp);
-    bswap32s((uint32_t*)&ts->esp);
-    bswap32s((uint32_t*)&ts->ss);
-    bswap32s((uint32_t*)&ts->eflags);
-    bswap32s((uint32_t*)&ts->eip);
-    bswap32s((uint32_t*)&ts->cs);
-    bswap32s((uint32_t*)&ts->ds);
-    bswap32s((uint32_t*)&ts->es);
-    bswap32s((uint32_t*)&ts->fs);
-    bswap32s((uint32_t*)&ts->gs);
-}
-#define target_thread_state mach_i386_thread_state
-#define TARGET_CPU_TYPE CPU_TYPE_I386
-#define TARGET_CPU_NAME "i386"
-#endif
-
-#ifdef TARGET_PPC
-struct mach_ppc_thread_state {
-    unsigned int srr0;      /* Instruction address register (PC) */
-    unsigned int srr1;    /* Machine state register (supervisor) */
-    unsigned int r0;
-    unsigned int r1;
-    unsigned int r2;
-    unsigned int r3;
-    unsigned int r4;
-    unsigned int r5;
-    unsigned int r6;
-    unsigned int r7;
-    unsigned int r8;
-    unsigned int r9;
-    unsigned int r10;
-    unsigned int r11;
-    unsigned int r12;
-    unsigned int r13;
-    unsigned int r14;
-    unsigned int r15;
-    unsigned int r16;
-    unsigned int r17;
-    unsigned int r18;
-    unsigned int r19;
-    unsigned int r20;
-    unsigned int r21;
-    unsigned int r22;
-    unsigned int r23;
-    unsigned int r24;
-    unsigned int r25;
-    unsigned int r26;
-    unsigned int r27;
-    unsigned int r28;
-    unsigned int r29;
-    unsigned int r30;
-    unsigned int r31;
-
-    unsigned int cr;        /* Condition register */
-    unsigned int xer;    /* User's integer exception register */
-    unsigned int lr;    /* Link register */
-    unsigned int ctr;    /* Count register */
-    unsigned int mq;    /* MQ register (601 only) */
-
-    unsigned int vrsave;    /* Vector Save Register */
-};
-
-void bswap_ppc_thread_state(struct mach_ppc_thread_state *ts)
-{
-    bswap32s((uint32_t*)&ts->srr0);
-    bswap32s((uint32_t*)&ts->srr1);
-    bswap32s((uint32_t*)&ts->r0);
-    bswap32s((uint32_t*)&ts->r1);
-    bswap32s((uint32_t*)&ts->r2);
-    bswap32s((uint32_t*)&ts->r3);
-    bswap32s((uint32_t*)&ts->r4);
-    bswap32s((uint32_t*)&ts->r5);
-    bswap32s((uint32_t*)&ts->r6);
-    bswap32s((uint32_t*)&ts->r7);
-    bswap32s((uint32_t*)&ts->r8);
-    bswap32s((uint32_t*)&ts->r9);
-    bswap32s((uint32_t*)&ts->r10);
-    bswap32s((uint32_t*)&ts->r11);
-    bswap32s((uint32_t*)&ts->r12);
-    bswap32s((uint32_t*)&ts->r13);
-    bswap32s((uint32_t*)&ts->r14);
-    bswap32s((uint32_t*)&ts->r15);
-    bswap32s((uint32_t*)&ts->r16);
-    bswap32s((uint32_t*)&ts->r17);
-    bswap32s((uint32_t*)&ts->r18);
-    bswap32s((uint32_t*)&ts->r19);
-    bswap32s((uint32_t*)&ts->r20);
-    bswap32s((uint32_t*)&ts->r21);
-    bswap32s((uint32_t*)&ts->r22);
-    bswap32s((uint32_t*)&ts->r23);
-    bswap32s((uint32_t*)&ts->r24);
-    bswap32s((uint32_t*)&ts->r25);
-    bswap32s((uint32_t*)&ts->r26);
-    bswap32s((uint32_t*)&ts->r27);
-    bswap32s((uint32_t*)&ts->r28);
-    bswap32s((uint32_t*)&ts->r29);
-    bswap32s((uint32_t*)&ts->r30);
-    bswap32s((uint32_t*)&ts->r31);
-
-    bswap32s((uint32_t*)&ts->cr);
-    bswap32s((uint32_t*)&ts->xer);
-    bswap32s((uint32_t*)&ts->lr);
-    bswap32s((uint32_t*)&ts->ctr);
-    bswap32s((uint32_t*)&ts->mq);
-
-    bswap32s((uint32_t*)&ts->vrsave);
-}
-
-#define target_thread_state mach_ppc_thread_state
-#define TARGET_CPU_TYPE CPU_TYPE_POWERPC
-#define TARGET_CPU_NAME "PowerPC"
-#endif
-
-struct target_thread_command {
-    unsigned long    cmd;    /* LC_THREAD or  LC_UNIXTHREAD */
-    unsigned long    cmdsize;    /* total size of this command */
-    unsigned long flavor;    /* flavor of thread state */
-    unsigned long count;        /* count of longs in thread state */
-    struct target_thread_state state;  /* thread state for this flavor */
-};
-
-void bswap_tc(struct target_thread_command *tc)
-{
-    bswap32s((uint32_t*)(&tc->flavor));
-    bswap32s((uint32_t*)&tc->count);
-#if defined(TARGET_I386)
-    bswap_i386_thread_state(&tc->state);
-#elif defined(TARGET_PPC)
-    bswap_ppc_thread_state(&tc->state);
-#else
-# error unknown TARGET_CPU_TYPE
-#endif
-}
-
-void bswap_mh(struct mach_header *mh)
-{
-    bswap32s((uint32_t*)(&mh->magic));
-    bswap32s((uint32_t*)&mh->cputype);
-    bswap32s((uint32_t*)&mh->cpusubtype);
-    bswap32s((uint32_t*)&mh->filetype);
-    bswap32s((uint32_t*)&mh->ncmds);
-    bswap32s((uint32_t*)&mh->sizeofcmds);
-    bswap32s((uint32_t*)&mh->flags);
-}
-
-void bswap_lc(struct load_command *lc)
-{
-    bswap32s((uint32_t*)&lc->cmd);
-    bswap32s((uint32_t*)&lc->cmdsize);
-}
-
-
-void bswap_fh(struct fat_header *fh)
-{
-    bswap32s((uint32_t*)&fh->magic);
-    bswap32s((uint32_t*)&fh->nfat_arch);
-}
-
-void bswap_fa(struct fat_arch *fa)
-{
-    bswap32s((uint32_t*)&fa->cputype);
-    bswap32s((uint32_t*)&fa->cpusubtype);
-    bswap32s((uint32_t*)&fa->offset);
-    bswap32s((uint32_t*)&fa->size);
-    bswap32s((uint32_t*)&fa->align);
-}
-
-void bswap_segcmd(struct segment_command *sc)
-{
-    bswap32s((uint32_t*)&sc->vmaddr);
-    bswap32s((uint32_t*)&sc->vmsize);
-    bswap32s((uint32_t*)&sc->fileoff);
-    bswap32s((uint32_t*)&sc->filesize);
-    bswap32s((uint32_t*)&sc->maxprot);
-    bswap32s((uint32_t*)&sc->initprot);
-    bswap32s((uint32_t*)&sc->nsects);
-    bswap32s((uint32_t*)&sc->flags);
-}
-
-void bswap_symtabcmd(struct symtab_command *stc)
-{
-    bswap32s((uint32_t*)&stc->cmd);
-    bswap32s((uint32_t*)&stc->cmdsize);
-    bswap32s((uint32_t*)&stc->symoff);
-    bswap32s((uint32_t*)&stc->nsyms);
-    bswap32s((uint32_t*)&stc->stroff);
-    bswap32s((uint32_t*)&stc->strsize);
-}
-
-void bswap_sym(struct nlist *n)
-{
-    bswap32s((uint32_t*)&n->n_un.n_strx);
-    bswap16s((uint16_t*)&n->n_desc);
-    bswap32s((uint32_t*)&n->n_value);
-}
-
-int load_thread(struct mach_header *mh, struct target_thread_command *tc, struct target_pt_regs * regs, int fd, int mh_pos, int need_bswap)
-{
-    int entry;
-    if(need_bswap)
-        bswap_tc(tc);
-#if defined(TARGET_I386)
-    entry = tc->state.eip;
-    DPRINTF(" eax 0x%.8x\n ebx 0x%.8x\n ecx 0x%.8x\n edx 0x%.8x\n edi 0x%.8x\n esi 0x%.8x\n ebp 0x%.8x\n esp 0x%.8x\n ss 0x%.8x\n eflags 0x%.8x\n eip 0x%.8x\n cs 0x%.8x\n ds 0x%.8x\n es 0x%.8x\n fs 0x%.8x\n gs 0x%.8x\n",
-            tc->state.eax, tc->state.ebx, tc->state.ecx, tc->state.edx, tc->state.edi, tc->state.esi, tc->state.ebp,
-            tc->state.esp, tc->state.ss, tc->state.eflags, tc->state.eip, tc->state.cs, tc->state.ds, tc->state.es,
-            tc->state.fs, tc->state.gs );
-#define reg_copy(reg)   regs->reg = tc->state.reg
-    if(regs)
-    {
-        reg_copy(eax);
-        reg_copy(ebx);
-        reg_copy(ecx);
-        reg_copy(edx);
-
-        reg_copy(edi);
-        reg_copy(esi);
-
-        reg_copy(ebp);
-        reg_copy(esp);
-
-        reg_copy(eflags);
-        reg_copy(eip);
-    /*
-        reg_copy(ss);
-        reg_copy(cs);
-        reg_copy(ds);
-        reg_copy(es);
-        reg_copy(fs);
-        reg_copy(gs);*/
-    }
-#undef reg_copy
-#elif defined(TARGET_PPC)
-    entry =  tc->state.srr0;
-#endif
-    DPRINTF("load_thread: entry 0x%x\n", entry);
-    return entry;
-}
-
-int load_dylinker(struct mach_header *mh, struct dylinker_command *dc, int fd, int mh_pos, int need_bswap)
-{
-    int size;
-    char * dylinker_name;
-    size = dc->cmdsize - sizeof(struct dylinker_command);
-
-    if(need_bswap)
-        dylinker_name = (char*)(bswap_32(dc->name.offset)+(int)dc);
-    else
-        dylinker_name = (char*)((dc->name.offset)+(int)dc);
-
-#ifdef OVERRIDE_DYLINKER
-    dylinker_name = DYLINKER_NAME;
-#else
-    if(asprintf(&dylinker_name, "%s%s", interp_prefix, dylinker_name) == -1)
-        qerror("can't allocate the new dylinker name\n");
-#endif
-
-    DPRINTF("dylinker_name %s\n", dylinker_name);
-    return load_object(dylinker_name, NULL, NULL);
-}
-
-int load_segment(struct mach_header *mh, struct segment_command *sc, int fd, int mh_pos, int need_bswap, int fixed, int slide)
-{
-    unsigned long addr = sc->vmaddr;
-    unsigned long size = sc->filesize;
-    unsigned long error = 0;
-
-    if(need_bswap)
-        bswap_segcmd(sc);
-
-    if(sc->vmaddr == 0)
-    {
-        DPRINTF("load_segment: sc->vmaddr == 0 returning\n");
-        return -1;
-    }
-
-    if (strcmp(sc->segname, "__PAGEZERO") == 0)
-    {
-        DPRINTF("load_segment: __PAGEZERO returning\n");
-        return -1;
-    }
-
-    /* Right now mmap memory */
-    /* XXX: should check to see that the space is free, because MAP_FIXED is dangerous */
-    DPRINTF("load_segment: mmaping %s to 0x%x-(0x%x|0x%x) + 0x%x\n", sc->segname, sc->vmaddr, sc->filesize, sc->vmsize, slide);
-
-    if(sc->filesize > 0)
-    {
-        int opt = 0;
-
-        if(fixed)
-            opt |= MAP_FIXED;
-
-        DPRINTF("sc->vmaddr 0x%x slide 0x%x add 0x%x\n", slide, sc->vmaddr, sc->vmaddr+slide);
-
-        addr = target_mmap(sc->vmaddr+slide, sc->filesize,  sc->initprot, opt, fd, mh_pos + sc->fileoff);
-
-        if(addr==-1)
-            qerror("load_segment: can't mmap at 0x%x\n", sc->vmaddr+slide);
-
-        error = addr-sc->vmaddr;
-    }
-    else
-    {
-        addr = sc->vmaddr+slide;
-        error = slide;
-    }
-
-    if(sc->vmsize > sc->filesize)
-    {
-        addr += sc->filesize;
-        size = sc->vmsize-sc->filesize;
-        addr = target_mmap(addr, size, sc->initprot, MAP_ANONYMOUS | MAP_FIXED, -1, 0);
-        if(addr==-1)
-            qerror("load_segment: can't mmap at 0x%x\n", sc->vmaddr+slide);
-    }
-
-    return error;
-}
-
-void *load_data(int fd, long offset, unsigned int size)
-{
-    char *data;
-
-    data = malloc(size);
-    if (!data)
-        return NULL;
-    lseek(fd, offset, SEEK_SET);
-    if (read(fd, data, size) != size) {
-        free(data);
-        return NULL;
-    }
-    return data;
-}
-
-/* load a mach-o object file */
-int load_object(const char *filename, struct target_pt_regs * regs, void ** mh)
-{
-    int need_bswap = 0;
-    int entry_point = 0;
-    int dyld_entry_point = 0;
-    int slide, mmapfixed;
-    int fd;
-    struct load_command *lcmds, *lc;
-    int is_fat = 0;
-    unsigned int i, magic;
-    int mach_hdr_pos = 0;
-    struct mach_header mach_hdr;
-
-    /* for symbol lookup with -d flag. */
-    struct symtab_command *    symtabcmd = 0;
-    struct nlist_extended *symtab, *sym;
-    struct nlist     *symtab_std, *syment;
-    char            *strtab;
-
-    fd = open(filename, O_RDONLY);
-    if (fd < 0)
-        qerror("can't open file '%s'", filename);
-
-    /* Read magic header.  */
-    if (read(fd, &magic, sizeof (magic)) != sizeof (magic))
-        qerror("unable to read Magic of '%s'", filename);
-
-    /* Check Mach identification.  */
-    if(magic == MH_MAGIC)
-    {
-        is_fat = 0;
-        need_bswap = 0;
-    } else if (magic == MH_CIGAM)
-    {
-        is_fat = 0;
-        need_bswap = 1;
-    } else if (magic == FAT_MAGIC)
-    {
-        is_fat = 1;
-        need_bswap = 0;
-    } else if (magic == FAT_CIGAM)
-    {
-        is_fat = 1;
-        need_bswap = 1;
-    }
-    else
-        qerror("Not a Mach-O file.", filename);
-
-    DPRINTF("loading %s %s...\n", filename, is_fat ? "[FAT]": "[REGULAR]");
-    if(is_fat)
-    {
-        int found = 0;
-        struct fat_header fh;
-        struct fat_arch *fa;
-
-        lseek(fd, 0, SEEK_SET);
-
-        /* Read Fat header.  */
-        if (read(fd, &fh, sizeof (fh)) != sizeof (fh))
-            qerror("unable to read file header");
-
-        if(need_bswap)
-            bswap_fh(&fh);
-
-        /* Read Fat Arch.  */
-        fa = malloc(sizeof(struct fat_arch)*fh.nfat_arch);
-
-        if (read(fd, fa, sizeof(struct fat_arch)*fh.nfat_arch) != sizeof(struct fat_arch)*fh.nfat_arch)
-            qerror("unable to read file header");
-
-        for( i = 0; i < fh.nfat_arch; i++, fa++)
-        {
-            if(need_bswap)
-                bswap_fa(fa);
-            if(fa->cputype == TARGET_CPU_TYPE)
-            {
-                mach_hdr_pos = fa->offset;
-                lseek(fd, mach_hdr_pos, SEEK_SET);
-
-                /* Read Mach header.  */
-
-                if (read(fd, &mach_hdr, sizeof(struct mach_header)) != sizeof (struct mach_header))
-                    qerror("unable to read file header");
-
-                if(mach_hdr.magic == MH_MAGIC)
-                    need_bswap = 0;
-                else if (mach_hdr.magic == MH_CIGAM)
-                    need_bswap = 1;
-                else
-                    qerror("Invalid mach header in Fat Mach-O File");
-                found = 1;
-                break;
-            }
-        }
-        if(!found)
-            qerror("%s: No %s CPU found in FAT Header", filename, TARGET_CPU_NAME);
-    }
-    else
-    {
-        lseek(fd, 0, SEEK_SET);
-        /* Read Mach header */
-        if (read(fd, &mach_hdr, sizeof (mach_hdr)) != sizeof (mach_hdr))
-            qerror("%s: unable to read file header", filename);
-    }
-
-    if(need_bswap)
-        bswap_mh(&mach_hdr);
-
-    if ((mach_hdr.cputype) != TARGET_CPU_TYPE)
-        qerror("%s: Unsupported CPU 0x%x (only 0x%x(%s) supported)", filename, mach_hdr.cputype, TARGET_CPU_TYPE, TARGET_CPU_NAME);
-
-
-    switch(mach_hdr.filetype)
-    {
-        case MH_EXECUTE:  break;
-        case MH_FVMLIB:
-        case MH_DYLIB:
-        case MH_DYLINKER: break;
-        default:
-            qerror("%s: Unsupported Mach type (0x%x)", filename, mach_hdr.filetype);
-    }
-
-    /* read segment headers */
-    lcmds = malloc(mach_hdr.sizeofcmds);
-
-    if(read(fd, lcmds, mach_hdr.sizeofcmds) != mach_hdr.sizeofcmds)
-            qerror("%s: unable to read load_command", filename);
-    slide = 0;
-    mmapfixed = 0;
-    for(i=0, lc = lcmds; i < (mach_hdr.ncmds) ; i++)
-    {
-
-        if(need_bswap)
-            bswap_lc(lc);
-        switch(lc->cmd)
-        {
-            case LC_SEGMENT:
-                /* The main_exe can't be relocated */
-                if(mach_hdr.filetype == MH_EXECUTE)
-                    mmapfixed = 1;
-
-                slide = load_segment(&mach_hdr, (struct segment_command*)lc, fd, mach_hdr_pos, need_bswap, mmapfixed, slide);
-
-                /* other segment must be mapped according to slide exactly, if load_segment did something */
-                if(slide != -1)
-                    mmapfixed = 1;
-                else
-                    slide = 0; /* load_segment didn't map the segment */
-
-                if(mach_hdr.filetype == MH_EXECUTE && slide != 0)
-                    qerror("%s: Warning executable can't be mapped at the right address (offset: 0x%x)\n", filename, slide);
-
-                if(strcmp(((struct segment_command*)(lc))->segname, "__TEXT") == 0)
-                {
-                    /* Text section */
-                    if(mach_hdr.filetype == MH_EXECUTE)
-                    {
-                        /* return the mach_header */
-                        *mh = (void*)(((struct segment_command*)(lc))->vmaddr + slide);
-                    }
-                    else
-                    {
-                        /* it is dyld save the section for gdb, we will be interested in dyld symbol
-                           while debuging */
-                        macho_text_sect = (void*)(((struct segment_command*)(lc))->vmaddr + slide);
-                        macho_offset = slide;
-                    }
-                }
-                break;
-            case LC_LOAD_DYLINKER:
-                dyld_entry_point = load_dylinker( &mach_hdr, (struct dylinker_command*)lc, fd, mach_hdr_pos, need_bswap );
-                break;
-            case LC_LOAD_DYLIB:
-                /* dyld will do that for us */
-                break;
-            case LC_THREAD:
-            case LC_UNIXTHREAD:
-                {
-                struct target_pt_regs * _regs;
-                if(mach_hdr.filetype == MH_DYLINKER)
-                    _regs = regs;
-                else
-                    _regs = 0;
-                entry_point = load_thread( &mach_hdr, (struct target_thread_command*)lc, _regs, fd, mach_hdr_pos, need_bswap );
-                }
-                break;
-            case LC_SYMTAB:
-                /* Save the symtab and strtab */
-                symtabcmd = (struct symtab_command *)lc;
-                break;
-            case LC_ID_DYLINKER:
-            case LC_ID_DYLIB:
-            case LC_UUID:
-            case LC_DYSYMTAB:
-            case LC_TWOLEVEL_HINTS:
-            case LC_PREBIND_CKSUM:
-            case LC_SUB_LIBRARY:
-                break;
-            default: fprintf(stderr, "warning: unknown command 0x%x in '%s'\n", lc->cmd, filename);
-        }
-        lc = (struct load_command*)((int)(lc)+(lc->cmdsize));
-    }
-
-    if(symtabcmd)
-    {
-        if(need_bswap)
-            bswap_symtabcmd(symtabcmd);
-
-        symtab_std = load_data(fd, symtabcmd->symoff+mach_hdr_pos, symtabcmd->nsyms * sizeof(struct nlist));
-        strtab = load_data(fd, symtabcmd->stroff+mach_hdr_pos, symtabcmd->strsize);
-
-        symtab = malloc(sizeof(struct nlist_extended) * symtabcmd->nsyms);
-
-        if(need_bswap)
-        {
-            for(i = 0, syment = symtab_std; i < symtabcmd->nsyms; i++, syment++)
-                bswap_sym(syment);
-        }
-
-        for(i = 0, sym = symtab, syment = symtab_std; i < symtabcmd->nsyms; i++, sym++, syment++)
-        {
-            struct nlist *sym_follow, *sym_next = 0;
-            unsigned int j;
-            memset(sym, 0, sizeof(*sym));
-
-            sym->n_type = syment->n_type;
-            if ( syment->n_type & N_STAB ) /* Debug symbols are skipped */
-                continue;
-
-            memcpy(sym, syment, sizeof(*syment));
-
-            /* Find the following symbol in order to get the current symbol size */
-            for(j = 0, sym_follow = symtab_std; j < symtabcmd->nsyms; j++, sym_follow++) {
-                if ( sym_follow->n_type & N_STAB || !(sym_follow->n_value > sym->st_value))
-                    continue;
-                if(!sym_next) {
-                    sym_next = sym_follow;
-                    continue;
-                }
-                if(!(sym_next->n_value > sym_follow->n_value))
-                    continue;
-                sym_next = sym_follow;
-            }
-            if(sym_next)
-                sym->st_size = sym_next->n_value - sym->st_value;
-            else
-                sym->st_size = 10; /* XXX: text_sec_hdr->size + text_sec_hdr->offset - sym->st_value; */
-
-            sym->st_value += slide;
-        }
-
-        free((void*)symtab_std);
-
-        {
-            DPRINTF("saving symtab of %s (%d symbol(s))\n", filename, symtabcmd->nsyms);
-            struct syminfo *s;
-            s = malloc(sizeof(*s));
-            s->disas_symtab = symtab;
-            s->disas_strtab = strtab;
-            s->disas_num_syms = symtabcmd->nsyms;
-            s->next = syminfos;
-            syminfos = s;
-        }
-    }
-    close(fd);
-    if(mach_hdr.filetype == MH_EXECUTE && dyld_entry_point)
-        return dyld_entry_point;
-    else
-        return entry_point+slide;
-}
-
-extern unsigned long stack_size;
-
-unsigned long setup_arg_pages(void * mh, char ** argv, char ** env)
-{
-    unsigned long stack_base, error, size;
-    int i;
-    int * stack;
-    int argc, envc;
-
-    /* Create enough stack to hold everything.  If we don't use
-     * it for args, we'll use it for something else...
-     */
-    size = stack_size;
-
-    error = target_mmap(0,
-                        size + qemu_host_page_size,
-                        PROT_READ | PROT_WRITE,
-                        MAP_PRIVATE | MAP_ANONYMOUS,
-                        -1, 0);
-    if (error == -1)
-        qerror("stk mmap");
-
-    /* we reserve one extra page at the top of the stack as guard */
-    target_mprotect(error + size, qemu_host_page_size, PROT_NONE);
-
-    stack_base = error + size;
-    stack = (void*)stack_base;
-/*
- *    | STRING AREA |
- *    +-------------+
- *    |      0      |
-*    +-------------+
- *    |  apple[n]   |
- *    +-------------+
- *           :
- *    +-------------+
- *    |  apple[0]   |
- *    +-------------+
- *    |      0      |
- *    +-------------+
- *    |    env[n]   |
- *    +-------------+
- *           :
- *           :
- *    +-------------+
- *    |    env[0]   |
- *    +-------------+
- *    |      0      |
- *    +-------------+
- *    | arg[argc-1] |
- *    +-------------+
- *           :
- *           :
- *    +-------------+
- *    |    arg[0]   |
- *    +-------------+
- *    |     argc    |
- *    +-------------+
- * sp->    |      mh     | address of where the a.out's file offset 0 is in memory
- *    +-------------+
-*/
-    /* Construct the stack Stack grows down */
-    stack--;
-
-    /* XXX: string should go up there */
-
-    *stack = 0;
-    stack--;
-
-    /* Push the absolute path of our executable */
-    DPRINTF("pushing apple %s (0x%x)\n", (char*)argv[0], (int)argv[0]);
-    stl(stack, (int) argv[0]);
-
-    stack--;
-
-    stl(stack, 0);
-    stack--;
-
-    /* Get envc */
-    for(envc = 0; env[envc]; envc++);
-
-    for(i = envc-1; i >= 0; i--)
-    {
-        DPRINTF("pushing env %s (0x%x)\n", (char*)env[i], (int)env[i]);
-        stl(stack, (int)env[i]);
-        stack--;
-
-        /* XXX: remove that when string will be on top of the stack */
-        page_set_flags((int)env[i], (int)(env[i]+strlen(env[i])), PROT_READ | PAGE_VALID);
-    }
-
-    /* Add on the stack the interp_prefix chosen if so */
-    if(interp_prefix[0])
-    {
-        char *dyld_root;
-        asprintf(&dyld_root, "DYLD_ROOT_PATH=%s", interp_prefix);
-        page_set_flags((int)dyld_root, (int)(dyld_root+strlen(interp_prefix)+1), PROT_READ | PAGE_VALID);
-
-        stl(stack, (int)dyld_root);
-        stack--;
-    }
-
-#ifdef DONT_USE_DYLD_SHARED_MAP
-    {
-        char *shared_map_mode;
-        asprintf(&shared_map_mode, "DYLD_SHARED_REGION=avoid");
-        page_set_flags((int)shared_map_mode, (int)(shared_map_mode+strlen(shared_map_mode)+1), PROT_READ | PAGE_VALID);
-
-        stl(stack, (int)shared_map_mode);
-        stack--;
-    }
-#endif
-
-#ifdef ACTIVATE_DYLD_TRACE
-    char * extra_env_static[] = {"DYLD_DEBUG_TRACE=yes",
-    "DYLD_PREBIND_DEBUG=3", "DYLD_UNKNOW_TRACE=yes",
-    "DYLD_PRINT_INITIALIZERS=yes",
-    "DYLD_PRINT_SEGMENTS=yes", "DYLD_PRINT_REBASINGS=yes", "DYLD_PRINT_BINDINGS=yes", "DYLD_PRINT_INITIALIZERS=yes", "DYLD_PRINT_WARNINGS=yes" };
-
-    char ** extra_env = malloc(sizeof(extra_env_static));
-    bcopy(extra_env_static, extra_env, sizeof(extra_env_static));
-    page_set_flags((int)extra_env, (int)((void*)extra_env+sizeof(extra_env_static)), PROT_READ | PAGE_VALID);
-
-    for(i = 0; i<9; i++)
-    {
-        DPRINTF("pushing (extra) env %s (0x%x)\n", (char*)extra_env[i], (int)extra_env[i]);
-        stl(stack, (int) extra_env[i]);
-        stack--;
-    }
-#endif
-
-    stl(stack, 0);
-    stack--;
-
-    /* Get argc */
-    for(argc = 0; argv[argc]; argc++);
-
-    for(i = argc-1; i >= 0; i--)
-    {
-        DPRINTF("pushing arg %s (0x%x)\n", (char*)argv[i], (int)argv[i]);
-        stl(stack, (int) argv[i]);
-        stack--;
-
-        /* XXX: remove that when string will be on top of the stack */
-        page_set_flags((int)argv[i], (int)(argv[i]+strlen(argv[i])), PROT_READ | PAGE_VALID);
-    }
-
-    DPRINTF("pushing argc %d\n", argc);
-    stl(stack, argc);
-    stack--;
-
-    DPRINTF("pushing mh 0x%x\n", (int)mh);
-    stl(stack, (int) mh);
-
-    /* Stack points on the mh */
-    return (unsigned long)stack;
-}
-
-int mach_exec(const char * filename, char ** argv, char ** envp,
-             struct target_pt_regs * regs)
-{
-    int entrypoint, stack;
-    void * mh; /* the Mach Header that will be  used by dyld */
-
-    DPRINTF("mach_exec at 0x%x\n", (int)mach_exec);
-
-    entrypoint = load_object(filename, regs, &mh);
-    stack = setup_arg_pages(mh, argv, envp);
-#if defined(TARGET_I386)
-    regs->eip = entrypoint;
-    regs->esp = stack;
-#elif defined(TARGET_PPC)
-    regs->nip = entrypoint;
-    regs->gpr[1] = stack;
-#endif
-    DPRINTF("mach_exec returns eip set to 0x%x esp 0x%x mh 0x%x\n", entrypoint, stack, (int)mh);
-
-    if(!entrypoint)
-        qerror("%s: no entry point!\n", filename);
-
-    return 0;
-}
diff --git a/darwin-user/main.c b/darwin-user/main.c
deleted file mode 100644
index 544e219..0000000
--- a/darwin-user/main.c
+++ /dev/null
@@ -1,1027 +0,0 @@
-/*
- *  qemu user main
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2006 Pierre d'Herbemont
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-
-#include <sys/syscall.h>
-#include <sys/mman.h>
-
-#include "qemu.h"
-#include "qemu-common.h"
-
-#define DEBUG_LOGFILE "/tmp/qemu.log"
-
-#ifdef __APPLE__
-#include <crt_externs.h>
-# define environ  (*_NSGetEnviron())
-#endif
-
-#include <mach/mach_init.h>
-#include <mach/vm_map.h>
-
-int singlestep;
-
-const char *interp_prefix = "";
-
-asm(".zerofill __STD_PROG_ZONE, __STD_PROG_ZONE, __std_prog_zone, 0x0dfff000");
-
-/* XXX: on x86 MAP_GROWSDOWN only works if ESP <= address + 32, so
-   we allocate a bigger stack. Need a better solution, for example
-   by remapping the process stack directly at the right place */
-unsigned long stack_size = 512 * 1024;
-
-void qerror(const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start(ap, fmt);
-    vfprintf(stderr, fmt, ap);
-    va_end(ap);
-    fprintf(stderr, "\n");
-    exit(1);
-}
-
-void gemu_log(const char *fmt, ...)
-{
-    va_list ap;
-
-    va_start(ap, fmt);
-    vfprintf(stderr, fmt, ap);
-    va_end(ap);
-}
-
-int cpu_get_pic_interrupt(CPUArchState *env)
-{
-    return -1;
-}
-#ifdef TARGET_PPC
-
-static inline uint64_t cpu_ppc_get_tb(CPUPPCState *env)
-{
-    /* TO FIX */
-    return 0;
-}
-
-uint64_t cpu_ppc_load_tbl(CPUPPCState *env)
-{
-    return cpu_ppc_get_tb(env);
-}
-
-uint32_t cpu_ppc_load_tbu(CPUPPCState *env)
-{
-    return cpu_ppc_get_tb(env) >> 32;
-}
-
-uint64_t cpu_ppc_load_atbl(CPUPPCState *env)
-{
-    return cpu_ppc_get_tb(env);
-}
-
-uint32_t cpu_ppc_load_atbu(CPUPPCState *env)
-{
-    return cpu_ppc_get_tb(env) >> 32;
-}
-
-uint32_t cpu_ppc601_load_rtcu(CPUPPCState *env)
-{
-    cpu_ppc_load_tbu(env);
-}
-
-uint32_t cpu_ppc601_load_rtcl(CPUPPCState *env)
-{
-    return cpu_ppc_load_tbl(env) & 0x3FFFFF80;
-}
-
-/* XXX: to be fixed */
-int ppc_dcr_read (ppc_dcr_t *dcr_env, int dcrn, uint32_t *valp)
-{
-    return -1;
-}
-
-int ppc_dcr_write (ppc_dcr_t *dcr_env, int dcrn, uint32_t val)
-{
-    return -1;
-}
-
-#define EXCP_DUMP(env, fmt, ...)                                        \
-do {                                                                    \
-    fprintf(stderr, fmt , ## __VA_ARGS__);                              \
-    cpu_dump_state(env, stderr, fprintf, 0);                            \
-    qemu_log(fmt, ## __VA_ARGS__);                                      \
-    log_cpu_state(env, 0);                                              \
-} while (0)
-
-void cpu_loop(CPUPPCState *env)
-{
-    int trapnr;
-    uint32_t ret;
-    target_siginfo_t info;
-
-    for(;;) {
-        trapnr = cpu_ppc_exec(env);
-        switch(trapnr) {
-        case POWERPC_EXCP_NONE:
-            /* Just go on */
-            break;
-        case POWERPC_EXCP_CRITICAL: /* Critical input                        */
-            cpu_abort(env, "Critical interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_MCHECK:   /* Machine check exception               */
-            cpu_abort(env, "Machine check exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_DSI:      /* Data storage exception                */
-#ifndef DAR
-/* To deal with multiple qemu header version as host for the darwin-user code */
-# define DAR SPR_DAR
-#endif
-            EXCP_DUMP(env, "Invalid data memory access: 0x" TARGET_FMT_lx "\n",
-                      env->spr[SPR_DAR]);
-            /* Handle this via the gdb */
-            gdb_handlesig (env, SIGSEGV);
-
-            info.si_addr = (void*)env->nip;
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_ISI:      /* Instruction storage exception         */
-            EXCP_DUMP(env, "Invalid instruction fetch: 0x\n" TARGET_FMT_lx "\n",
-                      env->spr[SPR_DAR]);
-            /* Handle this via the gdb */
-            gdb_handlesig (env, SIGSEGV);
-
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_EXTERNAL: /* External input                        */
-            cpu_abort(env, "External interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_ALIGN:    /* Alignment exception                   */
-            EXCP_DUMP(env, "Unaligned memory access\n");
-            info.si_errno = 0;
-            info.si_code = BUS_ADRALN;
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_PROGRAM:  /* Program exception                     */
-            /* XXX: check this */
-            switch (env->error_code & ~0xF) {
-            case POWERPC_EXCP_FP:
-                EXCP_DUMP(env, "Floating point program exception\n");
-                /* Set FX */
-                info.si_signo = SIGFPE;
-                info.si_errno = 0;
-                switch (env->error_code & 0xF) {
-                case POWERPC_EXCP_FP_OX:
-                    info.si_code = FPE_FLTOVF;
-                    break;
-                case POWERPC_EXCP_FP_UX:
-                    info.si_code = FPE_FLTUND;
-                    break;
-                case POWERPC_EXCP_FP_ZX:
-                case POWERPC_EXCP_FP_VXZDZ:
-                    info.si_code = FPE_FLTDIV;
-                    break;
-                case POWERPC_EXCP_FP_XX:
-                    info.si_code = FPE_FLTRES;
-                    break;
-                case POWERPC_EXCP_FP_VXSOFT:
-                    info.si_code = FPE_FLTINV;
-                    break;
-                case POWERPC_EXCP_FP_VXSNAN:
-                case POWERPC_EXCP_FP_VXISI:
-                case POWERPC_EXCP_FP_VXIDI:
-                case POWERPC_EXCP_FP_VXIMZ:
-                case POWERPC_EXCP_FP_VXVC:
-                case POWERPC_EXCP_FP_VXSQRT:
-                case POWERPC_EXCP_FP_VXCVI:
-                    info.si_code = FPE_FLTSUB;
-                    break;
-                default:
-                    EXCP_DUMP(env, "Unknown floating point exception (%02x)\n",
-                              env->error_code);
-                    break;
-                }
-                break;
-            case POWERPC_EXCP_INVAL:
-                EXCP_DUMP(env, "Invalid instruction\n");
-                info.si_signo = SIGILL;
-                info.si_errno = 0;
-                switch (env->error_code & 0xF) {
-                case POWERPC_EXCP_INVAL_INVAL:
-                    info.si_code = ILL_ILLOPC;
-                    break;
-                case POWERPC_EXCP_INVAL_LSWX:
-                    info.si_code = ILL_ILLOPN;
-                    break;
-                case POWERPC_EXCP_INVAL_SPR:
-                    info.si_code = ILL_PRVREG;
-                    break;
-                case POWERPC_EXCP_INVAL_FP:
-                    info.si_code = ILL_COPROC;
-                    break;
-                default:
-                    EXCP_DUMP(env, "Unknown invalid operation (%02x)\n",
-                              env->error_code & 0xF);
-                    info.si_code = ILL_ILLADR;
-                    break;
-                }
-                /* Handle this via the gdb */
-                gdb_handlesig (env, SIGSEGV);
-                break;
-            case POWERPC_EXCP_PRIV:
-                EXCP_DUMP(env, "Privilege violation\n");
-                info.si_signo = SIGILL;
-                info.si_errno = 0;
-                switch (env->error_code & 0xF) {
-                case POWERPC_EXCP_PRIV_OPC:
-                    info.si_code = ILL_PRVOPC;
-                    break;
-                case POWERPC_EXCP_PRIV_REG:
-                    info.si_code = ILL_PRVREG;
-                    break;
-                default:
-                    EXCP_DUMP(env, "Unknown privilege violation (%02x)\n",
-                              env->error_code & 0xF);
-                    info.si_code = ILL_PRVOPC;
-                    break;
-                }
-                break;
-            case POWERPC_EXCP_TRAP:
-                cpu_abort(env, "Tried to call a TRAP\n");
-                break;
-            default:
-                /* Should not happen ! */
-                cpu_abort(env, "Unknown program exception (%02x)\n",
-                          env->error_code);
-                break;
-            }
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_FPU:      /* Floating-point unavailable exception  */
-            EXCP_DUMP(env, "No floating point allowed\n");
-            info.si_signo = SIGILL;
-            info.si_errno = 0;
-            info.si_code = ILL_COPROC;
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_SYSCALL:  /* System call exception                 */
-            cpu_abort(env, "Syscall exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_APU:      /* Auxiliary processor unavailable       */
-            EXCP_DUMP(env, "No APU instruction allowed\n");
-            info.si_signo = SIGILL;
-            info.si_errno = 0;
-            info.si_code = ILL_COPROC;
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_DECR:     /* Decrementer exception                 */
-            cpu_abort(env, "Decrementer interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_FIT:      /* Fixed-interval timer interrupt        */
-            cpu_abort(env, "Fix interval timer interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_WDT:      /* Watchdog timer interrupt              */
-            cpu_abort(env, "Watchdog timer interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_DTLB:     /* Data TLB error                        */
-            cpu_abort(env, "Data TLB exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_ITLB:     /* Instruction TLB error                 */
-            cpu_abort(env, "Instruction TLB exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_DEBUG:    /* Debug interrupt                       */
-            gdb_handlesig (env, SIGTRAP);
-            break;
-        case POWERPC_EXCP_SPEU:     /* SPE/embedded floating-point unavail.  */
-            EXCP_DUMP(env, "No SPE/floating-point instruction allowed\n");
-            info.si_signo = SIGILL;
-            info.si_errno = 0;
-            info.si_code = ILL_COPROC;
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_EFPDI:    /* Embedded floating-point data IRQ      */
-            cpu_abort(env, "Embedded floating-point data IRQ not handled\n");
-            break;
-        case POWERPC_EXCP_EFPRI:    /* Embedded floating-point round IRQ     */
-            cpu_abort(env, "Embedded floating-point round IRQ not handled\n");
-            break;
-        case POWERPC_EXCP_EPERFM:   /* Embedded performance monitor IRQ      */
-            cpu_abort(env, "Performance monitor exception not handled\n");
-            break;
-        case POWERPC_EXCP_DOORI:    /* Embedded doorbell interrupt           */
-            cpu_abort(env, "Doorbell interrupt while in user mode. "
-                       "Aborting\n");
-            break;
-        case POWERPC_EXCP_DOORCI:   /* Embedded doorbell critical interrupt  */
-            cpu_abort(env, "Doorbell critical interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_RESET:    /* System reset exception                */
-            cpu_abort(env, "Reset interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_DSEG:     /* Data segment exception                */
-            cpu_abort(env, "Data segment exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_ISEG:     /* Instruction segment exception         */
-            cpu_abort(env, "Instruction segment exception "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_HDECR:    /* Hypervisor decrementer exception      */
-            cpu_abort(env, "Hypervisor decrementer interrupt "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_TRACE:    /* Trace exception                       */
-            /* Nothing to do:
-             * we use this exception to emulate step-by-step execution mode.
-             */
-            break;
-        case POWERPC_EXCP_HDSI:     /* Hypervisor data storage exception     */
-            cpu_abort(env, "Hypervisor data storage exception "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_HISI:     /* Hypervisor instruction storage excp   */
-            cpu_abort(env, "Hypervisor instruction storage exception "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_HDSEG:    /* Hypervisor data segment exception     */
-            cpu_abort(env, "Hypervisor data segment exception "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_HISEG:    /* Hypervisor instruction segment excp   */
-            cpu_abort(env, "Hypervisor instruction segment exception "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_VPU:      /* Vector unavailable exception          */
-            EXCP_DUMP(env, "No Altivec instructions allowed\n");
-            info.si_signo = SIGILL;
-            info.si_errno = 0;
-            info.si_code = ILL_COPROC;
-            info.si_addr = (void*)(env->nip - 4);
-            queue_signal(info.si_signo, &info);
-            break;
-        case POWERPC_EXCP_PIT:      /* Programmable interval timer IRQ       */
-            cpu_abort(env, "Programmable interval timer interrupt "
-                      "while in user mode. Aborting\n");
-            break;
-        case POWERPC_EXCP_IO:       /* IO error exception                    */
-            cpu_abort(env, "IO error exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_RUNM:     /* Run mode exception                    */
-            cpu_abort(env, "Run mode exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_EMUL:     /* Emulation trap exception              */
-            cpu_abort(env, "Emulation trap exception not handled\n");
-            break;
-        case POWERPC_EXCP_IFTLB:    /* Instruction fetch TLB error           */
-            cpu_abort(env, "Instruction fetch TLB exception "
-                      "while in user-mode. Aborting");
-            break;
-        case POWERPC_EXCP_DLTLB:    /* Data load TLB miss                    */
-            cpu_abort(env, "Data load TLB exception while in user-mode. "
-                      "Aborting");
-            break;
-        case POWERPC_EXCP_DSTLB:    /* Data store TLB miss                   */
-            cpu_abort(env, "Data store TLB exception while in user-mode. "
-                      "Aborting");
-            break;
-        case POWERPC_EXCP_FPA:      /* Floating-point assist exception       */
-            cpu_abort(env, "Floating-point assist exception not handled\n");
-            break;
-        case POWERPC_EXCP_IABR:     /* Instruction address breakpoint        */
-            cpu_abort(env, "Instruction address breakpoint exception "
-                      "not handled\n");
-            break;
-        case POWERPC_EXCP_SMI:      /* System management interrupt           */
-            cpu_abort(env, "System management interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_THERM:    /* Thermal interrupt                     */
-            cpu_abort(env, "Thermal interrupt interrupt while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_PERFM:    /* Embedded performance monitor IRQ      */
-            cpu_abort(env, "Performance monitor exception not handled\n");
-            break;
-        case POWERPC_EXCP_VPUA:     /* Vector assist exception               */
-            cpu_abort(env, "Vector assist exception not handled\n");
-            break;
-        case POWERPC_EXCP_SOFTP:    /* Soft patch exception                  */
-            cpu_abort(env, "Soft patch exception not handled\n");
-            break;
-        case POWERPC_EXCP_MAINT:    /* Maintenance exception                 */
-            cpu_abort(env, "Maintenance exception while in user mode. "
-                      "Aborting\n");
-            break;
-        case POWERPC_EXCP_STOP:     /* stop translation                      */
-            /* We did invalidate the instruction cache. Go on */
-            break;
-        case POWERPC_EXCP_BRANCH:   /* branch instruction:                   */
-            /* We just stopped because of a branch. Go on */
-            break;
-        case POWERPC_EXCP_SYSCALL_USER:
-            /* system call in user-mode emulation */
-            /* system call */
-            if(((int)env->gpr[0]) <= SYS_MAXSYSCALL && ((int)env->gpr[0])>0)
-                ret = do_unix_syscall(env, env->gpr[0]/*, env->gpr[3], env->gpr[4],
-                                      env->gpr[5], env->gpr[6], env->gpr[7],
-                                      env->gpr[8], env->gpr[9], env->gpr[10]*/);
-            else if(((int)env->gpr[0])<0)
-                ret = do_mach_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
-                                      env->gpr[5], env->gpr[6], env->gpr[7],
-                                      env->gpr[8], env->gpr[9], env->gpr[10]);
-            else
-                ret = do_thread_syscall(env, env->gpr[0], env->gpr[3], env->gpr[4],
-                                        env->gpr[5], env->gpr[6], env->gpr[7],
-                                        env->gpr[8], env->gpr[9], env->gpr[10]);
-
-            /* Unix syscall error signaling */
-            if(((int)env->gpr[0]) <= SYS_MAXSYSCALL && ((int)env->gpr[0])>0)
-            {
-                if( (int)ret < 0 )
-                    env->nip += 0;
-                else
-                    env->nip += 4;
-            }
-
-            /* Return value */
-            env->gpr[3] = ret;
-            break;
-        case EXCP_INTERRUPT:
-            /* just indicate that signals should be handled asap */
-            break;
-        default:
-            cpu_abort(env, "Unknown exception 0x%d. Aborting\n", trapnr);
-            break;
-        }
-        process_pending_signals(env);
-    }
-}
-#endif
-
-
-#ifdef TARGET_I386
-
-/***********************************************************/
-/* CPUX86 core interface */
-
-uint64_t cpu_get_tsc(CPUX86State *env)
-{
-    return cpu_get_real_ticks();
-}
-
-void
-write_dt(void *ptr, unsigned long addr, unsigned long limit,
-                     int flags)
-{
-    unsigned int e1, e2;
-    e1 = (addr << 16) | (limit & 0xffff);
-    e2 = ((addr >> 16) & 0xff) | (addr & 0xff000000) | (limit & 0x000f0000);
-    e2 |= flags;
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
-}
-
-static void set_gate(void *ptr, unsigned int type, unsigned int dpl,
-                     unsigned long addr, unsigned int sel)
-{
-    unsigned int e1, e2;
-    e1 = (addr & 0xffff) | (sel << 16);
-    e2 = (addr & 0xffff0000) | 0x8000 | (dpl << 13) | (type << 8);
-    stl((uint8_t *)ptr, e1);
-    stl((uint8_t *)ptr + 4, e2);
-}
-
-#define GDT_TABLE_SIZE 14
-#define LDT_TABLE_SIZE 15
-#define IDT_TABLE_SIZE 256
-#define TSS_SIZE 104
-uint64_t gdt_table[GDT_TABLE_SIZE];
-uint64_t ldt_table[LDT_TABLE_SIZE];
-uint64_t idt_table[IDT_TABLE_SIZE];
-uint32_t tss[TSS_SIZE];
-
-/* only dpl matters as we do only user space emulation */
-static void set_idt(int n, unsigned int dpl)
-{
-    set_gate(idt_table + n, 0, dpl, 0, 0);
-}
-
-/* ABI convention: after a syscall if there was an error the CF flag is set */
-static inline void set_error(CPUX86State *env, int ret)
-{
-    if(ret<0)
-        env->eflags = env->eflags | 0x1;
-    else
-        env->eflags &= ~0x1;
-    env->regs[R_EAX] = ret;
-}
-
-void cpu_loop(CPUX86State *env)
-{
-    int trapnr;
-    int ret;
-    uint8_t *pc;
-    target_siginfo_t info;
-
-    for(;;) {
-        trapnr = cpu_x86_exec(env);
-        uint32_t *params = (uint32_t *)env->regs[R_ESP];
-        switch(trapnr) {
-        case 0x79: /* Our commpage hack back door exit is here */
-            do_commpage(env,  env->eip,   *(params + 1), *(params + 2),
-                                          *(params + 3), *(params + 4),
-                                          *(params + 5), *(params + 6),
-                                          *(params + 7), *(params + 8));
-            break;
-        case 0x81: /* mach syscall */
-        {
-            ret = do_mach_syscall(env,  env->regs[R_EAX],
-                                          *(params + 1), *(params + 2),
-                                          *(params + 3), *(params + 4),
-                                          *(params + 5), *(params + 6),
-                                          *(params + 7), *(params + 8));
-            set_error(env, ret);
-            break;
-        }
-        case 0x90: /* unix backdoor */
-        {
-            /* after sysenter, stack is in R_ECX, new eip in R_EDX (sysexit will flip them back)*/
-            int saved_stack = env->regs[R_ESP];
-            env->regs[R_ESP] = env->regs[R_ECX];
-
-            ret = do_unix_syscall(env, env->regs[R_EAX]);
-
-            env->regs[R_ECX] = env->regs[R_ESP];
-            env->regs[R_ESP] = saved_stack;
-
-            set_error(env, ret);
-            break;
-        }
-        case 0x80: /* unix syscall */
-        {
-            ret = do_unix_syscall(env, env->regs[R_EAX]/*,
-                                          *(params + 1), *(params + 2),
-                                          *(params + 3), *(params + 4),
-                                          *(params + 5), *(params + 6),
-                                          *(params + 7), *(params + 8)*/);
-            set_error(env, ret);
-            break;
-        }
-        case 0x82: /* thread syscall */
-        {
-            ret = do_thread_syscall(env,  env->regs[R_EAX],
-                                          *(params + 1), *(params + 2),
-                                          *(params + 3), *(params + 4),
-                                          *(params + 5), *(params + 6),
-                                          *(params + 7), *(params + 8));
-            set_error(env, ret);
-            break;
-        }
-        case EXCP0B_NOSEG:
-        case EXCP0C_STACK:
-            info.si_signo = SIGBUS;
-            info.si_errno = 0;
-            info.si_code = BUS_NOOP;
-            info.si_addr = 0;
-            gdb_handlesig (env, SIGBUS);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP0D_GPF:
-            info.si_signo = SIGSEGV;
-            info.si_errno = 0;
-            info.si_code = SEGV_NOOP;
-            info.si_addr = 0;
-            gdb_handlesig (env, SIGSEGV);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP0E_PAGE:
-            info.si_signo = SIGSEGV;
-            info.si_errno = 0;
-            if (!(env->error_code & 1))
-                info.si_code = SEGV_MAPERR;
-            else
-                info.si_code = SEGV_ACCERR;
-            info.si_addr = (void*)env->cr[2];
-            gdb_handlesig (env, SIGSEGV);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP00_DIVZ:
-            /* division by zero */
-            info.si_signo = SIGFPE;
-            info.si_errno = 0;
-            info.si_code = FPE_INTDIV;
-            info.si_addr = (void*)env->eip;
-            gdb_handlesig (env, SIGFPE);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP01_SSTP:
-        case EXCP03_INT3:
-            info.si_signo = SIGTRAP;
-            info.si_errno = 0;
-            info.si_code = TRAP_BRKPT;
-            info.si_addr = (void*)env->eip;
-            gdb_handlesig (env, SIGTRAP);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP04_INTO:
-        case EXCP05_BOUND:
-            info.si_signo = SIGSEGV;
-            info.si_errno = 0;
-            info.si_code = SEGV_NOOP;
-            info.si_addr = 0;
-            gdb_handlesig (env, SIGSEGV);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP06_ILLOP:
-            info.si_signo = SIGILL;
-            info.si_errno = 0;
-            info.si_code = ILL_ILLOPN;
-            info.si_addr = (void*)env->eip;
-            gdb_handlesig (env, SIGILL);
-            queue_signal(info.si_signo, &info);
-            break;
-        case EXCP_INTERRUPT:
-            /* just indicate that signals should be handled asap */
-            break;
-        case EXCP_DEBUG:
-            {
-                int sig;
-
-                sig = gdb_handlesig (env, SIGTRAP);
-                if (sig)
-                  {
-                    info.si_signo = sig;
-                    info.si_errno = 0;
-                    info.si_code = TRAP_BRKPT;
-                    queue_signal(info.si_signo, &info);
-                  }
-            }
-            break;
-        default:
-            pc = (void*)(env->segs[R_CS].base + env->eip);
-            fprintf(stderr, "qemu: 0x%08lx: unhandled CPU exception 0x%x - aborting\n",
-                    (long)pc, trapnr);
-            abort();
-        }
-        process_pending_signals(env);
-    }
-}
-#endif
-
-static void usage(void)
-{
-    printf("qemu-" TARGET_ARCH " version " QEMU_VERSION ", Copyright (c) 2003-2004 Fabrice Bellard\n"
-           "usage: qemu-" TARGET_ARCH " [-h] [-d opts] [-L path] [-s size] program [arguments...]\n"
-           "Darwin CPU emulator (compiled for %s emulation)\n"
-           "\n"
-           "-h           print this help\n"
-           "-L path      set the %s library path (default='%s')\n"
-           "-s size      set the stack size in bytes (default=%ld)\n"
-           "\n"
-           "debug options:\n"
-           "-d options   activate log (logfile='%s')\n"
-           "-g wait for gdb on port 1234\n"
-           "-p pagesize  set the host page size to 'pagesize'\n",
-           "-singlestep  always run in singlestep mode\n"
-           TARGET_ARCH,
-           TARGET_ARCH,
-           interp_prefix,
-           stack_size,
-           DEBUG_LOGFILE);
-    exit(1);
-}
-
-/* XXX: currently only used for async signals (see signal.c) */
-CPUArchState *global_env;
-
-/* used to free thread contexts */
-TaskState *first_task_state;
-
-int main(int argc, char **argv)
-{
-    const char *filename;
-    const char *log_file = DEBUG_LOGFILE;
-    const char *log_mask = NULL;
-    struct target_pt_regs regs1, *regs = &regs1;
-    TaskState ts1, *ts = &ts1;
-    CPUArchState *env;
-    int optind;
-    short use_gdbstub = 0;
-    const char *r;
-    const char *cpu_model;
-
-    if (argc <= 1)
-        usage();
-
-    module_call_init(MODULE_INIT_QOM);
-
-    optind = 1;
-    for(;;) {
-        if (optind >= argc)
-            break;
-        r = argv[optind];
-        if (r[0] != '-')
-            break;
-        optind++;
-        r++;
-        if (!strcmp(r, "-")) {
-            break;
-        } else if (!strcmp(r, "d")) {
-            if (optind >= argc) {
-                break;
-            }
-            log_mask = argv[optind++];
-        } else if (!strcmp(r, "D")) {
-            if (optind >= argc) {
-                break;
-            }
-            log_file = argv[optind++];
-        } else if (!strcmp(r, "s")) {
-            r = argv[optind++];
-            stack_size = strtol(r, (char **)&r, 0);
-            if (stack_size <= 0)
-                usage();
-            if (*r == 'M')
-                stack_size *= 1024 * 1024;
-            else if (*r == 'k' || *r == 'K')
-                stack_size *= 1024;
-        } else if (!strcmp(r, "L")) {
-            interp_prefix = argv[optind++];
-        } else if (!strcmp(r, "p")) {
-            qemu_host_page_size = atoi(argv[optind++]);
-            if (qemu_host_page_size == 0 ||
-                (qemu_host_page_size & (qemu_host_page_size - 1)) != 0) {
-                fprintf(stderr, "page size must be a power of two\n");
-                exit(1);
-            }
-        } else
-        if (!strcmp(r, "g")) {
-            use_gdbstub = 1;
-        } else if (!strcmp(r, "cpu")) {
-            cpu_model = argv[optind++];
-            if (strcmp(cpu_model, "?") == 0) {
-/* XXX: implement xxx_cpu_list for targets that still miss it */
-#if defined(cpu_list)
-                    cpu_list(stdout, &fprintf);
-#endif
-                exit(1);
-            }
-        } else if (!strcmp(r, "singlestep")) {
-            singlestep = 1;
-        } else
-        {
-            usage();
-        }
-    }
-
-    /* init debug */
-    cpu_set_log_filename(log_file);
-    if (log_mask) {
-        int mask;
-        CPULogItem *item;
-
-        mask = cpu_str_to_log_mask(log_mask);
-        if (!mask) {
-            printf("Log items (comma separated):\n");
-            for (item = cpu_log_items; item->mask != 0; item++) {
-                printf("%-10s %s\n", item->name, item->help);
-            }
-            exit(1);
-        }
-        cpu_set_log(mask);
-    }
-
-    if (optind >= argc) {
-        usage();
-    }
-    filename = argv[optind];
-
-    /* Zero out regs */
-    memset(regs, 0, sizeof(struct target_pt_regs));
-
-    if (cpu_model == NULL) {
-#if defined(TARGET_I386)
-#ifdef TARGET_X86_64
-        cpu_model = "qemu64";
-#else
-        cpu_model = "qemu32";
-#endif
-#elif defined(TARGET_PPC)
-#ifdef TARGET_PPC64
-        cpu_model = "970";
-#else
-        cpu_model = "750";
-#endif
-#else
-#error unsupported CPU
-#endif
-    }
-    tcg_exec_init(0);
-    cpu_exec_init_all();
-    /* NOTE: we need to init the CPU at this stage to get
-       qemu_host_page_size */
-    env = cpu_init(cpu_model);
-    cpu_state_reset(env);
-
-    printf("Starting %s with qemu\n----------------\n", filename);
-
-    commpage_init();
-
-    if (mach_exec(filename, argv+optind, environ, regs) != 0) {
-    printf("Error loading %s\n", filename);
-    _exit(1);
-    }
-
-    syscall_init();
-    signal_init();
-    global_env = env;
-
-    /* build Task State */
-    memset(ts, 0, sizeof(TaskState));
-    env->opaque = ts;
-    ts->used = 1;
-
-#if defined(TARGET_I386)
-    cpu_x86_set_cpl(env, 3);
-
-    env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
-    env->hflags |= HF_PE_MASK;
-
-    if (env->cpuid_features & CPUID_SSE) {
-        env->cr[4] |= CR4_OSFXSR_MASK;
-        env->hflags |= HF_OSFXSR_MASK;
-    }
-
-    /* flags setup : we activate the IRQs by default as in user mode */
-    env->eflags |= IF_MASK;
-
-    /* darwin register setup */
-    env->regs[R_EAX] = regs->eax;
-    env->regs[R_EBX] = regs->ebx;
-    env->regs[R_ECX] = regs->ecx;
-    env->regs[R_EDX] = regs->edx;
-    env->regs[R_ESI] = regs->esi;
-    env->regs[R_EDI] = regs->edi;
-    env->regs[R_EBP] = regs->ebp;
-    env->regs[R_ESP] = regs->esp;
-    env->eip = regs->eip;
-
-    /* Darwin LDT setup */
-    /* 2 - User code segment
-       3 - User data segment
-       4 - User cthread */
-    bzero(ldt_table, LDT_TABLE_SIZE * sizeof(ldt_table[0]));
-    env->ldt.base = (uint32_t) ldt_table;
-    env->ldt.limit = sizeof(ldt_table) - 1;
-
-    write_dt(ldt_table + 2, 0, 0xfffff,
-             DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-             (3 << DESC_DPL_SHIFT) | (0xa << DESC_TYPE_SHIFT));
-    write_dt(ldt_table + 3, 0, 0xfffff,
-             DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-             (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
-    write_dt(ldt_table + 4, 0, 0xfffff,
-             DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-             (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
-
-    /* Darwin GDT setup.
-     * has changed a lot between old Darwin/x86 (pre-Mac Intel) and Mac OS X/x86,
-       now everything is done via  int 0x81(mach) int 0x82 (thread) and sysenter/sysexit(unix) */
-    bzero(gdt_table, sizeof(gdt_table));
-    env->gdt.base = (uint32_t)gdt_table;
-    env->gdt.limit = sizeof(gdt_table) - 1;
-
-    /* Set up a back door to handle sysenter syscalls (unix) */
-    char * syscallbackdoor = malloc(64);
-    page_set_flags((int)syscallbackdoor, (int)syscallbackdoor + 64, PROT_EXEC | PROT_READ | PAGE_VALID);
-
-    int i = 0;
-    syscallbackdoor[i++] = 0xcd;
-    syscallbackdoor[i++] = 0x90; /* int 0x90 */
-    syscallbackdoor[i++] = 0x0F;
-    syscallbackdoor[i++] = 0x35; /* sysexit */
-
-    /* Darwin sysenter/sysexit setup */
-    env->sysenter_cs = 0x1; //XXX
-    env->sysenter_eip = (int)syscallbackdoor;
-    env->sysenter_esp = (int)malloc(64);
-
-    /* Darwin TSS setup
-       This must match up with GDT[4] */
-    env->tr.base = (uint32_t) tss;
-    env->tr.limit = sizeof(tss) - 1;
-    env->tr.flags = DESC_P_MASK | (0x9 << DESC_TYPE_SHIFT);
-    stw(tss + 2, 0x10);  // ss0 = 0x10 = GDT[2] = Kernel Data Segment
-
-    /* Darwin interrupt setup */
-    bzero(idt_table, sizeof(idt_table));
-    env->idt.base = (uint32_t) idt_table;
-    env->idt.limit = sizeof(idt_table) - 1;
-    set_idt(0, 0);
-    set_idt(1, 0);
-    set_idt(2, 0);
-    set_idt(3, 3);
-    set_idt(4, 3);
-    set_idt(5, 3);
-    set_idt(6, 0);
-    set_idt(7, 0);
-    set_idt(8, 0);
-    set_idt(9, 0);
-    set_idt(10, 0);
-    set_idt(11, 0);
-    set_idt(12, 0);
-    set_idt(13, 0);
-    set_idt(14, 0);
-    set_idt(15, 0);
-    set_idt(16, 0);
-    set_idt(17, 0);
-    set_idt(18, 0);
-    set_idt(19, 0);
-    /* Syscalls are done via
-        int 0x80 (unix) (rarely used)
-        int 0x81 (mach)
-        int 0x82 (thread)
-        int 0x83 (diag) (not handled here)
-        sysenter/sysexit (unix) -> we redirect that to int 0x90 */
-    set_idt(0x79, 3); /* Commpage hack, here is our backdoor interrupt */
-    set_idt(0x80, 3); /* Unix Syscall */
-    set_idt(0x81, 3); /* Mach Syscalls */
-    set_idt(0x82, 3); /* thread Syscalls */
-
-    set_idt(0x90, 3); /* qemu-darwin-user's Unix syscalls backdoor */
-
-
-    cpu_x86_load_seg(env, R_CS, __USER_CS);
-    cpu_x86_load_seg(env, R_DS, __USER_DS);
-    cpu_x86_load_seg(env, R_ES, __USER_DS);
-    cpu_x86_load_seg(env, R_SS, __USER_DS);
-    cpu_x86_load_seg(env, R_FS, __USER_DS);
-    cpu_x86_load_seg(env, R_GS, __USER_DS);
-
-#elif defined(TARGET_PPC)
-    {
-        int i;
-
-#if defined(TARGET_PPC64)
-#if defined(TARGET_ABI32)
-        env->msr &= ~((target_ulong)1 << MSR_SF);
-#else
-        env->msr |= (target_ulong)1 << MSR_SF;
-#endif
-#endif
-        env->nip = regs->nip;
-        for(i = 0; i < 32; i++) {
-            env->gpr[i] = regs->gpr[i];
-        }
-    }
-#else
-#error unsupported target CPU
-#endif
-
-    if (use_gdbstub) {
-        printf("Waiting for gdb Connection on port 1234...\n");
-        gdbserver_start (1234);
-        gdb_handlesig(env, 0);
-    }
-
-    cpu_loop(env);
-    /* never exits */
-    return 0;
-}
diff --git a/darwin-user/mmap.c b/darwin-user/mmap.c
deleted file mode 100644
index d840b28..0000000
--- a/darwin-user/mmap.c
+++ /dev/null
@@ -1,409 +0,0 @@
-/*
- *  mmap support for qemu
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <unistd.h>
-#include <errno.h>
-#include <sys/mman.h>
-
-#include "qemu.h"
-
-//#define DEBUG_MMAP
-
-/* NOTE: all the constants are the HOST ones */
-int target_mprotect(unsigned long start, unsigned long len, int prot)
-{
-    unsigned long end, host_start, host_end, addr;
-    int prot1, ret;
-
-#ifdef DEBUG_MMAP
-    printf("mprotect: start=0x%lx len=0x%lx prot=%c%c%c\n", start, len,
-           prot & PROT_READ ? 'r' : '-',
-           prot & PROT_WRITE ? 'w' : '-',
-           prot & PROT_EXEC ? 'x' : '-');
-#endif
-
-    if ((start & ~TARGET_PAGE_MASK) != 0)
-        return -EINVAL;
-    len = TARGET_PAGE_ALIGN(len);
-    end = start + len;
-    if (end < start)
-        return -EINVAL;
-    if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC))
-        return -EINVAL;
-    if (len == 0)
-        return 0;
-
-    host_start = start & qemu_host_page_mask;
-    host_end = HOST_PAGE_ALIGN(end);
-    if (start > host_start) {
-        /* handle host page containing start */
-        prot1 = prot;
-        for(addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
-            prot1 |= page_get_flags(addr);
-        }
-        if (host_end == host_start + qemu_host_page_size) {
-            for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-                prot1 |= page_get_flags(addr);
-            }
-            end = host_end;
-        }
-        ret = mprotect((void *)host_start, qemu_host_page_size, prot1 & PAGE_BITS);
-        if (ret != 0)
-            return ret;
-        host_start += qemu_host_page_size;
-    }
-    if (end < host_end) {
-        prot1 = prot;
-        for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-            prot1 |= page_get_flags(addr);
-        }
-        ret = mprotect((void *)(host_end - qemu_host_page_size), qemu_host_page_size,
-                       prot1 & PAGE_BITS);
-        if (ret != 0)
-            return ret;
-        host_end -= qemu_host_page_size;
-    }
-
-    /* handle the pages in the middle */
-    if (host_start < host_end) {
-        ret = mprotect((void *)host_start, host_end - host_start, prot);
-        if (ret != 0)
-            return ret;
-    }
-    page_set_flags(start, start + len, prot | PAGE_VALID);
-    return 0;
-}
-
-/* map an incomplete host page */
-int mmap_frag(unsigned long host_start,
-               unsigned long start, unsigned long end,
-               int prot, int flags, int fd, unsigned long offset)
-{
-    unsigned long host_end, ret, addr;
-    int prot1, prot_new;
-
-    host_end = host_start + qemu_host_page_size;
-
-    /* get the protection of the target pages outside the mapping */
-    prot1 = 0;
-    for(addr = host_start; addr < host_end; addr++) {
-        if (addr < start || addr >= end)
-            prot1 |= page_get_flags(addr);
-    }
-
-    if (prot1 == 0) {
-        /* no page was there, so we allocate one */
-        ret = (long)mmap((void *)host_start, qemu_host_page_size, prot,
-                         flags | MAP_ANONYMOUS, -1, 0);
-        if (ret == -1)
-            return ret;
-    }
-    prot1 &= PAGE_BITS;
-
-    prot_new = prot | prot1;
-    if (!(flags & MAP_ANONYMOUS)) {
-        /* msync() won't work here, so we return an error if write is
-           possible while it is a shared mapping */
-#ifndef __APPLE__
-        if ((flags & MAP_TYPE) == MAP_SHARED &&
-#else
-        if ((flags &  MAP_SHARED) &&
-#endif
-            (prot & PROT_WRITE))
-            return -1;
-
-        /* adjust protection to be able to read */
-        if (!(prot1 & PROT_WRITE))
-            mprotect((void *)host_start, qemu_host_page_size, prot1 | PROT_WRITE);
-
-        /* read the corresponding file data */
-        pread(fd, (void *)start, end - start, offset);
-
-        /* put final protection */
-        if (prot_new != (prot1 | PROT_WRITE))
-            mprotect((void *)host_start, qemu_host_page_size, prot_new);
-    } else {
-        /* just update the protection */
-        if (prot_new != prot1) {
-            mprotect((void *)host_start, qemu_host_page_size, prot_new);
-        }
-    }
-    return 0;
-}
-
-/* NOTE: all the constants are the HOST ones */
-long target_mmap(unsigned long start, unsigned long len, int prot,
-                 int flags, int fd, unsigned long offset)
-{
-    unsigned long ret, end, host_start, host_end, retaddr, host_offset, host_len;
-#if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__)
-    static unsigned long last_start = 0x40000000;
-#endif
-
-#ifdef DEBUG_MMAP
-    {
-        printf("mmap: start=0x%lx len=0x%lx prot=%c%c%c flags=",
-               start, len,
-               prot & PROT_READ ? 'r' : '-',
-               prot & PROT_WRITE ? 'w' : '-',
-               prot & PROT_EXEC ? 'x' : '-');
-        if (flags & MAP_FIXED)
-            printf("MAP_FIXED ");
-        if (flags & MAP_ANONYMOUS)
-            printf("MAP_ANON ");
-#ifndef MAP_TYPE
-# define MAP_TYPE 0x3
-#endif
-        switch(flags & MAP_TYPE) {
-        case MAP_PRIVATE:
-            printf("MAP_PRIVATE ");
-            break;
-        case MAP_SHARED:
-            printf("MAP_SHARED ");
-            break;
-        default:
-            printf("[MAP_TYPE=0x%x] ", flags & MAP_TYPE);
-            break;
-        }
-        printf("fd=%d offset=%lx\n", fd, offset);
-    }
-#endif
-
-    if (offset & ~TARGET_PAGE_MASK)
-        return -EINVAL;
-
-    len = TARGET_PAGE_ALIGN(len);
-    if (len == 0)
-        return start;
-    host_start = start & qemu_host_page_mask;
-
-    if (!(flags & MAP_FIXED)) {
-#if defined(__alpha__) || defined(__sparc__) || defined(__x86_64__)
-        /* tell the kernel to search at the same place as i386 */
-        if (host_start == 0) {
-            host_start = last_start;
-            last_start += HOST_PAGE_ALIGN(len);
-        }
-#endif
-        if (qemu_host_page_size != qemu_real_host_page_size) {
-            /* NOTE: this code is only for debugging with '-p' option */
-            /* reserve a memory area */
-            host_len = HOST_PAGE_ALIGN(len) + qemu_host_page_size - TARGET_PAGE_SIZE;
-            host_start = (long)mmap((void *)host_start, host_len, PROT_NONE,
-                                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-            if (host_start == -1)
-                return host_start;
-            host_end = host_start + host_len;
-            start = HOST_PAGE_ALIGN(host_start);
-            end = start + HOST_PAGE_ALIGN(len);
-            if (start > host_start)
-                munmap((void *)host_start, start - host_start);
-            if (end < host_end)
-                munmap((void *)end, host_end - end);
-            /* use it as a fixed mapping */
-            flags |= MAP_FIXED;
-        } else {
-            /* if not fixed, no need to do anything */
-            host_offset = offset & qemu_host_page_mask;
-            host_len = len + offset - host_offset;
-            start = (long)mmap((void *)host_start, host_len,
-                               prot, flags, fd, host_offset);
-            if (start == -1)
-                return start;
-            /* update start so that it points to the file position at 'offset' */
-            if (!(flags & MAP_ANONYMOUS))
-                start += offset - host_offset;
-            goto the_end1;
-        }
-    }
-
-    if (start & ~TARGET_PAGE_MASK)
-        return -EINVAL;
-    end = start + len;
-    host_end = HOST_PAGE_ALIGN(end);
-
-    /* worst case: we cannot map the file because the offset is not
-       aligned, so we read it */
-    if (!(flags & MAP_ANONYMOUS) &&
-        (offset & ~qemu_host_page_mask) != (start & ~qemu_host_page_mask)) {
-        /* msync() won't work here, so we return an error if write is
-           possible while it is a shared mapping */
-#ifndef __APPLE__
-        if ((flags & MAP_TYPE) == MAP_SHARED &&
-#else
-        if ((flags & MAP_SHARED) &&
-#endif
-            (prot & PROT_WRITE))
-            return -EINVAL;
-        retaddr = target_mmap(start, len, prot | PROT_WRITE,
-                              MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
-                              -1, 0);
-        if (retaddr == -1)
-            return retaddr;
-        pread(fd, (void *)start, len, offset);
-        if (!(prot & PROT_WRITE)) {
-            ret = target_mprotect(start, len, prot);
-            if (ret != 0)
-                return ret;
-        }
-        goto the_end;
-    }
-
-    /* handle the start of the mapping */
-    if (start > host_start) {
-        if (host_end == host_start + qemu_host_page_size) {
-            /* one single host page */
-            ret = mmap_frag(host_start, start, end,
-                            prot, flags, fd, offset);
-            if (ret == -1)
-                return ret;
-            goto the_end1;
-        }
-        ret = mmap_frag(host_start, start, host_start + qemu_host_page_size,
-                        prot, flags, fd, offset);
-        if (ret == -1)
-            return ret;
-        host_start += qemu_host_page_size;
-    }
-    /* handle the end of the mapping */
-    if (end < host_end) {
-        ret = mmap_frag(host_end - qemu_host_page_size,
-                        host_end - qemu_host_page_size, host_end,
-                        prot, flags, fd,
-                        offset + host_end - qemu_host_page_size - start);
-        if (ret == -1)
-            return ret;
-        host_end -= qemu_host_page_size;
-    }
-
-    /* map the middle (easier) */
-    if (host_start < host_end) {
-        unsigned long offset1;
-	if (flags & MAP_ANONYMOUS)
-	  offset1 = 0;
-	else
-	  offset1 = offset + host_start - start;
-        ret = (long)mmap((void *)host_start, host_end - host_start,
-                         prot, flags, fd, offset1);
-        if (ret == -1)
-            return ret;
-    }
- the_end1:
-    page_set_flags(start, start + len, prot | PAGE_VALID);
- the_end:
-#ifdef DEBUG_MMAP
-    printf("target_mmap: ret=0x%lx\n", (long)start);
-    page_dump(stdout);
-    printf("\n");
-#endif
-    return start;
-}
-
-int target_munmap(unsigned long start, unsigned long len)
-{
-    unsigned long end, host_start, host_end, addr;
-    int prot, ret;
-
-#ifdef DEBUG_MMAP
-    printf("munmap: start=0x%lx len=0x%lx\n", start, len);
-#endif
-    if (start & ~TARGET_PAGE_MASK)
-        return -EINVAL;
-    len = TARGET_PAGE_ALIGN(len);
-    if (len == 0)
-        return -EINVAL;
-    end = start + len;
-    host_start = start & qemu_host_page_mask;
-    host_end = HOST_PAGE_ALIGN(end);
-
-    if (start > host_start) {
-        /* handle host page containing start */
-        prot = 0;
-        for(addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
-        }
-        if (host_end == host_start + qemu_host_page_size) {
-            for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-                prot |= page_get_flags(addr);
-            }
-            end = host_end;
-        }
-        if (prot != 0)
-            host_start += qemu_host_page_size;
-    }
-    if (end < host_end) {
-        prot = 0;
-        for(addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
-            prot |= page_get_flags(addr);
-        }
-        if (prot != 0)
-            host_end -= qemu_host_page_size;
-    }
-
-    /* unmap what we can */
-    if (host_start < host_end) {
-        ret = munmap((void *)host_start, host_end - host_start);
-        if (ret != 0)
-            return ret;
-    }
-
-    page_set_flags(start, start + len, 0);
-    return 0;
-}
-
-/* XXX: currently, we only handle MAP_ANONYMOUS and not MAP_FIXED
-   blocks which have been allocated starting on a host page */
-long target_mremap(unsigned long old_addr, unsigned long old_size,
-                   unsigned long new_size, unsigned long flags,
-                   unsigned long new_addr)
-{
-#ifndef __APPLE__
-    /* XXX: use 5 args syscall */
-    new_addr = (long)mremap((void *)old_addr, old_size, new_size, flags);
-    if (new_addr == -1)
-        return new_addr;
-    prot = page_get_flags(old_addr);
-    page_set_flags(old_addr, old_addr + old_size, 0);
-    page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);
-    return new_addr;
-#else
-    qerror("target_mremap: unsupported\n");
-#endif
-
-}
-
-int target_msync(unsigned long start, unsigned long len, int flags)
-{
-    unsigned long end;
-
-    if (start & ~TARGET_PAGE_MASK)
-        return -EINVAL;
-    len = TARGET_PAGE_ALIGN(len);
-    end = start + len;
-    if (end < start)
-        return -EINVAL;
-    if (end == start)
-        return 0;
-
-    start &= qemu_host_page_mask;
-    return msync((void *)start, end - start, flags);
-}
diff --git a/darwin-user/qemu.h b/darwin-user/qemu.h
deleted file mode 100644
index 9e16c8e..0000000
--- a/darwin-user/qemu.h
+++ /dev/null
@@ -1,178 +0,0 @@
-#ifndef GEMU_H
-#define GEMU_H
-
-#include <signal.h>
-#include <string.h>
-
-#include "cpu.h"
-
-#include "thunk.h"
-
-#include "gdbstub.h"
-
-typedef siginfo_t target_siginfo_t;
-#define target_sigaction	sigaction
-#ifdef TARGET_I386
-struct target_pt_regs {
-	long ebx;
-	long ecx;
-	long edx;
-	long esi;
-	long edi;
-	long ebp;
-	long eax;
-	int  xds;
-	int  xes;
-	long orig_eax;
-	long eip;
-	int  xcs;
-	long eflags;
-	long esp;
-	int  xss;
-};
-struct	target_sigcontext {
-    int			sc_onstack;
-    int			sc_mask;
-    int	sc_eax;
-    int	sc_ebx;
-    int	sc_ecx;
-    int	sc_edx;
-    int	sc_edi;
-    int	sc_esi;
-    int	sc_ebp;
-    int	sc_esp;
-    int	sc_ss;
-    int	sc_eflags;
-    int	sc_eip;
-    int	sc_cs;
-    int	sc_ds;
-    int	sc_es;
-    int	sc_fs;
-    int	sc_gs;
-};
-
-#define __USER_CS	(0x17)
-#define __USER_DS	(0x1F)
-
-#elif defined(TARGET_PPC)
-struct target_pt_regs {
-	unsigned long gpr[32];
-	unsigned long nip;
-	unsigned long msr;
-	unsigned long orig_gpr3;	/* Used for restarting system calls */
-	unsigned long ctr;
-	unsigned long link;
-	unsigned long xer;
-	unsigned long ccr;
-	unsigned long mq;		/* 601 only (not used at present) */
-					/* Used on APUS to hold IPL value. */
-	unsigned long trap;		/* Reason for being here */
-	unsigned long dar;		/* Fault registers */
-	unsigned long dsisr;
-	unsigned long result; 		/* Result of a system call */
-};
-
-struct target_sigcontext {
-    int		sc_onstack;     /* sigstack state to restore */
-    int		sc_mask;        /* signal mask to restore */
-    int		sc_ir;			/* pc */
-    int		sc_psw;         /* processor status word */
-    int		sc_sp;      	/* stack pointer if sc_regs == NULL */
-    void	*sc_regs;		/* (kernel private) saved state */
-};
-
-#endif
-
-typedef struct TaskState {
-    struct TaskState *next;
-    int used; /* non zero if used */
-    uint8_t stack[0];
-} __attribute__((aligned(16))) TaskState;
-
-void syscall_init(void);
-long do_mach_syscall(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7, uint32_t arg8);
-long do_thread_syscall(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7, uint32_t arg8);
-long do_unix_syscall(void *cpu_env, int num);
-int do_sigaction(int sig, const struct sigaction *act,
-                 struct sigaction *oact);
-int do_sigaltstack(const struct sigaltstack *ss, struct sigaltstack *oss);
-
-void gemu_log(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
-void qerror(const char *fmt, ...) GCC_FMT_ATTR(1, 2);
-
-void write_dt(void *ptr, unsigned long addr, unsigned long limit, int flags);
-
-extern CPUArchState *global_env;
-void cpu_loop(CPUArchState *env);
-void init_paths(const char *prefix);
-const char *path(const char *pathname);
-
-#include "qemu-log.h"
-
-/* commpage.c */
-void commpage_init(void);
-void do_commpage(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7, uint32_t arg8);
-
-/* signal.c */
-void process_pending_signals(void *cpu_env);
-void signal_init(void);
-int queue_signal(int sig, target_siginfo_t *info);
-void host_to_target_siginfo(target_siginfo_t *tinfo, const siginfo_t *info);
-void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo);
-long do_sigreturn(CPUArchState *env, int num);
-
-/* machload.c */
-int mach_exec(const char * filename, char ** argv, char ** envp,
-			  struct target_pt_regs * regs);
-
-/* mmap.c */
-int target_mprotect(unsigned long start, unsigned long len, int prot);
-long target_mmap(unsigned long start, unsigned long len, int prot,
-                 int flags, int fd, unsigned long offset);
-int target_munmap(unsigned long start, unsigned long len);
-long target_mremap(unsigned long old_addr, unsigned long old_size,
-                   unsigned long new_size, unsigned long flags,
-                   unsigned long new_addr);
-int target_msync(unsigned long start, unsigned long len, int flags);
-
-/* user access */
-
-/* XXX: todo protect every memory access */
-#define lock_user(x,y,z)    (void*)(x)
-#define unlock_user(x,y,z)
-
-/* Mac OS X ABI arguments processing */
-#ifdef TARGET_I386
-static inline uint32_t get_int_arg(int *i, CPUX86State *cpu_env)
-{
-    uint32_t *args = (uint32_t*)(cpu_env->regs[R_ESP] + 4 + *i);
-    *i+=4;
-    return tswap32(*args);
-}
-static inline uint64_t get_int64_arg(int *i, CPUX86State *cpu_env)
-{
-    uint64_t *args = (uint64_t*)(cpu_env->regs[R_ESP] + 4 + *i);
-    *i+=8;
-    return tswap64(*args);
-}
-#elif defined(TARGET_PPC)
-static inline uint32_t get_int_arg(int *i, CPUPPCState *cpu_env)
-{
-    /* XXX: won't work when args goes on stack after gpr10 */
-    uint32_t args = (uint32_t)(cpu_env->gpr[3+(*i & 0xff)/4]);
-    *i+=4;
-    return tswap32(args);
-}
-static inline uint64_t get_int64_arg(int *i, CPUPPCState *cpu_env)
-{
-    /* XXX: won't work when args goes on stack after gpr10 */
-    uint64_t args = (uint64_t)(cpu_env->fpr[1+(*i >> 8)/8]);
-    *i+=(8 << 8) + 8;
-    return tswap64(args);
-}
-#endif
-
-#endif
diff --git a/darwin-user/signal.c b/darwin-user/signal.c
deleted file mode 100644
index 489cb64..0000000
--- a/darwin-user/signal.c
+++ /dev/null
@@ -1,452 +0,0 @@
-/*
- *  Emulation of Linux signals
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdarg.h>
-#include <unistd.h>
-#include <errno.h>
-#include <sys/ucontext.h>
-
-#ifdef __ia64__
-#undef uc_mcontext
-#undef uc_sigmask
-#undef uc_stack
-#undef uc_link
-#endif
-
-#include "qemu.h"
-#include "qemu-common.h"
-
-#define DEBUG_SIGNAL
-
-#define MAX_SIGQUEUE_SIZE 1024
-
-struct sigqueue {
-    struct sigqueue *next;
-    target_siginfo_t info;
-};
-
-struct emulated_sigaction {
-    struct target_sigaction sa;
-    int pending; /* true if signal is pending */
-    struct sigqueue *first;
-    struct sigqueue info; /* in order to always have memory for the
-                             first signal, we put it here */
-};
-
-static struct sigaltstack target_sigaltstack_used = {
-    0, 0, SA_DISABLE
-};
-
-static struct emulated_sigaction sigact_table[NSIG];
-static struct sigqueue sigqueue_table[MAX_SIGQUEUE_SIZE]; /* siginfo queue */
-static struct sigqueue *first_free; /* first free siginfo queue entry */
-static int signal_pending; /* non zero if a signal may be pending */
-
-static void host_signal_handler(int host_signum, siginfo_t *info,
-                                void *puc);
-
-
-static inline int host_to_target_signal(int sig)
-{
-    return sig;
-}
-
-static inline int target_to_host_signal(int sig)
-{
-    return sig;
-}
-
-/* siginfo conversion */
-
-
-
-void host_to_target_siginfo(target_siginfo_t *tinfo, const siginfo_t *info)
-{
-
-}
-
-void target_to_host_siginfo(siginfo_t *info, const target_siginfo_t *tinfo)
-{
-
-}
-
-void signal_init(void)
-{
-    struct sigaction act;
-    int i;
-
-    /* set all host signal handlers. ALL signals are blocked during
-       the handlers to serialize them. */
-    sigfillset(&act.sa_mask);
-    act.sa_flags = SA_SIGINFO;
-    act.sa_sigaction = host_signal_handler;
-    for(i = 1; i < NSIG; i++) {
-        sigaction(i, &act, NULL);
-    }
-
-    memset(sigact_table, 0, sizeof(sigact_table));
-
-    first_free = &sigqueue_table[0];
-    for(i = 0; i < MAX_SIGQUEUE_SIZE - 1; i++)
-        sigqueue_table[i].next = &sigqueue_table[i + 1];
-    sigqueue_table[MAX_SIGQUEUE_SIZE - 1].next = NULL;
-}
-
-/* signal queue handling */
-
-static inline struct sigqueue *alloc_sigqueue(void)
-{
-    struct sigqueue *q = first_free;
-    if (!q)
-        return NULL;
-    first_free = q->next;
-    return q;
-}
-
-static inline void free_sigqueue(struct sigqueue *q)
-{
-    q->next = first_free;
-    first_free = q;
-}
-
-/* abort execution with signal */
-void QEMU_NORETURN force_sig(int sig)
-{
-    int host_sig;
-    host_sig = target_to_host_signal(sig);
-    fprintf(stderr, "qemu: uncaught target signal %d (%s) - exiting\n",
-            sig, strsignal(host_sig));
-    _exit(-host_sig);
-}
-
-/* queue a signal so that it will be send to the virtual CPU as soon
-   as possible */
-int queue_signal(int sig, target_siginfo_t *info)
-{
-    struct emulated_sigaction *k;
-    struct sigqueue *q, **pq;
-    target_ulong handler;
-
-#if defined(DEBUG_SIGNAL)
-    fprintf(stderr, "queue_signal: sig=%d\n",
-            sig);
-#endif
-    k = &sigact_table[sig - 1];
-    handler = (target_ulong)k->sa.sa_handler;
-    if (handler == SIG_DFL) {
-        /* default handler : ignore some signal. The other are fatal */
-        if (sig != SIGCHLD &&
-            sig != SIGURG &&
-            sig != SIGWINCH) {
-            force_sig(sig);
-        } else {
-            return 0; /* indicate ignored */
-        }
-    } else if (handler == host_to_target_signal(SIG_IGN)) {
-        /* ignore signal */
-        return 0;
-    } else if (handler == host_to_target_signal(SIG_ERR)) {
-        force_sig(sig);
-    } else {
-        pq = &k->first;
-        if (!k->pending) {
-            /* first signal */
-            q = &k->info;
-        } else {
-            q = alloc_sigqueue();
-            if (!q)
-                return -EAGAIN;
-            while (*pq != NULL)
-                pq = &(*pq)->next;
-        }
-        *pq = q;
-        q->info = *info;
-        q->next = NULL;
-        k->pending = 1;
-        /* signal that a new signal is pending */
-        signal_pending = 1;
-        return 1; /* indicates that the signal was queued */
-    }
-}
-
-static void host_signal_handler(int host_signum, siginfo_t *info,
-                                void *puc)
-{
-    int sig;
-    target_siginfo_t tinfo;
-
-    /* the CPU emulator uses some host signals to detect exceptions,
-       we we forward to it some signals */
-    if (host_signum == SIGSEGV || host_signum == SIGBUS) {
-        if (cpu_signal_handler(host_signum, (void*)info, puc))
-            return;
-    }
-
-    /* get target signal number */
-    sig = host_to_target_signal(host_signum);
-    if (sig < 1 || sig > NSIG)
-        return;
-
-#if defined(DEBUG_SIGNAL)
-	fprintf(stderr, "qemu: got signal %d\n", sig);
-#endif
-    if (queue_signal(sig, &tinfo) == 1) {
-        /* interrupt the virtual CPU as soon as possible */
-        cpu_exit(global_env);
-    }
-}
-
-int do_sigaltstack(const struct sigaltstack *ss, struct sigaltstack *oss)
-{
-    /* XXX: test errors */
-    if(oss)
-    {
-        oss->ss_sp = tswap32(target_sigaltstack_used.ss_sp);
-        oss->ss_size = tswap32(target_sigaltstack_used.ss_size);
-        oss->ss_flags = tswap32(target_sigaltstack_used.ss_flags);
-    }
-    if(ss)
-    {
-        target_sigaltstack_used.ss_sp = tswap32(ss->ss_sp);
-        target_sigaltstack_used.ss_size = tswap32(ss->ss_size);
-        target_sigaltstack_used.ss_flags = tswap32(ss->ss_flags);
-    }
-    return 0;
-}
-
-int do_sigaction(int sig, const struct sigaction *act,
-                 struct sigaction *oact)
-{
-    struct emulated_sigaction *k;
-    struct sigaction act1;
-    int host_sig;
-
-    if (sig < 1 || sig > NSIG)
-        return -EINVAL;
-
-    k = &sigact_table[sig - 1];
-#if defined(DEBUG_SIGNAL)
-    fprintf(stderr, "sigaction 1 sig=%d act=0x%08x, oact=0x%08x\n",
-            sig, (int)act, (int)oact);
-#endif
-    if (oact) {
-#if defined(DEBUG_SIGNAL)
-    fprintf(stderr, "sigaction 1 sig=%d act=0x%08x, oact=0x%08x\n",
-            sig, (int)act, (int)oact);
-#endif
-
-        oact->sa_handler = tswapl(k->sa.sa_handler);
-        oact->sa_flags = tswapl(k->sa.sa_flags);
-        oact->sa_mask = tswapl(k->sa.sa_mask);
-    }
-    if (act) {
-#if defined(DEBUG_SIGNAL)
-    fprintf(stderr, "sigaction handler 0x%x flag 0x%x mask 0x%x\n",
-            act->sa_handler, act->sa_flags, act->sa_mask);
-#endif
-
-        k->sa.sa_handler = tswapl(act->sa_handler);
-        k->sa.sa_flags = tswapl(act->sa_flags);
-        k->sa.sa_mask = tswapl(act->sa_mask);
-        /* we update the host signal state */
-        host_sig = target_to_host_signal(sig);
-        if (host_sig != SIGSEGV && host_sig != SIGBUS) {
-#if defined(DEBUG_SIGNAL)
-            fprintf(stderr, "sigaction handler going to call sigaction\n");
-#endif
-
-            sigfillset(&act1.sa_mask);
-            act1.sa_flags = SA_SIGINFO;
-            if (k->sa.sa_flags & SA_RESTART)
-                act1.sa_flags |= SA_RESTART;
-            /* NOTE: it is important to update the host kernel signal
-               ignore state to avoid getting unexpected interrupted
-               syscalls */
-            if (k->sa.sa_handler == SIG_IGN) {
-                act1.sa_sigaction = (void *)SIG_IGN;
-            } else if (k->sa.sa_handler == SIG_DFL) {
-                act1.sa_sigaction = (void *)SIG_DFL;
-            } else {
-                act1.sa_sigaction = host_signal_handler;
-            }
-            sigaction(host_sig, &act1, NULL);
-        }
-    }
-    return 0;
-}
-
-
-#ifdef TARGET_I386
-
-static inline void *
-get_sigframe(struct emulated_sigaction *ka, CPUX86State *env, size_t frame_size)
-{
-    /* XXX Fix that */
-    if(target_sigaltstack_used.ss_flags & SA_DISABLE)
-    {
-        int esp;
-        /* Default to using normal stack */
-        esp = env->regs[R_ESP];
-
-        return (void *)((esp - frame_size) & -8ul);
-    }
-    else
-    {
-        return target_sigaltstack_used.ss_sp;
-    }
-}
-
-static void setup_frame(int sig, struct emulated_sigaction *ka,
-                        void *set, CPUX86State *env)
-{
-	void *frame;
-
-    fprintf(stderr, "setup_frame %d\n", sig);
-	frame = get_sigframe(ka, env, sizeof(*frame));
-
-	/* Set up registers for signal handler */
-	env->regs[R_ESP] = (unsigned long) frame;
-	env->eip = (unsigned long) ka->sa.sa_handler;
-
-	env->eflags &= ~TF_MASK;
-
-	return;
-
-give_sigsegv:
-	if (sig == SIGSEGV)
-		ka->sa.sa_handler = SIG_DFL;
-	force_sig(SIGSEGV /* , current */);
-}
-
-long do_sigreturn(CPUX86State *env, int num)
-{
-    int i = 0;
-    struct target_sigcontext *scp = get_int_arg(&i, env);
-    /* XXX Get current signal number */
-    /* XXX Adjust accordin to sc_onstack, sc_mask */
-    if(tswapl(scp->sc_onstack) & 0x1)
-        target_sigaltstack_used.ss_flags |= ~SA_DISABLE;
-    else
-        target_sigaltstack_used.ss_flags &=  SA_DISABLE;
-    int set = tswapl(scp->sc_eax);
-    sigprocmask(SIG_SETMASK, &set, NULL);
-
-    fprintf(stderr, "do_sigreturn: partially implemented %x EAX:%x EBX:%x\n", scp->sc_mask, tswapl(scp->sc_eax), tswapl(scp->sc_ebx));
-    fprintf(stderr, "ECX:%x EDX:%x EDI:%x\n", scp->sc_ecx, tswapl(scp->sc_edx), tswapl(scp->sc_edi));
-    fprintf(stderr, "EIP:%x\n", tswapl(scp->sc_eip));
-
-    env->regs[R_EAX] = tswapl(scp->sc_eax);
-    env->regs[R_EBX] = tswapl(scp->sc_ebx);
-    env->regs[R_ECX] = tswapl(scp->sc_ecx);
-    env->regs[R_EDX] = tswapl(scp->sc_edx);
-    env->regs[R_EDI] = tswapl(scp->sc_edi);
-    env->regs[R_ESI] = tswapl(scp->sc_esi);
-    env->regs[R_EBP] = tswapl(scp->sc_ebp);
-    env->regs[R_ESP] = tswapl(scp->sc_esp);
-    env->segs[R_SS].selector = (void*)tswapl(scp->sc_ss);
-    env->eflags = tswapl(scp->sc_eflags);
-    env->eip = tswapl(scp->sc_eip);
-    env->segs[R_CS].selector = (void*)tswapl(scp->sc_cs);
-    env->segs[R_DS].selector = (void*)tswapl(scp->sc_ds);
-    env->segs[R_ES].selector = (void*)tswapl(scp->sc_es);
-    env->segs[R_FS].selector = (void*)tswapl(scp->sc_fs);
-    env->segs[R_GS].selector = (void*)tswapl(scp->sc_gs);
-
-    /* Again, because our caller's caller will reset EAX */
-    return env->regs[R_EAX];
-}
-
-#else
-
-static void setup_frame(int sig, struct emulated_sigaction *ka,
-			void *set, CPUArchState *env)
-{
-    fprintf(stderr, "setup_frame: not implemented\n");
-}
-
-long do_sigreturn(CPUArchState *env, int num)
-{
-    int i = 0;
-    struct target_sigcontext *scp = get_int_arg(&i, env);
-    fprintf(stderr, "do_sigreturn: not implemented\n");
-    return -ENOSYS;
-}
-
-#endif
-
-void process_pending_signals(void *cpu_env)
-{
-    struct emulated_sigaction *k;
-    struct sigqueue *q;
-    target_ulong handler;
-    int sig;
-
-    if (!signal_pending)
-        return;
-
-    k = sigact_table;
-
-    for(sig = 1; sig <= NSIG; sig++) {
-        if (k->pending)
-            goto handle_signal;
-        k++;
-    }
-
-    /* if no signal is pending, just return */
-    signal_pending = 0;
-    return;
-handle_signal:
-    #ifdef DEBUG_SIGNAL
-    fprintf(stderr, "qemu: process signal %d\n", sig);
-    #endif
-    /* dequeue signal */
-    q = k->first;
-    k->first = q->next;
-    if (!k->first)
-        k->pending = 0;
-
-    sig = gdb_handlesig (cpu_env, sig);
-    if (!sig) {
-        fprintf (stderr, "Lost signal\n");
-        abort();
-    }
-
-    handler = k->sa.sa_handler;
-    if (handler == SIG_DFL) {
-        /* default handler : ignore some signal. The other are fatal */
-        if (sig != SIGCHLD &&
-            sig != SIGURG &&
-            sig != SIGWINCH) {
-            force_sig(sig);
-        }
-    } else if (handler == SIG_IGN) {
-        /* ignore sig */
-    } else if (handler == SIG_ERR) {
-        force_sig(sig);
-    } else {
-
-        setup_frame(sig, k, 0, cpu_env);
-	if (k->sa.sa_flags & SA_RESETHAND)
-            k->sa.sa_handler = SIG_DFL;
-    }
-    if (q != &k->info)
-        free_sigqueue(q);
-}
diff --git a/darwin-user/syscall.c b/darwin-user/syscall.c
deleted file mode 100644
index 8a16883..0000000
--- a/darwin-user/syscall.c
+++ /dev/null
@@ -1,1566 +0,0 @@
-/*
- *  Darwin syscalls
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *  Copyright (c) 2006 Pierre d'Herbemont
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-
-#include <mach/host_info.h>
-#include <mach/mach.h>
-#include <mach/mach_time.h>
-#include <mach/message.h>
-
-#include <pthread.h>
-#include <dirent.h>
-
-#include <sys/stat.h>
-#include <sys/syscall.h>
-#include <sys/sysctl.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/types.h>
-#include <sys/dirent.h>
-#include <sys/uio.h>
-#include <sys/termios.h>
-#include <sys/ptrace.h>
-#include <net/if.h>
-
-#include <sys/param.h>
-#include <sys/mount.h>
-
-#include <sys/attr.h>
-
-#include <mach/ndr.h>
-#include <mach/mig_errors.h>
-
-#include <sys/xattr.h>
-
-#include "qemu.h"
-
-//#define DEBUG_SYSCALL
-
-#ifdef DEBUG_SYSCALL
-# define DEBUG_FORCE_ENABLE_LOCAL() int __DEBUG_qemu_user_force_enable = 1
-# define DEBUG_BEGIN_ENABLE  __DEBUG_qemu_user_force_enable = 1;
-# define DEBUG_END_ENABLE  __DEBUG_qemu_user_force_enable = 0;
-
-# define DEBUG_DISABLE_ALL() static int __DEBUG_qemu_user_force_enable = 0
-# define DEBUG_ENABLE_ALL()  static int __DEBUG_qemu_user_force_enable = 1
-    DEBUG_ENABLE_ALL();
-
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); \
-                           if(__DEBUG_qemu_user_force_enable) fprintf(stderr, __VA_ARGS__); \
-                         } while(0)
-#else
-# define DEBUG_FORCE_ENABLE_LOCAL()
-# define DEBUG_BEGIN_ENABLE
-# define DEBUG_END_ENABLE
-
-# define DPRINTF(...) do { qemu_log(__VA_ARGS__); } while(0)
-#endif
-
-enum {
-    bswap_out = 0,
-    bswap_in = 1
-};
-
-extern const char *interp_prefix;
-
-static inline long get_errno(long ret)
-{
-    if (ret == -1)
-        return -errno;
-    else
-        return ret;
-}
-
-static inline int is_error(long ret)
-{
-    return (unsigned long)ret >= (unsigned long)(-4096);
-}
-
-/* ------------------------------------------------------------
-   Mach syscall handling
-*/
-
-void static inline print_description_msg_header(mach_msg_header_t *hdr)
-{
-    char *name = NULL;
-    int i;
-    struct { int number; char *name; } msg_name[] =
-    {
-        /* see http://fxr.watson.org/fxr/source/compat/mach/mach_namemap.c?v=NETBSD */
-        { 200,      "host_info" },
-        { 202,      "host_page_size" },
-        { 206,      "host_get_clock_service" },
-        { 206,      "host_get_clock_service" },
-        { 206,      "host_get_clock_service" },
-        { 306,      "host_get_clock_service" },
-        { 3204,     "mach_port_allocate" },
-        { 3206,     "mach_port_deallocate" },
-        { 3404,     "mach_ports_lookup" },
-        { 3409,     "mach_task_get_special_port" },
-        { 3414,     "mach_task_get_exception_ports" },
-        { 3418,     "mach_semaphore_create" },
-        { 3504,     "mach_semaphore_create" },
-        { 3509,     "mach_semaphore_create" },
-        { 3518,     "semaphore_create" },
-        { 3616,     "thread_policy" },
-        { 3801,     "vm_allocate" },
-        { 3802,     "vm_deallocate" },
-        { 3802,     "vm_deallocate" },
-        { 3803,     "vm_protect" },
-        { 3812,     "vm_map" },
-        { 4241776,  "lu_message_send_id" },  /* lookupd */
-        { 4241876,  "lu_message_reply_id" }, /* lookupd */
-    };
-
-    for(i = 0; i < ARRAY_SIZE(msg_name); i++) {
-        if(msg_name[i].number == hdr->msgh_id)
-        {
-            name = msg_name[i].name;
-            break;
-        }
-    }
-    if(!name)
-        DPRINTF("unknown mach msg %d 0x%x\n", hdr->msgh_id, hdr->msgh_id);
-    else
-        DPRINTF("%s\n", name);
-#if 0
-    DPRINTF("Bits: %8x\n", hdr->msgh_bits);
-    DPRINTF("Size: %8x\n", hdr->msgh_size);
-    DPRINTF("Rmte: %8x\n", hdr->msgh_remote_port);
-    DPRINTF("Locl: %8x\n", hdr->msgh_local_port);
-    DPRINTF("Rsrv: %8x\n", hdr->msgh_reserved);
-
-    DPRINTF("Id  : %8x\n", hdr->msgh_id);
-
-    NDR_record_t *ndr = (NDR_record_t *)(hdr + 1);
-    DPRINTF("hdr = %p, sizeof(hdr) = %x, NDR = %p\n", hdr, (unsigned int)sizeof(mach_msg_header_t), ndr);
-    DPRINTF("%d %d %d %d %d %d %d %d\n",
-           ndr->mig_vers, ndr->if_vers, ndr->reserved1, ndr->mig_encoding,
-           ndr->int_rep, ndr->char_rep, ndr->float_rep, ndr->reserved2);
-#endif
-}
-
-static inline void print_mach_msg_return(mach_msg_return_t ret)
-{
-    int i, found = 0;
-#define MACH_MSG_RET(msg) { msg, #msg }
-    struct { int code; char *name; } msg_name[] =
-    {
-        /* ref: http://darwinsource.opendarwin.org/10.4.2/xnu-792.2.4/osfmk/man/mach_msg.html */
-        /* send message */
-        MACH_MSG_RET(MACH_SEND_MSG_TOO_SMALL),
-        MACH_MSG_RET(MACH_SEND_NO_BUFFER),
-        MACH_MSG_RET(MACH_SEND_INVALID_DATA),
-        MACH_MSG_RET(MACH_SEND_INVALID_HEADER),
-        MACH_MSG_RET(MACH_SEND_INVALID_DEST),
-        MACH_MSG_RET(MACH_SEND_INVALID_NOTIFY),
-        MACH_MSG_RET(MACH_SEND_INVALID_REPLY),
-        MACH_MSG_RET(MACH_SEND_INVALID_TRAILER),
-        MACH_MSG_RET(MACH_SEND_INVALID_MEMORY),
-        MACH_MSG_RET(MACH_SEND_INVALID_RIGHT),
-        MACH_MSG_RET(MACH_SEND_INVALID_TYPE),
-        MACH_MSG_RET(MACH_SEND_INTERRUPTED),
-        MACH_MSG_RET(MACH_SEND_TIMED_OUT),
-
-        MACH_MSG_RET(MACH_RCV_BODY_ERROR),
-        MACH_MSG_RET(MACH_RCV_HEADER_ERROR),
-
-        MACH_MSG_RET(MACH_RCV_IN_SET),
-        MACH_MSG_RET(MACH_RCV_INTERRUPTED),
-
-        MACH_MSG_RET(MACH_RCV_INVALID_DATA),
-        MACH_MSG_RET(MACH_RCV_INVALID_NAME),
-        MACH_MSG_RET(MACH_RCV_INVALID_NOTIFY),
-        MACH_MSG_RET(MACH_RCV_INVALID_TRAILER),
-        MACH_MSG_RET(MACH_RCV_INVALID_TYPE),
-
-        MACH_MSG_RET(MACH_RCV_PORT_CHANGED),
-        MACH_MSG_RET(MACH_RCV_PORT_DIED),
-
-        MACH_MSG_RET(MACH_RCV_SCATTER_SMALL),
-        MACH_MSG_RET(MACH_RCV_TIMED_OUT),
-        MACH_MSG_RET(MACH_RCV_TOO_LARGE)
-    };
-#undef MACH_MSG_RET
-
-    if( ret == MACH_MSG_SUCCESS)
-        DPRINTF("MACH_MSG_SUCCESS\n");
-    else
-    {
-        for( i = 0; i < ARRAY_SIZE(msg_name); i++) {
-            if(msg_name[i].code == ret) {
-                DPRINTF("%s\n", msg_name[i].name);
-                found = 1;
-                break;
-            }
-        }
-        if(!found)
-            qerror("unknow mach message ret code %d\n", ret);
-    }
-}
-
-static inline void swap_mach_msg_header(mach_msg_header_t *hdr)
-{
-    hdr->msgh_bits = tswap32(hdr->msgh_bits);
-    hdr->msgh_size = tswap32(hdr->msgh_size);
-    hdr->msgh_remote_port = tswap32(hdr->msgh_remote_port);
-    hdr->msgh_local_port = tswap32(hdr->msgh_local_port);
-    hdr->msgh_reserved = tswap32(hdr->msgh_reserved);
-    hdr->msgh_id = tswap32(hdr->msgh_id);
-}
-
-struct complex_msg {
-            mach_msg_header_t hdr;
-            mach_msg_body_t body;
-};
-
-static inline void swap_mach_msg_body(struct complex_msg *complex_msg, int bswap)
-{
-    mach_msg_port_descriptor_t *descr = (mach_msg_port_descriptor_t *)(complex_msg+1);
-    int i,j;
-
-    if(bswap == bswap_in)
-        tswap32s(&complex_msg->body.msgh_descriptor_count);
-
-    DPRINTF("body.msgh_descriptor_count %d\n", complex_msg->body.msgh_descriptor_count);
-
-    for(i = 0; i < complex_msg->body.msgh_descriptor_count; i++) {
-        switch(descr->type)
-        {
-            case MACH_MSG_PORT_DESCRIPTOR:
-                tswap32s(&descr->name);
-                descr++;
-                break;
-            case MACH_MSG_OOL_DESCRIPTOR:
-            {
-                mach_msg_ool_descriptor_t *ool = (void *)descr;
-                tswap32s((uint32_t *)&ool->address);
-                tswap32s(&ool->size);
-
-                descr = (mach_msg_port_descriptor_t *)(ool+1);
-                break;
-            }
-            case MACH_MSG_OOL_PORTS_DESCRIPTOR:
-            {
-                mach_msg_ool_ports_descriptor_t *ool_ports = (void *)descr;
-                mach_port_name_t * port_names;
-
-                if(bswap == bswap_in)
-                {
-                    tswap32s((uint32_t *)&ool_ports->address);
-                    tswap32s(&ool_ports->count);
-                }
-
-                port_names = ool_ports->address;
-
-                for(j = 0; j < ool_ports->count; j++)
-                    tswap32s(&port_names[j]);
-
-                if(bswap == bswap_out)
-                {
-                    tswap32s((uint32_t *)&ool_ports->address);
-                    tswap32s(&ool_ports->count);
-                }
-
-                descr = (mach_msg_port_descriptor_t *)(ool_ports+1);
-                break;
-            }
-            default: qerror("unknow mach msg descriptor type %x\n", descr->type);
-        }
-    }
-    if(bswap == bswap_out)
-        tswap32s(&complex_msg->body.msgh_descriptor_count);
-}
-
-static inline void swap_mach_msg(mach_msg_header_t *hdr, int bswap)
-{
-    if (bswap == bswap_out && hdr->msgh_bits & MACH_MSGH_BITS_COMPLEX)
-        swap_mach_msg_body((struct complex_msg *)hdr, bswap);
-
-    swap_mach_msg_header(hdr);
-
-    if (bswap == bswap_in && hdr->msgh_bits & MACH_MSGH_BITS_COMPLEX)
-        swap_mach_msg_body((struct complex_msg *)hdr, bswap);
-}
-
-static inline uint32_t target_mach_msg_trap(
-        mach_msg_header_t *hdr, uint32_t options, uint32_t send_size,
-        uint32_t rcv_size, uint32_t rcv_name, uint32_t time_out, uint32_t notify)
-{
-    extern int mach_msg_trap(mach_msg_header_t *, mach_msg_option_t,
-          mach_msg_size_t, mach_msg_size_t, mach_port_t,
-          mach_msg_timeout_t, mach_port_t);
-    mach_msg_audit_trailer_t *trailer;
-    mach_msg_id_t msg_id;
-    uint32_t ret = 0;
-    int i;
-
-    swap_mach_msg(hdr, bswap_in);
-
-    msg_id = hdr->msgh_id;
-
-    print_description_msg_header(hdr);
-
-    ret = mach_msg_trap(hdr, options, send_size, rcv_size, rcv_name, time_out, notify);
-
-    print_mach_msg_return(ret);
-
-    if( (options & MACH_RCV_MSG) && (REQUESTED_TRAILER_SIZE(options) > 0) )
-    {
-        /* XXX: the kernel always return the full trailer with MACH_SEND_MSG, so we should
-                probably always bswap it  */
-        /* warning: according to Mac OS X Internals (the book) msg_size might be expressed in
-                    natural_t units but according to xnu/osfmk/mach/message.h: "The size of
-                    the message must be specified in bytes" */
-        trailer = (mach_msg_audit_trailer_t *)((uint8_t *)hdr + hdr->msgh_size);
-        /* XXX: Should probably do that based on the option asked by the sender, but dealing
-        with kernel answer seems more sound */
-        switch(trailer->msgh_trailer_size)
-        {
-            case sizeof(mach_msg_audit_trailer_t):
-                for(i = 0; i < 8; i++)
-                    tswap32s(&trailer->msgh_audit.val[i]);
-                /* Fall in mach_msg_security_trailer_t case */
-            case sizeof(mach_msg_security_trailer_t):
-                tswap32s(&trailer->msgh_sender.val[0]);
-                tswap32s(&trailer->msgh_sender.val[1]);
-                /* Fall in mach_msg_seqno_trailer_t case */
-            case sizeof(mach_msg_seqno_trailer_t):
-                tswap32s(&trailer->msgh_seqno);
-                /* Fall in mach_msg_trailer_t case */
-            case sizeof(mach_msg_trailer_t):
-                tswap32s(&trailer->msgh_trailer_type);
-                tswap32s(&trailer->msgh_trailer_size);
-                break;
-            case 0:
-                /* Safer not to byteswap, but probably wrong */
-                break;
-            default:
-                qerror("unknow trailer type given its size %d\n", trailer->msgh_trailer_size);
-                break;
-        }
-    }
-
-    /* Special message handling */
-    switch (msg_id) {
-        case 200: /* host_info */
-        {
-            mig_reply_error_t *err = (mig_reply_error_t *)hdr;
-            struct {
-                uint32_t unknow1;
-                uint32_t max_cpus;
-                uint32_t avail_cpus;
-                uint32_t memory_size;
-                uint32_t cpu_type;
-                uint32_t cpu_subtype;
-            } *data = (void *)(err+1);
-
-            DPRINTF("maxcpu = 0x%x\n",   data->max_cpus);
-            DPRINTF("numcpu = 0x%x\n",   data->avail_cpus);
-            DPRINTF("memsize = 0x%x\n",  data->memory_size);
-
-#if defined(TARGET_I386)
-            data->cpu_type = CPU_TYPE_I386;
-            DPRINTF("cpu_type changed to 0x%x(i386)\n", data->cpu_type);
-            data->cpu_subtype = CPU_SUBTYPE_PENT;
-            DPRINTF("cpu_subtype changed to 0x%x(i386_pent)\n", data->cpu_subtype);
-#elif defined(TARGET_PPC)
-            data->cpu_type = CPU_TYPE_POWERPC;
-            DPRINTF("cpu_type changed to 0x%x(ppc)\n", data->cpu_type);
-            data->cpu_subtype = CPU_SUBTYPE_POWERPC_750;
-            DPRINTF("cpu_subtype changed to 0x%x(ppc_all)\n", data->cpu_subtype);
-#else
-# error target not supported
-#endif
-            break;
-        }
-        case 202: /* host_page_size */
-        {
-            mig_reply_error_t *err = (mig_reply_error_t *)hdr;
-            uint32_t *pagesize = (uint32_t *)(err+1);
-
-            DPRINTF("pagesize = %d\n", *pagesize);
-            break;
-        }
-        default: break;
-    }
-
-    swap_mach_msg(hdr, bswap_out);
-
-    return ret;
-}
-
-long do_mach_syscall(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7,
-                uint32_t arg8)
-{
-    extern uint32_t mach_reply_port(void);
-
-    long ret = 0;
-
-    arg1 = tswap32(arg1);
-    arg2 = tswap32(arg2);
-    arg3 = tswap32(arg3);
-    arg4 = tswap32(arg4);
-    arg5 = tswap32(arg5);
-    arg6 = tswap32(arg6);
-    arg7 = tswap32(arg7);
-    arg8 = tswap32(arg8);
-
-    DPRINTF("mach syscall %d : " , num);
-
-    switch(num) {
-    /* see xnu/osfmk/mach/syscall_sw.h */
-    case -26:
-        DPRINTF("mach_reply_port()\n");
-        ret = mach_reply_port();
-        break;
-    case -27:
-        DPRINTF("mach_thread_self()\n");
-        ret = mach_thread_self();
-        break;
-    case -28:
-        DPRINTF("mach_task_self()\n");
-        ret = mach_task_self();
-        break;
-    case -29:
-        DPRINTF("mach_host_self()\n");
-        ret = mach_host_self();
-        break;
-    case -31:
-        DPRINTF("mach_msg_trap(0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, 0x%x)\n",
-                arg1, arg2, arg3, arg4, arg5, arg6, arg7);
-        ret = target_mach_msg_trap((mach_msg_header_t *)arg1, arg2, arg3, arg4, arg5, arg6, arg7);
-        break;
-/* may need more translation if target arch is different from host */
-#if (defined(TARGET_I386) && defined(__i386__)) || (defined(TARGET_PPC) && defined(__ppc__))
-    case -33:
-        DPRINTF("semaphore_signal_trap(0x%x)\n", arg1);
-        ret = semaphore_signal_trap(arg1);
-        break;
-    case -34:
-        DPRINTF("semaphore_signal_all_trap(0x%x)\n", arg1);
-        ret = semaphore_signal_all_trap(arg1);
-        break;
-    case -35:
-        DPRINTF("semaphore_signal_thread_trap(0x%x)\n", arg1, arg2);
-        ret = semaphore_signal_thread_trap(arg1,arg2);
-        break;
-#endif
-    case -36:
-        DPRINTF("semaphore_wait_trap(0x%x)\n", arg1);
-        extern int semaphore_wait_trap(int); // XXX: is there any header for that?
-        ret = semaphore_wait_trap(arg1);
-        break;
-/* may need more translation if target arch is different from host */
-#if (defined(TARGET_I386) && defined(__i386__)) || (defined(TARGET_PPC) && defined(__ppc__))
-    case -37:
-        DPRINTF("semaphore_wait_signal_trap(0x%x, 0x%x)\n", arg1, arg2);
-        ret = semaphore_wait_signal_trap(arg1,arg2);
-        break;
-#endif
-    case -43:
-        DPRINTF("map_fd(0x%x, 0x%x, 0x%x, 0x%x, 0x%x)\n",
-                arg1, arg2, arg3, arg4, arg5);
-        ret = map_fd(arg1, arg2, (void*)arg3, arg4, arg5);
-        tswap32s((uint32_t*)arg3);
-        break;
-/* may need more translation if target arch is different from host */
-#if (defined(TARGET_I386) && defined(__i386__)) || (defined(TARGET_PPC) && defined(__ppc__))
-    case -61:
-        DPRINTF("syscall_thread_switch(0x%x, 0x%x, 0x%x)\n",
-                arg1, arg2, arg3);
-        ret = syscall_thread_switch(arg1, arg2, arg3);  // just a hint to the scheduler; can drop?
-        break;
-#endif
-    case -89:
-        DPRINTF("mach_timebase_info(0x%x)\n", arg1);
-        struct mach_timebase_info info;
-        ret = mach_timebase_info(&info);
-        if(!is_error(ret))
-        {
-            struct mach_timebase_info *outInfo = (void*)arg1;
-            outInfo->numer = tswap32(info.numer);
-            outInfo->denom = tswap32(info.denom);
-        }
-        break;
-    case -90:
-        DPRINTF("mach_wait_until()\n");
-        extern int mach_wait_until(uint64_t); // XXX: is there any header for that?
-        ret = mach_wait_until(((uint64_t)arg2<<32) | (uint64_t)arg1);
-        break;
-    case -91:
-        DPRINTF("mk_timer_create()\n");
-        extern int mk_timer_create(); // XXX: is there any header for that?
-        ret = mk_timer_create();
-        break;
-    case -92:
-        DPRINTF("mk_timer_destroy()\n");
-        extern int mk_timer_destroy(int); // XXX: is there any header for that?
-        ret = mk_timer_destroy(arg1);
-        break;
-    case -93:
-        DPRINTF("mk_timer_create()\n");
-        extern int mk_timer_arm(int, uint64_t); // XXX: is there any header for that?
-        ret = mk_timer_arm(arg1, ((uint64_t)arg3<<32) | (uint64_t)arg2);
-        break;
-    case -94:
-        DPRINTF("mk_timer_cancel()\n");
-        extern int mk_timer_cancel(int, uint64_t *); // XXX: is there any header for that?
-        ret = mk_timer_cancel(arg1, (uint64_t *)arg2);
-        if((!is_error(ret)) && arg2)
-            tswap64s((uint64_t *)arg2);
-        break;
-    default:
-        gemu_log("qemu: Unsupported mach syscall: %d(0x%x)\n", num, num);
-        gdb_handlesig (cpu_env, SIGTRAP);
-        exit(0);
-        break;
-    }
-    return ret;
-}
-
-/* ------------------------------------------------------------
-   thread type syscall handling
-*/
-long do_thread_syscall(void *cpu_env, int num, uint32_t arg1, uint32_t arg2, uint32_t arg3,
-                uint32_t arg4, uint32_t arg5, uint32_t arg6, uint32_t arg7,
-                uint32_t arg8)
-{
-    extern uint32_t cthread_set_self(uint32_t);
-    extern uint32_t processor_facilities_used(void);
-    long ret = 0;
-
-    arg1 = tswap32(arg1);
-    arg2 = tswap32(arg2);
-    arg3 = tswap32(arg3);
-    arg4 = tswap32(arg4);
-    arg5 = tswap32(arg5);
-    arg6 = tswap32(arg6);
-    arg7 = tswap32(arg7);
-    arg8 = tswap32(arg8);
-
-    DPRINTF("thread syscall %d : " , num);
-
-    switch(num) {
-#ifdef TARGET_I386
-    case 0x3:
-#endif
-    case 0x7FF1: /* cthread_set_self */
-        DPRINTF("cthread_set_self(0x%x)\n", (unsigned int)arg1);
-        ret = cthread_set_self(arg1);
-#ifdef TARGET_I386
-        /* we need to update the LDT with the address of the thread */
-        write_dt((void *)(((CPUX86State *) cpu_env)->ldt.base + (4 * sizeof(uint64_t))), arg1, 1,
-                 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK |
-                 (3 << DESC_DPL_SHIFT) | (0x2 << DESC_TYPE_SHIFT));
-        /* New i386 convention, %gs should be set to our this LDT entry */
-        cpu_x86_load_seg(cpu_env, R_GS, 0x27);
-        /* Old i386 convention, the kernel returns the selector for the cthread (pre-10.4.8?)*/
-        ret = 0x27;
-#endif
-        break;
-    case 0x7FF2: /* Called the super-fast pthread_self handler by the apple guys */
-        DPRINTF("pthread_self()\n");
-        ret = (uint32_t)pthread_self();
-        break;
-    case 0x7FF3:
-        DPRINTF("processor_facilities_used()\n");
-#ifdef __i386__
-        qerror("processor_facilities_used: not implemented!\n");
-#else
-        ret = (uint32_t)processor_facilities_used();
-#endif
-        break;
-    default:
-        gemu_log("qemu: Unsupported thread syscall: %d(0x%x)\n", num, num);
-        gdb_handlesig (cpu_env, SIGTRAP);
-        exit(0);
-        break;
-    }
-    return ret;
-}
-
-/* ------------------------------------------------------------
-   ioctl handling
-*/
-static inline void byteswap_termios(struct termios *t)
-{
-    tswap32s((uint32_t*)&t->c_iflag);
-    tswap32s((uint32_t*)&t->c_oflag);
-    tswap32s((uint32_t*)&t->c_cflag);
-    tswap32s((uint32_t*)&t->c_lflag);
-    /* 20 (char) bytes then */
-    tswap32s((uint32_t*)&t->c_ispeed);
-    tswap32s((uint32_t*)&t->c_ospeed);
-}
-
-static inline void byteswap_winsize(struct winsize *w)
-{
-    tswap16s(&w->ws_row);
-    tswap16s(&w->ws_col);
-    tswap16s(&w->ws_xpixel);
-    tswap16s(&w->ws_ypixel);
-}
-
-#define STRUCT(name, ...) STRUCT_ ## name,
-#define STRUCT_SPECIAL(name) STRUCT_ ## name,
-enum {
-#include "ioctls_types.h"
-};
-#undef STRUCT
-#undef STRUCT_SPECIAL
-
-#define STRUCT(name, ...) const argtype struct_ ## name ## _def[] = {  __VA_ARGS__, TYPE_NULL };
-#define STRUCT_SPECIAL(name)
-#include "ioctls_types.h"
-#undef STRUCT
-#undef STRUCT_SPECIAL
-
-typedef struct IOCTLEntry {
-    unsigned int target_cmd;
-    unsigned int host_cmd;
-    const char *name;
-    int access;
-    const argtype arg_type[5];
-} IOCTLEntry;
-
-#define IOC_R 0x0001
-#define IOC_W 0x0002
-#define IOC_RW (IOC_R | IOC_W)
-
-#define MAX_STRUCT_SIZE 4096
-
-static IOCTLEntry ioctl_entries[] = {
-#define IOCTL(cmd, access,  ...)                        \
-    { cmd, cmd, #cmd, access, {  __VA_ARGS__ } },
-#include "ioctls.h"
-    { 0, 0, },
-};
-
-/* ??? Implement proper locking for ioctls.  */
-static long do_ioctl(long fd, long cmd, long arg)
-{
-    const IOCTLEntry *ie;
-    const argtype *arg_type;
-    int ret;
-    uint8_t buf_temp[MAX_STRUCT_SIZE];
-    int target_size;
-    void *argptr;
-
-    ie = ioctl_entries;
-    for(;;) {
-        if (ie->target_cmd == 0) {
-            gemu_log("Unsupported ioctl: cmd=0x%04lx\n", cmd);
-            return -ENOSYS;
-        }
-        if (ie->target_cmd == cmd)
-            break;
-        ie++;
-    }
-    arg_type = ie->arg_type;
-#if defined(DEBUG)
-    gemu_log("ioctl: cmd=0x%04lx (%s)\n", cmd, ie->name);
-#endif
-    switch(arg_type[0]) {
-    case TYPE_NULL:
-        /* no argument */
-        ret = get_errno(ioctl(fd, ie->host_cmd));
-        break;
-    case TYPE_PTRVOID:
-    case TYPE_INT:
-        /* int argment */
-        ret = get_errno(ioctl(fd, ie->host_cmd, arg));
-        break;
-    case TYPE_PTR:
-        arg_type++;
-        target_size = thunk_type_size(arg_type, 0);
-        switch(ie->access) {
-        case IOC_R:
-            ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
-            if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
-                thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
-                unlock_user(argptr, arg, target_size);
-            }
-            break;
-        case IOC_W:
-            argptr = lock_user(arg, target_size, 1);
-            thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
-            unlock_user(argptr, arg, 0);
-            ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
-            break;
-        default:
-        case IOC_RW:
-            argptr = lock_user(arg, target_size, 1);
-            thunk_convert(buf_temp, argptr, arg_type, THUNK_HOST);
-            unlock_user(argptr, arg, 0);
-            ret = get_errno(ioctl(fd, ie->host_cmd, buf_temp));
-            if (!is_error(ret)) {
-                argptr = lock_user(arg, target_size, 0);
-                thunk_convert(argptr, buf_temp, arg_type, THUNK_TARGET);
-                unlock_user(argptr, arg, target_size);
-            }
-            break;
-        }
-        break;
-    default:
-        gemu_log("Unsupported ioctl type: cmd=0x%04lx type=%d\n", cmd, arg_type[0]);
-        ret = -ENOSYS;
-        break;
-    }
-    return ret;
-}
-
-/* ------------------------------------------------------------
-   Unix syscall handling
-*/
-
-static inline void byteswap_attrlist(struct attrlist *a)
-{
-    tswap16s(&a->bitmapcount);
-    tswap16s(&a->reserved);
-    tswap32s(&a->commonattr);
-    tswap32s(&a->volattr);
-    tswap32s(&a->dirattr);
-    tswap32s(&a->fileattr);
-    tswap32s(&a->forkattr);
-}
-
-struct attrbuf_header {
-    unsigned long length;
-};
-
-static inline void byteswap_attrbuf(struct attrbuf_header *attrbuf, struct attrlist *attrlist)
-{
-    DPRINTF("attrBuf.length %lx\n", attrbuf->length);
-}
-
-static inline void byteswap_statfs(struct statfs *s)
-{
-    tswap16s((uint16_t*)&s->f_otype);
-    tswap16s((uint16_t*)&s->f_oflags);
-    tswap32s((uint32_t*)&s->f_bsize);
-    tswap32s((uint32_t*)&s->f_iosize);
-    tswap32s((uint32_t*)&s->f_blocks);
-    tswap32s((uint32_t*)&s->f_bfree);
-    tswap32s((uint32_t*)&s->f_bavail);
-    tswap32s((uint32_t*)&s->f_files);
-    tswap32s((uint32_t*)&s->f_ffree);
-    tswap32s((uint32_t*)&s->f_fsid.val[0]);
-    tswap32s((uint32_t*)&s->f_fsid.val[1]);
-    tswap16s((uint16_t*)&s->f_reserved1);
-    tswap16s((uint16_t*)&s->f_type);
-    tswap32s((uint32_t*)&s->f_flags);
-}
-
-static inline void byteswap_stat(struct stat *s)
-{
-    tswap32s((uint32_t*)&s->st_dev);
-    tswap32s(&s->st_ino);
-    tswap16s(&s->st_mode);
-    tswap16s(&s->st_nlink);
-    tswap32s(&s->st_uid);
-    tswap32s(&s->st_gid);
-    tswap32s((uint32_t*)&s->st_rdev);
-    tswap32s((uint32_t*)&s->st_atimespec.tv_sec);
-    tswap32s((uint32_t*)&s->st_atimespec.tv_nsec);
-    tswap32s((uint32_t*)&s->st_mtimespec.tv_sec);
-    tswap32s((uint32_t*)&s->st_mtimespec.tv_nsec);
-    tswap32s((uint32_t*)&s->st_ctimespec.tv_sec);
-    tswap32s((uint32_t*)&s->st_ctimespec.tv_nsec);
-    tswap64s((uint64_t*)&s->st_size);
-    tswap64s((uint64_t*)&s->st_blocks);
-    tswap32s((uint32_t*)&s->st_blksize);
-    tswap32s(&s->st_flags);
-    tswap32s(&s->st_gen);
-}
-
-static inline void byteswap_dirents(struct dirent *d, int bytes)
-{
-    char *b;
-    for( b = (char*)d; (int)b < (int)d+bytes; )
-    {
-        unsigned short s = ((struct dirent *)b)->d_reclen;
-        tswap32s(&((struct dirent *)b)->d_ino);
-        tswap16s(&((struct dirent *)b)->d_reclen);
-        if(s<=0)
-            break;
-        b += s;
-    }
-}
-
-static inline void byteswap_iovec(struct iovec *v, int n)
-{
-    int i;
-    for(i = 0; i < n; i++)
-    {
-        tswap32s((uint32_t*)&v[i].iov_base);
-        tswap32s((uint32_t*)&v[i].iov_len);
-    }
-}
-
-static inline void byteswap_timeval(struct timeval *t)
-{
-    tswap32s((uint32_t*)&t->tv_sec);
-    tswap32s((uint32_t*)&t->tv_usec);
-}
-
-long do_unix_syscall_indirect(void *cpu_env, int num);
-long do_sync(void);
-long do_exit(uint32_t arg1);
-long do_getlogin(char *out, uint32_t size);
-long do_open(char * arg1, uint32_t arg2, uint32_t arg3);
-long do_getfsstat(struct statfs * arg1, uint32_t arg2, uint32_t arg3);
-long do_sigprocmask(uint32_t arg1, uint32_t * arg2, uint32_t * arg3);
-long do_execve(char* arg1, char ** arg2, char ** arg3);
-long do_getgroups(uint32_t arg1, gid_t * arg2);
-long do_gettimeofday(struct timeval * arg1, void * arg2);
-long do_readv(uint32_t arg1, struct iovec * arg2, uint32_t arg3);
-long do_writev(uint32_t arg1, struct iovec * arg2, uint32_t arg3);
-long do_utimes(char * arg1, struct timeval * arg2);
-long do_futimes(uint32_t arg1, struct timeval * arg2);
-long do_statfs(char * arg1, struct statfs * arg2);
-long do_fstatfs(uint32_t arg1, struct statfs * arg2);
-long do_stat(char * arg1, struct stat * arg2);
-long do_fstat(uint32_t arg1, struct stat * arg2);
-long do_lstat(char * arg1, struct stat * arg2);
-long do_getdirentries(uint32_t arg1, void* arg2, uint32_t arg3, void* arg4);
-long do_lseek(void *cpu_env, int num);
-long do___sysctl(int * name, uint32_t namelen, void * oldp, size_t * oldlenp, void * newp, size_t newlen  /* ignored */);
-long do_getattrlist(void * arg1, void * arg2, void * arg3, uint32_t arg4, uint32_t arg5);
-long do_getdirentriesattr(uint32_t arg1, void * arg2, void * arg3, size_t arg4, void * arg5, void * arg6, void* arg7, uint32_t arg8);
-long do_fcntl(int fd, int cmd, int arg);
-
-long no_syscall(void *cpu_env, int num);
-
-long do_pread(uint32_t arg1, void * arg2, size_t arg3, off_t arg4)
-{
-    DPRINTF("0x%x, %p, 0x%lx, 0x%" PRIx64 "\n", arg1, arg2, arg3, arg4);
-    long ret = pread(arg1, arg2, arg3, arg4);
-    return ret;
-}
-
-long do_read(int d, void *buf, size_t nbytes)
-{
-    DPRINTF("0x%x, %p, 0x%lx\n", d, buf, nbytes);
-    long ret = get_errno(read(d, buf, nbytes));
-    if(!is_error(ret))
-        DPRINTF("%x\n", *(uint32_t*)buf);
-    return ret;
-}
-
-long unimpl_unix_syscall(void *cpu_env, int num);
-
-typedef long (*syscall_function_t)(void *cpu_env, int num);
-
-
-/* define a table that will handle the syscall number->function association */
-#define VOID    void
-#define INT     (uint32_t)get_int_arg(&i, cpu_env)
-#define INT64   (uint64_t)get_int64_arg(&i, cpu_env)
-#define UINT    (unsigned int)INT
-#define PTR     (void*)INT
-
-#define SIZE    INT
-#define OFFSET  INT64
-
-#define WRAPPER_CALL_DIRECT_0(function, args) long __qemu_##function(void *cpu_env) {  return (long)function(); }
-#define WRAPPER_CALL_DIRECT_1(function, _arg1) long __qemu_##function(void *cpu_env) { int i = 0; typeof(_arg1) arg1 = _arg1;  return (long)function(arg1); }
-#define WRAPPER_CALL_DIRECT_2(function, _arg1, _arg2) long __qemu_##function(void *cpu_env) { int i = 0;  typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; return (long)function(arg1, arg2); }
-#define WRAPPER_CALL_DIRECT_3(function, _arg1, _arg2, _arg3) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; return (long)function(arg1, arg2, arg3); }
-#define WRAPPER_CALL_DIRECT_4(function, _arg1, _arg2, _arg3, _arg4) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; typeof(_arg4) arg4 = _arg4; return (long)function(arg1, arg2, arg3, arg4); }
-#define WRAPPER_CALL_DIRECT_5(function, _arg1, _arg2, _arg3, _arg4, _arg5) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; typeof(_arg4) arg4 = _arg4; typeof(_arg5) arg5 = _arg5;  return (long)function(arg1, arg2, arg3, arg4, arg5); }
-#define WRAPPER_CALL_DIRECT_6(function, _arg1, _arg2, _arg3, _arg4, _arg5, _arg6) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; typeof(_arg4) arg4 = _arg4; typeof(_arg5) arg5 = _arg5; typeof(_arg6) arg6 = _arg6;  return (long)function(arg1, arg2, arg3, arg4, arg5, arg6); }
-#define WRAPPER_CALL_DIRECT_7(function, _arg1, _arg2, _arg3, _arg4, _arg5, _arg6, _arg7) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; typeof(_arg4) arg4 = _arg4; typeof(_arg5) arg5 = _arg5; typeof(_arg6) arg6 = _arg6; typeof(_arg7) arg7 = _arg7; return (long)function(arg1, arg2, arg3, arg4, arg5, arg6, arg7); }
-#define WRAPPER_CALL_DIRECT_8(function, _arg1, _arg2, _arg3, _arg4, _arg5, _arg6, _arg7, _arg8) long __qemu_##function(void *cpu_env) { int i = 0;   typeof(_arg1) arg1 = _arg1; typeof(_arg2) arg2 = _arg2; typeof(_arg3) arg3 = _arg3; typeof(_arg4) arg4 = _arg4; typeof(_arg5) arg5 = _arg5; typeof(_arg6) arg6 = _arg6; typeof(_arg7) arg7 = _arg7; typeof(_arg8) arg8 = _arg8;  return (long)function(arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8); }
-#define WRAPPER_CALL_DIRECT(function, nargs, ...) WRAPPER_CALL_DIRECT_##nargs(function, __VA_ARGS__)
-#define WRAPPER_CALL_NOERRNO(function, nargs, ...)  WRAPPER_CALL_DIRECT(function, nargs, __VA_ARGS__)
-#define WRAPPER_CALL_INDIRECT(function, nargs, ...)
-#define ENTRY(name, number, function, nargs, call_type, ...)  WRAPPER_##call_type(function, nargs, __VA_ARGS__)
-
-#include "syscalls.h"
-
-#undef ENTRY
-#undef WRAPPER_CALL_DIRECT
-#undef WRAPPER_CALL_NOERRNO
-#undef WRAPPER_CALL_INDIRECT
-#undef OFFSET
-#undef SIZE
-#undef INT
-#undef PTR
-#undef INT64
-
-#define _ENTRY(name, number, function, nargs, call_type) [number] = {\
-        name, \
-        number, \
-        (syscall_function_t)function, \
-        nargs, \
-        call_type  \
-        },
-
-#define ENTRY_CALL_DIRECT(name, number, function, nargs, call_type)  _ENTRY(name, number, __qemu_##function, nargs, call_type)
-#define ENTRY_CALL_NOERRNO(name, number, function, nargs, call_type) ENTRY_CALL_DIRECT(name, number, function, nargs, call_type)
-#define ENTRY_CALL_INDIRECT(name, number, function, nargs, call_type) _ENTRY(name, number, function, nargs, call_type)
-#define ENTRY(name, number, function, nargs, call_type, ...) ENTRY_##call_type(name, number, function, nargs, call_type)
-
-#define CALL_DIRECT 1
-#define CALL_INDIRECT 2
-#define CALL_NOERRNO  (CALL_DIRECT | 4 /* = 5 */)
-
-struct unix_syscall {
-    char * name;
-    int number;
-    syscall_function_t function;
-    int nargs;
-    int call_type;
-} unix_syscall_table[SYS_MAXSYSCALL] = {
-#include "syscalls.h"
-};
-
-#undef ENTRY
-#undef _ENTRY
-#undef ENTRY_CALL_DIRECT
-#undef ENTRY_CALL_INDIRECT
-#undef ENTRY_CALL_NOERRNO
-
-/* Actual syscalls implementation */
-
-long do_unix_syscall_indirect(void *cpu_env, int num)
-{
-    long ret;
-    int new_num;
-    int i = 0;
-
-    new_num = get_int_arg(&i, cpu_env);
-#ifdef TARGET_I386
-    ((CPUX86State*)cpu_env)->regs[R_ESP] += 4;
-    /* XXX: not necessary */
-    ((CPUX86State*)cpu_env)->regs[R_EAX] = new_num;
-#elif TARGET_PPC
-    {
-        int i;
-        uint32_t **regs = ((CPUPPCState*)cpu_env)->gpr;
-        for(i = 3; i < 11; i++)
-            *regs[i] = *regs[i+1];
-        /* XXX: not necessary */
-        *regs[0] = new_num;
-    }
-#endif
-    ret = do_unix_syscall(cpu_env, new_num);
-#ifdef TARGET_I386
-    ((CPUX86State*)cpu_env)->regs[R_ESP] -= 4;
-    /* XXX: not necessary */
-    ((CPUX86State*)cpu_env)->regs[R_EAX] = num;
-#elif TARGET_PPC
-    {
-        int i;
-        /* XXX: not really needed those regs are volatile across calls */
-        uint32_t **regs = ((CPUPPCState*)cpu_env)->gpr;
-        for(i = 11; i > 3; i--)
-            *regs[i] = *regs[i-1];
-        regs[3] = new_num;
-        *regs[0] = num;
-    }
-#endif
-    return ret;
-}
-
-long do_exit(uint32_t arg1)
-{
-    exit(arg1);
-    /* not reached */
-    return -1;
-}
-
-long do_sync(void)
-{
-    sync();
-    return 0;
-}
-
-long do_getlogin(char *out, uint32_t size)
-{
-    char *login = getlogin();
-    if(!login)
-        return -1;
-    memcpy(out, login, size);
-    return 0;
-}
-long do_open(char * arg1, uint32_t arg2, uint32_t arg3)
-{
-    /* XXX: don't let the %s stay in there */
-    DPRINTF("open(%s, 0x%x, 0x%x)\n", arg1, arg2, arg3);
-    return get_errno(open(arg1, arg2, arg3));
-}
-
-long do_getfsstat(struct statfs * arg1, uint32_t arg2, uint32_t arg3)
-{
-    long ret;
-    DPRINTF("getfsstat(%p, 0x%x, 0x%x)\n", arg1, arg2, arg3);
-    ret = get_errno(getfsstat(arg1, arg2, arg3));
-    if((!is_error(ret)) && arg1)
-        byteswap_statfs(arg1);
-    return ret;
-}
-
-long do_sigprocmask(uint32_t arg1, uint32_t * arg2, uint32_t * arg3)
-{
-    long ret;
-    DPRINTF("sigprocmask(%d, %p, %p)\n", arg1, arg2, arg3);
-    gemu_log("XXX: sigprocmask not tested (%d, %p, %p)\n", arg1, arg2, arg3);
-    if(arg2)
-        tswap32s(arg2);
-    ret = get_errno(sigprocmask(arg1, (void *)arg2, (void *)arg3));
-    if((!is_error(ret)) && arg3)
-        tswap32s(arg3);
-    if(arg2)
-        tswap32s(arg2);
-    return ret;
-}
-
-long do_execve(char* arg1, char ** arg2, char ** arg3)
-{
-    long ret;
-    char **argv = arg2;
-    char **envp = arg3;
-    int argc;
-    int envc;
-
-    /* XXX: don't let the %s stay in here */
-    DPRINTF("execve(%s, %p, %p)\n", arg1, arg2, arg3);
-
-    for(argc = 0; argv[argc]; argc++);
-    for(envc = 0; envp[envc]; envc++);
-
-    argv = (char**)malloc(sizeof(char*)*argc);
-    envp = (char**)malloc(sizeof(char*)*envc);
-
-    for(; argc >= 0; argc--)
-        argv[argc] = (char*)tswap32((uint32_t)(arg2)[argc]);
-
-    for(; envc >= 0; envc--)
-        envp[envc] = (char*)tswap32((uint32_t)(arg3)[envc]);
-
-    ret = get_errno(execve(arg1, argv, envp));
-    free(argv);
-    free(envp);
-    return ret;
-}
-
-long do_getgroups(uint32_t arg1, gid_t * arg2)
-{
-    long ret;
-    int i;
-    DPRINTF("getgroups(0x%x, %p)\n", arg1, arg2);
-    ret = get_errno(getgroups(arg1, arg2));
-    if(ret > 0)
-        for(i = 0; i < arg1; i++)
-            tswap32s(&arg2[i]);
-    return ret;
-}
-
-long do_gettimeofday(struct timeval * arg1, void * arg2)
-{
-    long ret;
-    DPRINTF("gettimeofday(%p, %p)\n",
-            arg1, arg2);
-    ret = get_errno(gettimeofday(arg1, arg2));
-    if(!is_error(ret))
-    {
-        /* timezone no longer used according to the manpage, so don't bother with it */
-        byteswap_timeval(arg1);
-    }
-    return ret;
-}
-
-long do_readv(uint32_t arg1, struct iovec * arg2, uint32_t arg3)
-{
-    long ret;
-    DPRINTF("readv(0x%x, %p, 0x%x)\n", arg1, arg2, arg3);
-    if(arg2)
-        byteswap_iovec(arg2, arg3);
-    ret = get_errno(readv(arg1, arg2, arg3));
-    if((!is_error(ret)) && arg2)
-        byteswap_iovec(arg2, arg3);
-    return ret;
-}
-
-long do_writev(uint32_t arg1, struct iovec * arg2, uint32_t arg3)
-{
-    long ret;
-    DPRINTF("writev(0x%x, %p, 0x%x)\n", arg1, arg2, arg3);
-    if(arg2)
-        byteswap_iovec(arg2, arg3);
-    ret = get_errno(writev(arg1, arg2, arg3));
-    if((!is_error(ret)) && arg2)
-        byteswap_iovec(arg2, arg3);
-    return ret;
-}
-
-long do_utimes(char * arg1, struct timeval * arg2)
-{
-    DPRINTF("utimes(%p, %p)\n", arg1, arg2);
-    if(arg2)
-    {
-        byteswap_timeval(arg2);
-        byteswap_timeval(arg2+1);
-    }
-    return get_errno(utimes(arg1, arg2));
-}
-
-long do_futimes(uint32_t arg1, struct timeval * arg2)
-{
-    DPRINTF("futimes(0x%x, %p)\n", arg1, arg2);
-    if(arg2)
-    {
-        byteswap_timeval(arg2);
-        byteswap_timeval(arg2+1);
-    }
-    return get_errno(futimes(arg1, arg2));
-}
-
-long do_statfs(char * arg1, struct statfs * arg2)
-{
-    long ret;
-    DPRINTF("statfs(%p, %p)\n", arg1, arg2);
-    ret = get_errno(statfs(arg1, arg2));
-    if(!is_error(ret))
-        byteswap_statfs(arg2);
-    return ret;
-}
-
-long do_fstatfs(uint32_t arg1, struct statfs* arg2)
-{
-    long ret;
-    DPRINTF("fstatfs(0x%x, %p)\n",
-            arg1, arg2);
-    ret = get_errno(fstatfs(arg1, arg2));
-    if(!is_error(ret))
-        byteswap_statfs(arg2);
-
-    return ret;
-}
-
-long do_stat(char * arg1, struct stat * arg2)
-{
-    long ret;
-    /* XXX: don't let the %s stay in there */
-    DPRINTF("stat(%s, %p)\n", arg1, arg2);
-    ret = get_errno(stat(arg1, arg2));
-    if(!is_error(ret))
-        byteswap_stat(arg2);
-    return ret;
-}
-
-long do_fstat(uint32_t arg1, struct stat * arg2)
-{
-    long ret;
-    DPRINTF("fstat(0x%x, %p)\n", arg1, arg2);
-    ret = get_errno(fstat(arg1, arg2));
-    if(!is_error(ret))
-        byteswap_stat(arg2);
-    return ret;
-}
-
-long do_lstat(char * arg1, struct stat * arg2)
-{
-    long ret;
-    /* XXX: don't let the %s stay in there */
-    DPRINTF("lstat(%s, %p)\n", (const char *)arg1, arg2);
-    ret = get_errno(lstat(arg1, arg2));
-    if(!is_error(ret))
-        byteswap_stat(arg2);
-    return ret;
-}
-
-long do_getdirentries(uint32_t arg1, void* arg2, uint32_t arg3, void* arg4)
-{
-    long ret;
-    DPRINTF("getdirentries(0x%x, %p, 0x%x, %p)\n", arg1, arg2, arg3, arg4);
-    if(arg4)
-        tswap32s((uint32_t *)arg4);
-    ret = get_errno(getdirentries(arg1, arg2, arg3, arg4));
-    if(arg4)
-        tswap32s((uint32_t *)arg4);
-    if(!is_error(ret))
-        byteswap_dirents(arg2, ret);
-    return ret;
-}
-
-long do_lseek(void *cpu_env, int num)
-{
-    long ret;
-    int i = 0;
-    uint32_t arg1 = get_int_arg(&i, cpu_env);
-    uint64_t offset = get_int64_arg(&i, cpu_env);
-    uint32_t arg3 = get_int_arg(&i, cpu_env);
-    uint64_t r = lseek(arg1, offset, arg3);
-#ifdef TARGET_I386
-    /* lowest word in eax, highest in edx */
-    ret = r & 0xffffffff; /* will be set to eax after do_unix_syscall exit */
-    ((CPUX86State *)cpu_env)->regs[R_EDX] = (uint32_t)((r >> 32) & 0xffffffff) ;
-#elif defined TARGET_PPC
-    ret = r & 0xffffffff; /* will be set to r3 after do_unix_syscall exit */
-    ((CPUPPCState *)cpu_env)->gpr[4] = (uint32_t)((r >> 32) & 0xffffffff) ;
-#else
-    qerror("64 bit ret value on your arch?");
-#endif
-    return get_errno(ret);
-}
-
-void no_swap(void * oldp, int size)
-{
-}
-
-void sysctl_tswap32s(void * oldp, int size)
-{
-    tswap32s(oldp);
-}
-
-void bswap_oid(uint32_t * oldp, int size)
-{
-    int count = size / sizeof(int);
-    int i = 0;
-    do { tswap32s(oldp + i); } while (++i < count);
-}
-
-void sysctl_usrstack(uint32_t * oldp, int size)
-{
-    DPRINTF("sysctl_usrstack: 0x%x\n", *oldp);
-    tswap32s(oldp);
-}
-
-void sysctl_ncpu(uint32_t * ncpu, int size)
-{
-    *ncpu = 0x1;
-    DPRINTF("sysctl_ncpu: 0x%x\n", *ncpu);
-    tswap32s(ncpu);
-}
-
-void sysctl_exec(char * exec, int size)
-{
-    DPRINTF("sysctl_exec: %s\n", exec);
-}
-
-void sysctl_translate(char * exec, int size)
-{
-    DPRINTF("sysctl_translate: %s\n", exec);
-}
-
-struct sysctl_dir {
-    int num;
-    const char * name;
-    void (*swap_func)(void *, int);
-    struct sysctl_dir *childs;
-};
-
-#define ENTRYD(num, name, childs) { num, name, NULL, childs }
-#define ENTRYE(num, name, func)   { num, name, (void (*)(void *, int))func, NULL  }
-struct sysctl_dir sysctls_unspec[] = {
-    ENTRYE(3,  "oip", bswap_oid),
-    { 0, NULL, NULL, NULL }
-};
-
-struct sysctl_dir sysctls_kern[] = {
-    ENTRYE(KERN_TRANSLATE,          "translate",    sysctl_translate), /* 44 */
-    ENTRYE(KERN_EXEC,               "exec",         sysctl_exec), /* 45 */
-    ENTRYE(KERN_USRSTACK32,          "KERN_USRSTACK32", sysctl_usrstack), /* 35 */
-    ENTRYE(KERN_SHREG_PRIVATIZABLE,  "KERN_SHREG_PRIVATIZABLE", sysctl_tswap32s), /* 54 */
-    { 0, NULL, NULL, NULL }
-};
-
-struct sysctl_dir sysctls_hw[] = {
-    ENTRYE(HW_NCPU, "ncpud", sysctl_tswap32s),
-    ENTRYE(104, "104", no_swap),
-    ENTRYE(105, "105", no_swap),
-    { 0, NULL, NULL, NULL }
-};
-
-struct sysctl_dir sysctls[] = {
-    ENTRYD(CTL_UNSPEC, "unspec", sysctls_unspec),
-    ENTRYD(CTL_KERN, "kern", sysctls_kern),
-    ENTRYD(CTL_HW,   "hw",   sysctls_hw ),
-    { 0, NULL, NULL, NULL }
-};
-
-#undef ENTRYE
-#undef ENTRYD
-
-static inline struct sysctl_dir * get_sysctl_entry_for_mib(int mib, struct sysctl_dir * sysctl_elmt)
-{
-    if(!sysctl_elmt)
-        return NULL;
-    for(; sysctl_elmt->name != NULL ; sysctl_elmt++) {
-        if(sysctl_elmt->num == mib)
-            return sysctl_elmt;
-    }
-    return NULL;
-}
-
-static inline long bswap_syctl(int * mib, int count, void *buf, int size)
-{
-    int i;
-    struct sysctl_dir * sysctl = sysctls;
-    struct sysctl_dir * ret = NULL;
-
-    for(i = 0; i < count; i++) {
-
-        if(!(ret = sysctl = get_sysctl_entry_for_mib(mib[i], sysctl))) {
-            gemu_log("bswap_syctl: can't find mib %d\n", mib[i]);
-            return -ENOTDIR;
-        }
-        if(!(sysctl = sysctl->childs))
-            break;
-    }
-
-    if(ret->childs)
-        qerror("we shouldn't have a directory element\n");
-
-    ret->swap_func(buf, size);
-    return 0;
-}
-
-static inline void print_syctl(int * mib, int count)
-{
-    int i;
-    struct sysctl_dir * sysctl = sysctls;
-    struct sysctl_dir * ret = NULL;
-
-    for(i = 0; i < count; i++) {
-        if(!(ret = sysctl = get_sysctl_entry_for_mib(mib[i], sysctl))){
-            gemu_log("print_syctl: can't find mib %d\n", mib[i]);
-            return;
-        }
-        DPRINTF("%s.", sysctl->name);
-        if(!(sysctl = sysctl->childs))
-            break;
-    }
-    DPRINTF("\n");
-}
-
-long do___sysctl(int * name, uint32_t namelen, void * oldp, size_t * oldlenp, void * newp, size_t newlen  /* ignored */)
-{
-    long ret = 0;
-    int i;
-    DPRINTF("sysctl(%p, 0x%x, %p, %p, %p, 0x%lx)\n",
-            name, namelen, oldp, oldlenp, newp, newlen);
-    if(name) {
-        i = 0;
-        do { tswap32s( name + i); } while (++i < namelen);
-        print_syctl(name, namelen);
-        //bswap_syctl(name, namelen, newp, newlen);
-        tswap32s((uint32_t*)oldlenp);
-    }
-
-    if(name) /* Sometimes sysctl is called with no arg1, ignore */
-        ret = get_errno(sysctl(name, namelen, oldp, oldlenp, newp, newlen));
-
-#if defined(TARGET_I386) ^ defined(__i386__) || defined(TARGET_PPC) ^ defined(__ppc__)
-    if (!is_error(ret) && bswap_syctl(name, namelen, oldp, *oldlenp) != 0) {
-        return -ENOTDIR;
-    }
-#endif
-
-    if(name) {
-        //bswap_syctl(name, namelen, newp, newlen);
-        tswap32s((uint32_t*)oldlenp);
-
-        i = 0;
-        do { tswap32s( name + i); } while (++i < namelen);
-    }
-    return ret;
-}
-
-long do_getattrlist(void * arg1, void * arg2, void * arg3, uint32_t arg4, uint32_t arg5)
-{
-    struct attrlist * attrlist = (void *)arg2;
-    long ret;
-
-#if defined(TARGET_I386) ^ defined(__i386__) || defined(TARGET_PPC) ^ defined(__ppc__)
-    gemu_log("SYS_getdirentriesattr unimplemented\n");
-    return -ENOTSUP;
-#endif
-    /* XXX: don't let the %s stay in there */
-    DPRINTF("getattrlist(%s, %p, %p, 0x%x, 0x%x)\n",
-            (char *)arg1, arg2, arg3, arg4, arg5);
-
-    if(arg2) /* XXX: We should handle that in a copy especially
-        if the structure is not writable */
-        byteswap_attrlist(attrlist);
-
-    ret = get_errno(getattrlist((const char* )arg1, attrlist, (void *)arg3, arg4, arg5));
-
-    if(!is_error(ret))
-    {
-        byteswap_attrbuf((void *)arg3, attrlist);
-        byteswap_attrlist(attrlist);
-    }
-    return ret;
-}
-
-long do_getdirentriesattr(uint32_t arg1, void * arg2, void * arg3, size_t arg4, void * arg5, void * arg6, void* arg7, uint32_t arg8)
-{
-    DPRINTF("getdirentriesattr(0x%x, %p, %p, 0x%lx, %p, %p, %p, 0x%x)\n",
-            arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8);
-#if defined(TARGET_I386) ^ defined(__i386__) || defined(TARGET_PPC) ^ defined(__ppc__)
-    qerror("SYS_getdirentriesattr unimplemented\n");
-#endif
-
-    return get_errno(getdirentriesattr( arg1, (struct attrlist * )arg2, (void *)arg3, arg4,
-                                       (unsigned long *)arg5, (unsigned long *)arg6,
-                                       (unsigned long *)arg7, arg8));
-}
-
-static inline void bswap_flock(struct flock *f)
-{
-    tswap64s(&f->l_start);
-    tswap64s(&f->l_len);
-    tswap32s(&f->l_pid);
-    tswap16s(&f->l_type);
-    tswap16s(&f->l_whence);
-}
-
-static inline void bswap_fstore(struct fstore *f)
-{
-    tswap32s(&f->fst_flags);
-    tswap32s(&f->fst_posmode);
-    tswap64s(&f->fst_offset);
-    tswap64s(&f->fst_length);
-    tswap64s(&f->fst_bytesalloc);
-}
-
-static inline void bswap_radvisory(struct radvisory *f)
-{
-    tswap64s(&f->ra_offset);
-    tswap32s(&f->ra_count);
-}
-
-static inline void bswap_fbootstraptransfer(struct fbootstraptransfer *f)
-{
-    tswap64s(&f->fbt_offset);
-    tswap32s((uint32_t*)&f->fbt_length);
-    tswap32s((uint32_t*)&f->fbt_buffer); /* XXX: this is a ptr */
-}
-
-static inline void bswap_log2phys(struct log2phys *f)
-{
-    tswap32s(&f->l2p_flags);
-    tswap64s(&f->l2p_contigbytes);
-    tswap64s(&f->l2p_devoffset);
-}
-
-static inline void bswap_fcntl_arg(int cmd, void * arg)
-{
-    switch(cmd)
-    {
-        case F_DUPFD:
-        case F_GETFD:
-        case F_SETFD:
-        case F_GETFL:
-        case F_SETFL:
-        case F_GETOWN:
-        case F_SETOWN:
-        case F_SETSIZE:
-        case F_RDAHEAD:
-        case F_FULLFSYNC:
-            break;
-        case F_GETLK:
-        case F_SETLK:
-        case F_SETLKW:
-            bswap_flock(arg);
-            break;
-        case F_PREALLOCATE:
-            bswap_fstore(arg);
-            break;
-        case F_RDADVISE:
-            bswap_radvisory(arg);
-            break;
-        case F_READBOOTSTRAP:
-        case F_WRITEBOOTSTRAP:
-            bswap_fbootstraptransfer(arg);
-            break;
-        case F_LOG2PHYS:
-            bswap_log2phys(arg);
-            break;
-        default:
-            gemu_log("unknow cmd in fcntl\n");
-    }
-}
-
-long do_fcntl(int fd, int cmd, int arg)
-{
-    long ret;
-    bswap_fcntl_arg(cmd, (void *)arg);
-    ret = get_errno(fcntl(fd, cmd, arg));
-    if(!is_error(ret))
-        bswap_fcntl_arg(cmd, (void *)arg);
-    return ret;
-}
-
-long no_syscall(void *cpu_env, int num)
-{
-    /* XXX: We should probably fordward it to the host kernel */
-    qerror("no unix syscall %d\n", num);
-    /* not reached */
-    return -1;
-}
-
-long unimpl_unix_syscall(void *cpu_env, int num)
-{
-    if( (num < 0) || (num > SYS_MAXSYSCALL-1) )
-        qerror("unix syscall %d is out of unix syscall bounds (0-%d) " , num, SYS_MAXSYSCALL-1);
-
-    gemu_log("qemu: Unsupported unix syscall %s %d\n", unix_syscall_table[num].name , num);
-    gdb_handlesig (cpu_env, SIGTRAP);
-    exit(-1);
-}
-
-long do_unix_syscall(void *cpu_env, int num)
-{
-    long ret = 0;
-
-    DPRINTF("unix syscall %d: " , num);
-
-    if( (num < 0) || (num > SYS_MAXSYSCALL-1) )
-        qerror("unix syscall %d is out of unix syscall bounds (0-%d) " , num, SYS_MAXSYSCALL-1);
-
-    DPRINTF("%s [%s]", unix_syscall_table[num].name, unix_syscall_table[num].call_type & CALL_DIRECT ? "direct" : "indirect" );
-    ret = unix_syscall_table[num].function(cpu_env, num);
-
-    if(!(unix_syscall_table[num].call_type & CALL_NOERRNO))
-        ret = get_errno(ret);
-
-    DPRINTF("[returned 0x%x(%d)]\n", (int)ret, (int)ret);
-    return ret;
-}
-
-/* ------------------------------------------------------------
-   syscall_init
-*/
-void syscall_init(void)
-{
-    /* Nothing yet */
-}
diff --git a/darwin-user/syscalls.h b/darwin-user/syscalls.h
deleted file mode 100644
index 34d95da..0000000
--- a/darwin-user/syscalls.h
+++ /dev/null
@@ -1,384 +0,0 @@
-/* generated from xnu/bsd/kern/syscalls.master */
-
- ENTRY("syscall",                  SYS_syscall,                        do_unix_syscall_indirect,          0, CALL_INDIRECT, VOID) /* 0  indirect syscall */
- ENTRY("exit",                     SYS_exit,                           do_exit,                           1, CALL_DIRECT, INT)   /* 1  */
- ENTRY("fork",                     SYS_fork,                           fork,                              0, CALL_NOERRNO, VOID)  /* 2  */
- ENTRY("read",                     SYS_read,                           do_read,                           3, CALL_DIRECT, INT, PTR, SIZE)   /* 3  */
- ENTRY("write",                    SYS_write,                          write,                             3, CALL_DIRECT, INT, PTR, SIZE)   /* 4  */
- ENTRY("open",                     SYS_open,                           do_open,                           3, CALL_DIRECT, PTR, INT, INT)   /* 5  */
- ENTRY("close",                    SYS_close,                          close,                             1, CALL_DIRECT, INT)   /* 6  */
- ENTRY("wait4",                    SYS_wait4,                          wait4,                             4, CALL_DIRECT, INT, PTR, INT, PTR)   /* 7  */
- ENTRY("",                         8,                                  no_syscall,                        0, CALL_INDIRECT, VOID) /* 8  old creat */
- ENTRY("link",                     SYS_link,                           link,                              2, CALL_DIRECT, PTR, PTR)   /* 9  */
- ENTRY("unlink",                   SYS_unlink,                         unlink,                            1, CALL_DIRECT, PTR)   /* 10  */
- ENTRY("",                         11,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 11  old execv */
- ENTRY("chdir",                    SYS_chdir,                          chdir,                             1, CALL_DIRECT, PTR)   /* 12  */
- ENTRY("fchdir",                   SYS_fchdir,                         fchdir,                            1, CALL_DIRECT, INT)   /* 13  */
- ENTRY("mknod",                    SYS_mknod,                          mknod,                             3, CALL_DIRECT, PTR, INT, INT)   /* 14  */
- ENTRY("chmod",                    SYS_chmod,                          chmod,                             2, CALL_DIRECT, PTR, INT)   /* 15  */
- ENTRY("chown",                    SYS_chown,                          chown,                             3, CALL_DIRECT, PTR, INT, INT)   /* 16  */
- ENTRY("obreak",                   SYS_obreak,                         no_syscall,                        1, CALL_INDIRECT, VOID)   /* 17  old break */
- ENTRY("ogetfsstat",               18,                                 unimpl_unix_syscall,               3, CALL_INDIRECT, PTR, INT, INT)   /* 18  */
- ENTRY("",                         19,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 19  old lseek */
- ENTRY("getpid",                   SYS_getpid,                         getpid,                            0, CALL_NOERRNO, VOID)   /* 20  */
- ENTRY("",                         21,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 21  old mount */
- ENTRY("",                         22,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 22  old umount */
- ENTRY("setuid",                   SYS_setuid,                         setuid,                            1, CALL_DIRECT, INT)   /* 23  */
- ENTRY("getuid",                   SYS_getuid,                         getuid,                            0, CALL_NOERRNO, VOID)   /* 24  */
- ENTRY("geteuid",                  SYS_geteuid,                        geteuid,                           0, CALL_NOERRNO, VOID)   /* 25  */
- ENTRY("ptrace",                   SYS_ptrace,                         ptrace,                            4, CALL_DIRECT, INT, INT, PTR, INT)   /* 26  */
- ENTRY("recvmsg",                  SYS_recvmsg,                        recvmsg,                           3, CALL_DIRECT, INT, PTR, INT)   /* 27  */
- ENTRY("sendmsg",                  SYS_sendmsg,                        sendmsg,                           3, CALL_DIRECT, INT, PTR, INT)   /* 28  */
- ENTRY("recvfrom",                 SYS_recvfrom,                       recvfrom,                          6, CALL_DIRECT, INT, PTR, INT, INT, PTR, PTR)   /* 29  */
- ENTRY("accept",                   SYS_accept,                         accept,                            3, CALL_DIRECT, INT, PTR, PTR)   /* 30  */
- ENTRY("getpeername",              SYS_getpeername,                    getpeername,                       3, CALL_DIRECT, INT, PTR, PTR)   /* 31  */
- ENTRY("getsockname",              SYS_getsockname,                    getsockname,                       3, CALL_DIRECT, INT, PTR, PTR)   /* 32  */
- ENTRY("access",                   SYS_access,                         access,                            2, CALL_DIRECT, PTR, INT)   /* 33  */
- ENTRY("chflags",                  SYS_chflags,                        chflags,                           2, CALL_DIRECT, PTR, INT)   /* 34  */
- ENTRY("fchflags",                 SYS_fchflags,                       fchflags,                          2, CALL_DIRECT, INT, INT)   /* 35  */
- ENTRY("sync",                     SYS_sync,                           do_sync,                           0, CALL_INDIRECT, VOID)   /* 36  */
- ENTRY("kill",                     SYS_kill,                           kill,                              2, CALL_DIRECT, INT, INT)   /* 37  */
- ENTRY("",                         38,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 38  old stat */
- ENTRY("getppid",                  SYS_getppid,                        getppid,                           0, CALL_DIRECT, VOID)   /* 39  */
- ENTRY("",                         40,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 40  old lstat */
- ENTRY("dup",                      SYS_dup,                            dup,                               1, CALL_DIRECT, INT)   /* 41  */
- ENTRY("pipe",                     SYS_pipe,                           pipe,               0, CALL_INDIRECT, PTR)   /* 42  */
- ENTRY("getegid",                  SYS_getegid,                        getegid,                           0, CALL_NOERRNO, VOID)  /* 43  */
- ENTRY("profil",                   SYS_profil,                         profil,                            4, CALL_DIRECT, PTR, SIZE, INT, INT)   /* 44  */
- ENTRY("ktrace",                   SYS_ktrace,                         no_syscall,                        4, CALL_INDIRECT, VOID) /* 45  */
- ENTRY("sigaction",                SYS_sigaction,                      do_sigaction,                      3, CALL_DIRECT, INT, PTR, PTR)   /* 46  */
- ENTRY("getgid",                   SYS_getgid,                         getgid,                            0, CALL_NOERRNO, VOID)  /* 47  */
- ENTRY("sigprocmask",              SYS_sigprocmask,                    do_sigprocmask,                    3, CALL_DIRECT, INT, PTR, PTR)   /* 48  */
- ENTRY("getlogin",                 SYS_getlogin,                       do_getlogin,                       2, CALL_DIRECT, PTR, UINT)   /* 49 XXX */
- ENTRY("setlogin",                 SYS_setlogin,                       setlogin,                          1, CALL_DIRECT, PTR)   /* 50  */
- ENTRY("acct",                     SYS_acct,                           acct,                              1, CALL_DIRECT, PTR)   /* 51  */
- ENTRY("sigpending",               SYS_sigpending,                     sigpending,                        1, CALL_DIRECT, PTR)   /* 52  */
- ENTRY("sigaltstack",              SYS_sigaltstack,                    do_sigaltstack,                    2, CALL_DIRECT, PTR, PTR)   /* 53  */
- ENTRY("ioctl",                    SYS_ioctl,                          do_ioctl,                          3, CALL_DIRECT, INT, INT, INT)   /* 54  */
- ENTRY("reboot",                   SYS_reboot,                         unimpl_unix_syscall,               2, CALL_INDIRECT, INT, PTR)   /* 55  */
- ENTRY("revoke",                   SYS_revoke,                         revoke,                            1, CALL_DIRECT, PTR)   /* 56  */
- ENTRY("symlink",                  SYS_symlink,                        symlink,                           2, CALL_DIRECT, PTR, PTR)   /* 57  */
- ENTRY("readlink",                 SYS_readlink,                       readlink,                          3, CALL_DIRECT, PTR, PTR, INT)   /* 58  */
- ENTRY("execve",                   SYS_execve,                         do_execve,                         3, CALL_DIRECT, PTR, PTR, PTR)   /* 59  */
- ENTRY("umask",                    SYS_umask,                          umask,                             1, CALL_DIRECT, INT)   /* 60  */
- ENTRY("chroot",                   SYS_chroot,                         chroot,                            1, CALL_DIRECT, PTR)   /* 61  */
- ENTRY("",                         62,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 62  old fstat */
- ENTRY("",                         63,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 63  used internally , reserved */
- ENTRY("",                         64,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 64  old getpagesize */
- ENTRY("msync",                    SYS_msync,                          target_msync,                      3, CALL_DIRECT, UINT /*PTR*/, SIZE, INT)   /* 65  */
- ENTRY("vfork",                    SYS_vfork,                          vfork,                             0, CALL_DIRECT, VOID)   /* 66  */
- ENTRY("",                         67,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 67  old vread */
- ENTRY("",                         68,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 68  old vwrite */
- ENTRY("sbrk",                     SYS_sbrk,                           sbrk,                              1, CALL_DIRECT, INT)   /* 69  */
- ENTRY("sstk",                     SYS_sstk,                           no_syscall,                        1, CALL_INDIRECT, VOID) /* 70  */
- ENTRY("",                         71,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 71  old mmap */
- ENTRY("ovadvise",                 SYS_ovadvise,                       no_syscall,                        0, CALL_INDIRECT, VOID) /* 72  old vadvise */
- ENTRY("munmap",                   SYS_munmap,                         target_munmap,                     2, CALL_DIRECT, UINT /* PTR */, SIZE)   /* 73  */
- ENTRY("mprotect",                 SYS_mprotect,                       mprotect,                          3, CALL_DIRECT, PTR, SIZE, INT)   /* 74  */
- ENTRY("madvise",                  SYS_madvise,                        madvise,                           3, CALL_DIRECT, PTR, SIZE, INT)   /* 75  */
- ENTRY("",                         76,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 76  old vhangup */
- ENTRY("",                         77,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 77  old vlimit */
- ENTRY("mincore",                  SYS_mincore,                        mincore,                           3, CALL_DIRECT, PTR, SIZE, PTR)   /* 78  */
- ENTRY("getgroups",                SYS_getgroups,                      do_getgroups,                      2, CALL_DIRECT, UINT, PTR)   /* 79  */
- ENTRY("setgroups",                SYS_setgroups,                      setgroups,                         2, CALL_DIRECT, UINT, PTR)   /* 80  */
- ENTRY("getpgrp",                  SYS_getpgrp,                        getpgrp,                           0, CALL_DIRECT, VOID)   /* 81  */
- ENTRY("setpgid",                  SYS_setpgid,                        setpgid,                           2, CALL_DIRECT, INT, INT)   /* 82  */
- ENTRY("setitimer",                SYS_setitimer,                      setitimer,                         3, CALL_DIRECT, INT, PTR, PTR)   /* 83  */
- ENTRY("",                         84,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 84  old wait */
- ENTRY("swapon",                   SYS_swapon,                         unimpl_unix_syscall,               0, CALL_INDIRECT, VOID)   /* 85  */
- ENTRY("getitimer",                SYS_getitimer,                      getitimer,                         2, CALL_DIRECT, INT, PTR)   /* 86  */
- ENTRY("",                         87,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 87  old gethostname */
- ENTRY("",                         88,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 88  old sethostname */
- ENTRY("getdtablesize",            SYS_getdtablesize,                  getdtablesize,                     0, CALL_DIRECT, VOID)   /* 89  */
- ENTRY("dup2",                     SYS_dup2,                           dup2,                              2, CALL_DIRECT, INT, INT)   /* 90  */
- ENTRY("",                         91,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 91  old getdopt */
- ENTRY("fcntl",                    SYS_fcntl,                          do_fcntl,                          3, CALL_DIRECT, INT, INT, INT)   /* 92  */
- ENTRY("select",                   SYS_select,                         select,                            5, CALL_DIRECT, INT, PTR, PTR, PTR, PTR)   /* 93  */
- ENTRY("",                         94,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 94  old setdopt */
- ENTRY("fsync",                    SYS_fsync,                          fsync,                             1, CALL_DIRECT, INT)   /* 95  */
- ENTRY("setpriority",              SYS_setpriority,                    setpriority,                       3, CALL_DIRECT, INT, INT, INT)   /* 96  */
- ENTRY("socket",                   SYS_socket,                         socket,                            3, CALL_DIRECT, INT, INT, INT)   /* 97  */
- ENTRY("connect",                  SYS_connect,                        connect,                           3, CALL_DIRECT, INT, PTR, INT)   /* 98  */
- ENTRY("",                         99,                                 no_syscall,                        0, CALL_INDIRECT, VOID) /* 99  old accept */
- ENTRY("getpriority",              SYS_getpriority,                    getpriority,                       2, CALL_DIRECT, INT, INT)   /* 100  */
- ENTRY("",                         101,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 101  old send */
- ENTRY("",                         102,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 102  old recv */
- ENTRY("",                         103,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 103  old sigreturn */
- ENTRY("bind",                     SYS_bind,                           bind,                              3, CALL_DIRECT, INT, PTR, INT)   /* 104  */
- ENTRY("setsockopt",               SYS_setsockopt,                     setsockopt,                        5, CALL_DIRECT, INT, INT, INT, PTR, INT)   /* 105  */
- ENTRY("listen",                   SYS_listen,                         listen,                            2, CALL_DIRECT, INT, INT)   /* 106  */
- ENTRY("",                         107,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 107  old vtimes */
- ENTRY("",                         108,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 108  old sigvec */
- ENTRY("",                         109,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 109  old sigblock */
- ENTRY("",                         110,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 110  old sigsetmask */
- ENTRY("sigsuspend",               SYS_sigsuspend,                     unimpl_unix_syscall,               1, CALL_INDIRECT, INT)   /* 111  */
- ENTRY("",                         112,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 112  old sigstack */
- ENTRY("",                         113,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 113  old recvmsg */
- ENTRY("",                         114,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 114  old sendmsg */
- ENTRY("",                         115,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 115  old vtrace */
- ENTRY("gettimeofday",             SYS_gettimeofday,                   do_gettimeofday,                   2, CALL_DIRECT, PTR, PTR) /* 116  */
- ENTRY("getrusage",                SYS_getrusage,                      getrusage,                         2, CALL_DIRECT, INT, PTR)   /* 117  */
- ENTRY("getsockopt",               SYS_getsockopt,                     getsockopt,                        5, CALL_DIRECT, INT, INT, INT, PTR, PTR)   /* 118  */
- ENTRY("",                         119,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 119  old resuba */
- ENTRY("readv",                    SYS_readv,                          do_readv,                          3, CALL_DIRECT, INT, PTR, UINT)   /* 120  */
- ENTRY("writev",                   SYS_writev,                         do_writev,                         3, CALL_DIRECT, INT, PTR, UINT)   /* 121  */
- ENTRY("settimeofday",             SYS_settimeofday,                   settimeofday,                      2, CALL_DIRECT, PTR, PTR)   /* 122  */
- ENTRY("fchown",                   SYS_fchown,                         fchown,                            3, CALL_DIRECT, INT, INT, INT)   /* 123  */
- ENTRY("fchmod",                   SYS_fchmod,                         fchmod,                            2, CALL_DIRECT, INT, INT)   /* 124  */
- ENTRY("",                         125,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 125  old recvfrom */
- ENTRY("",                         126,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 126  old setreuid */
- ENTRY("",                         127,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 127  old setregid */
- ENTRY("rename",                   SYS_rename,                         rename,                            2, CALL_DIRECT, PTR, PTR)   /* 128  */
- ENTRY("",                         129,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 129  old truncate */
- ENTRY("",                         130,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 130  old ftruncate */
- ENTRY("flock",                    SYS_flock,                          flock,                             2, CALL_DIRECT, INT, INT)   /* 131  */
- ENTRY("mkfifo",                   SYS_mkfifo,                         mkfifo,                            2, CALL_DIRECT, PTR, INT)   /* 132  */
- ENTRY("sendto",                   SYS_sendto,                         sendto,                            6, CALL_DIRECT, INT, PTR, SIZE, INT, PTR, INT)   /* 133  */
- ENTRY("shutdown",                 SYS_shutdown,                       shutdown,                          2, CALL_DIRECT, INT, INT)   /* 134  */
- ENTRY("socketpair",               SYS_socketpair,                     socketpair,                        4, CALL_DIRECT, INT, INT, INT, PTR)   /* 135  */
- ENTRY("mkdir",                    SYS_mkdir,                          mkdir,                             2, CALL_DIRECT, PTR, INT)   /* 136  */
- ENTRY("rmdir",                    SYS_rmdir,                          rmdir,                             1, CALL_DIRECT, PTR)   /* 137  */
- ENTRY("utimes",                   SYS_utimes,                         do_utimes,                         2, CALL_DIRECT, PTR, PTR)   /* 138  */
- ENTRY("futimes",                  SYS_futimes,                        do_futimes,                        2, CALL_DIRECT, INT, PTR)   /* 139  */
- ENTRY("adjtime",                  SYS_adjtime,                        adjtime,                           2, CALL_DIRECT, PTR, PTR)   /* 140  */
- ENTRY("",                         141,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 141  old getpeername */
- ENTRY("",                         142,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 142  old gethostid */
- ENTRY("",                         143,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 143  old sethostid */
- ENTRY("",                         144,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 144  old getrlimit */
- ENTRY("",                         145,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 145  old setrlimit */
- ENTRY("",                         146,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 146  old killpg */
- ENTRY("setsid",                   SYS_setsid,                         setsid,                            0, CALL_DIRECT, VOID)   /* 147  */
- ENTRY("",                         148,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 148  old setquota */
- ENTRY("",                         149,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 149  old qquota */
- ENTRY("",                         150,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 150  old getsockname */
- ENTRY("getpgid",                  SYS_getpgid,                        getpgid,                           1, CALL_DIRECT, INT)   /* 151  */
- ENTRY("setprivexec",              SYS_setprivexec,                    no_syscall,                        1, CALL_INDIRECT, VOID) /* 152  */
- ENTRY("pread",                    SYS_pread,                          do_pread,                          4, CALL_DIRECT, INT, PTR, SIZE, OFFSET)   /* 153  */
- ENTRY("pwrite",                   SYS_pwrite,                         pwrite,                            4, CALL_DIRECT, INT, PTR, SIZE, OFFSET)   /* 154  */
-#ifdef SYS_nfssvc
- ENTRY("nfssvc",                   SYS_nfssvc,                         nfssvc,                            2, CALL_DIRECT, INT, PTR)   /* 155  */
-#else
- ENTRY("nfssvc",                   155,                                no_syscall,                        2, CALL_INDIRECT, VOID)   /* 155  */
-#endif
- ENTRY("",                         155,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 155  */
- ENTRY("",                         156,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 156  old getdirentries */
- ENTRY("statfs",                   SYS_statfs,                         do_statfs,                         2, CALL_DIRECT, PTR, PTR)   /* 157  */
- ENTRY("fstatfs",                  SYS_fstatfs,                        do_fstatfs,                        2, CALL_DIRECT, INT, PTR)   /* 158  */
- ENTRY("unmount",                  SYS_unmount,                        unmount,                           2, CALL_DIRECT, PTR, INT)   /* 159  */
- ENTRY("",                         160,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 160  old async_daemon */
- ENTRY("",                         161,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 161  */
- ENTRY("",                         162,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 162  old getdomainname */
- ENTRY("",                         163,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 163  old setdomainname */
- ENTRY("",                         164,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 164  */
- ENTRY("quotactl",                 SYS_quotactl,                       no_syscall,                        4, CALL_INDIRECT, VOID) /* 165  */
- ENTRY("",                         166,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 166  old exportfs */
- ENTRY("mount",                    SYS_mount,                          mount,                             4, CALL_DIRECT, PTR, PTR, INT, PTR)   /* 167  */
- ENTRY("",                         168,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 168  old ustat */
- ENTRY("",                         169,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 169  */
- ENTRY("table",                    SYS_table,                          no_syscall,                        0, CALL_INDIRECT, VOID) /* 170  old table */
- ENTRY("",                         171,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 171  old wait3 */
- ENTRY("",                         172,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 172  old rpause */
- ENTRY("waitid",                   SYS_waitid,                         unimpl_unix_syscall,               4, CALL_INDIRECT, VOID) /* 173  */
- ENTRY("",                         174,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 174  old getdents */
- ENTRY("",                         175,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 175  old gc_control */
- ENTRY("add_profil",               SYS_add_profil,                     add_profil,                        4, CALL_DIRECT, PTR, SIZE, UINT, UINT)   /* 176  */
- ENTRY("",                         177,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 177  */
- ENTRY("",                         178,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 178  */
- ENTRY("",                         179,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 179  */
- ENTRY("kdebug_trace",             SYS_kdebug_trace,                   no_syscall,                        6, CALL_INDIRECT, VOID) /* 180  */
- ENTRY("setgid",                   SYS_setgid,                         setgid,                            1, CALL_DIRECT, INT)   /* 181  */
- ENTRY("setegid",                  SYS_setegid,                        setegid,                           1, CALL_DIRECT, INT)   /* 182  */
- ENTRY("seteuid",                  SYS_seteuid,                        seteuid,                           1, CALL_DIRECT, INT)   /* 183  */
- ENTRY("sigreturn",                SYS_sigreturn,                      do_sigreturn,                      2, CALL_INDIRECT, PTR, INT)   /* 184  */
- ENTRY("chud",                     SYS_chud,                           unimpl_unix_syscall,               6, CALL_INDIRECT, VOID)   /* 185  */
- ENTRY("",                         186,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 186  */
- ENTRY("",                         187,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 187  */
- ENTRY("stat",                     SYS_stat,                           do_stat,                           2, CALL_DIRECT, PTR, PTR)   /* 188  */
- ENTRY("fstat",                    SYS_fstat,                          do_fstat,                          2, CALL_DIRECT, INT, PTR)   /* 189  */
- ENTRY("lstat",                    SYS_lstat,                          do_lstat,                          2, CALL_DIRECT, PTR, PTR)   /* 190  */
- ENTRY("pathconf",                 SYS_pathconf,                       pathconf,                          2, CALL_DIRECT, PTR, INT)   /* 191  */
- ENTRY("fpathconf",                SYS_fpathconf,                      fpathconf,                         2, CALL_DIRECT, INT, INT)   /* 192  */
- ENTRY("getfsstat",                SYS_getfsstat,                      do_getfsstat,                      3, CALL_DIRECT, PTR, INT, INT)   /* 193  */
- ENTRY("",                         193,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 193  */
- ENTRY("getrlimit",                SYS_getrlimit,                      getrlimit,                         2, CALL_DIRECT, UINT, PTR)   /* 194  */
- ENTRY("setrlimit",                SYS_setrlimit,                      setrlimit,                         2, CALL_DIRECT, UINT, PTR)   /* 195  */
- ENTRY("getdirentries",            SYS_getdirentries,                  do_getdirentries,                  4, CALL_DIRECT, INT, PTR, UINT, PTR)   /* 196  */
- ENTRY("mmap",                     SYS_mmap,                           target_mmap,                       6, CALL_DIRECT, UINT /*PTR*/, SIZE, INT, INT, INT, OFFSET)   /* 197  */
- ENTRY("",                         198,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 198  __syscall */
- ENTRY("lseek",                    SYS_lseek,                          do_lseek,                          3, CALL_INDIRECT, INT, OFFSET, INT)   /* 199  */
- ENTRY("truncate",                 SYS_truncate,                       truncate,                          2, CALL_DIRECT, PTR, OFFSET)   /* 200  */
- ENTRY("ftruncate",                SYS_ftruncate,                      ftruncate,                         2, CALL_DIRECT, INT, OFFSET)   /* 201  */
- ENTRY("__sysctl",                 SYS___sysctl,                       do___sysctl,                       6, CALL_DIRECT, PTR, INT, PTR, PTR, PTR, SIZE)   /* 202  */
- ENTRY("mlock",                    SYS_mlock,                          mlock,                             2, CALL_DIRECT, PTR, SIZE)   /* 203  */
- ENTRY("munlock",                  SYS_munlock,                        munlock,                           2, CALL_DIRECT, PTR, SIZE)   /* 204  */
- ENTRY("undelete",                 SYS_undelete,                       undelete,                          1, CALL_DIRECT, PTR)   /* 205  */
- ENTRY("ATsocket",                 SYS_ATsocket,                       no_syscall,                        1, CALL_INDIRECT, VOID) /* 206  */
- ENTRY("ATgetmsg",                 SYS_ATgetmsg,                       no_syscall,                        4, CALL_INDIRECT, VOID) /* 207  */
- ENTRY("ATputmsg",                 SYS_ATputmsg,                       no_syscall,                        4, CALL_INDIRECT, VOID) /* 208  */
- ENTRY("ATPsndreq",                SYS_ATPsndreq,                      no_syscall,                        4, CALL_INDIRECT, VOID) /* 209  */
- ENTRY("ATPsndrsp",                SYS_ATPsndrsp,                      no_syscall,                        4, CALL_INDIRECT, VOID) /* 210  */
- ENTRY("ATPgetreq",                SYS_ATPgetreq,                      no_syscall,                        3, CALL_INDIRECT, VOID) /* 211  */
- ENTRY("ATPgetrsp",                SYS_ATPgetrsp,                      no_syscall,                        2, CALL_INDIRECT, VOID) /* 212  */
- ENTRY("",                         213,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 213  Reserved for AppleTalk */
- ENTRY("kqueue_from_portset_np",   SYS_kqueue_from_portset_np,         no_syscall,                        1, CALL_INDIRECT, VOID) /* 214  */
- ENTRY("kqueue_portset_np",        SYS_kqueue_portset_np,              no_syscall,                        1, CALL_INDIRECT, VOID) /* 215  */
- ENTRY("mkcomplex",                SYS_mkcomplex,                      no_syscall,                        3, CALL_INDIRECT, VOID)   /* 216  soon to be obsolete */
- ENTRY("statv",                    SYS_statv,                          no_syscall,                        2, CALL_INDIRECT, VOID)   /* 217  soon to be obsolete */
- ENTRY("lstatv",                   SYS_lstatv,                         no_syscall,                        2, CALL_INDIRECT, VOID)   /* 218  soon to be obsolete */
- ENTRY("fstatv",                   SYS_fstatv,                         no_syscall,                        2, CALL_INDIRECT, VOID)   /* 219  soon to be obsolete */
- ENTRY("getattrlist",              SYS_getattrlist,                    do_getattrlist,                    5, CALL_DIRECT, PTR, PTR, PTR, SIZE, UINT)   /* 220  */
- ENTRY("setattrlist",              SYS_setattrlist,                    unimpl_unix_syscall,               5, CALL_INDIRECT, VOID) /* 221  */
- ENTRY("getdirentriesattr",        SYS_getdirentriesattr,              do_getdirentriesattr,              8, CALL_DIRECT, INT, PTR, PTR, SIZE, PTR, PTR, PTR, UINT)   /* 222  */
- ENTRY("exchangedata",             SYS_exchangedata,                   exchangedata,                      3, CALL_DIRECT, PTR, PTR, UINT)   /* 223  */
- ENTRY("checkuseraccess",          SYS_checkuseraccess,                checkuseraccess,                   6, CALL_DIRECT, PTR, INT, PTR, INT, INT, UINT)   /* 224  */
- ENTRY("",                         224,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 224  HFS checkuseraccess check access to a file */
- ENTRY("searchfs",                 SYS_searchfs,                       searchfs,                          6, CALL_DIRECT, PTR, PTR, PTR, UINT, UINT, PTR)   /* 225  */
- ENTRY("delete",                   SYS_delete,                         no_syscall,                        1, CALL_INDIRECT, VOID)   /* 226  private delete ( Carbon semantics ) */
- ENTRY("copyfile",                 SYS_copyfile,                       no_syscall,                        4, CALL_INDIRECT, VOID)   /* 227  */
- ENTRY("",                         228,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 228  */
- ENTRY("",                         229,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 229  */
- ENTRY("poll",                     SYS_poll,                           no_syscall,                        3, CALL_INDIRECT, VOID) /* 230  */
- ENTRY("watchevent",               SYS_watchevent,                     no_syscall,                        2, CALL_INDIRECT, VOID)   /* 231  */
- ENTRY("waitevent",                SYS_waitevent,                      no_syscall,                        2, CALL_INDIRECT, VOID)   /* 232  */
- ENTRY("modwatch",                 SYS_modwatch,                       no_syscall,                        2, CALL_INDIRECT, VOID)   /* 233  */
- ENTRY("getxattr",                 SYS_getxattr,                       no_syscall,                        6, CALL_INDIRECT, VOID)   /* 234  */
- ENTRY("fgetxattr",                SYS_fgetxattr,                      no_syscall,                        6, CALL_INDIRECT, VOID)   /* 235  */
- ENTRY("setxattr",                 SYS_setxattr,                       no_syscall,                        6, CALL_INDIRECT, VOID)   /* 236  */
- ENTRY("fsetxattr",                SYS_fsetxattr,                      no_syscall,                        6, CALL_INDIRECT, VOID)   /* 237  */
- ENTRY("removexattr",              SYS_removexattr,                    no_syscall,                        3, CALL_INDIRECT, VOID)   /* 238  */
- ENTRY("fremovexattr",             SYS_fremovexattr,                   no_syscall,                        3, CALL_INDIRECT, VOID)   /* 239  */
- ENTRY("listxattr",                SYS_listxattr,                      listxattr,                         4, CALL_INDIRECT, VOID)   /* 240  */
- ENTRY("flistxattr",               SYS_flistxattr,                     no_syscall,                        4, CALL_INDIRECT, VOID)   /* 241  */
- ENTRY("fsctl",                    SYS_fsctl,                          fsctl,                             4, CALL_DIRECT, PTR, UINT, PTR, UINT)   /* 242  */
- ENTRY("initgroups",               SYS_initgroups,                     unimpl_unix_syscall,               3, CALL_INDIRECT, UINT, PTR, INT)   /* 243  */
- ENTRY("",                         244,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 244  */
- ENTRY("",                         245,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 245  */
- ENTRY("",                         246,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 246  */
-#ifdef SYS_nfsclnt
- ENTRY("nfsclnt",                  SYS_nfsclnt,                        nfsclnt,                           2, CALL_DIRECT, INT, PTR)   /* 247  */
-#else
- ENTRY("nfsclnt",                  247,                                no_syscall,                        2, CALL_INDIRECT, VOID)   /* 247  */
-#endif
- ENTRY("",                         247,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 247  */
- ENTRY("",                         248,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 248  */
- ENTRY("",                         249,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 249  */
- ENTRY("minherit",                 SYS_minherit,                       minherit,                          3, CALL_DIRECT, PTR, INT, INT)   /* 250  */
- ENTRY("semsys",                   SYS_semsys,                         unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 251  */
- ENTRY("msgsys",                   SYS_msgsys,                         unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 252  */
- ENTRY("shmsys",                   SYS_shmsys,                         unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 253  */
- ENTRY("semctl",                   SYS_semctl,                         unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 254  */
- ENTRY("semget",                   SYS_semget,                         unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 255  */
- ENTRY("semop",                    SYS_semop,                          unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 256  */
- ENTRY("",                         257,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 257  */
- ENTRY("msgctl",                   SYS_msgctl,                         unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 258  */
- ENTRY("msgget",                   SYS_msgget,                         unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 259  */
- ENTRY("msgsnd",                   SYS_msgsnd,                         unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 260  */
- ENTRY("msgrcv",                   SYS_msgrcv,                         unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 261  */
- ENTRY("shmat",                    SYS_shmat,                          unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 262  */
- ENTRY("shmctl",                   SYS_shmctl,                         unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 263  */
- ENTRY("shmdt",                    SYS_shmdt,                          unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 264  */
- ENTRY("shmget",                   SYS_shmget,                         unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 265  */
- ENTRY("shm_open",                 SYS_shm_open,                       shm_open,                          3, CALL_DIRECT, PTR, INT, INT)   /* 266  */
- ENTRY("shm_unlink",               SYS_shm_unlink,                     shm_unlink,                        1, CALL_DIRECT, PTR)   /* 267  */
- ENTRY("sem_open",                 SYS_sem_open,                       unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 268  */
- ENTRY("sem_close",                SYS_sem_close,                      unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 269  */
- ENTRY("sem_unlink",               SYS_sem_unlink,                     unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 270  */
- ENTRY("sem_wait",                 SYS_sem_wait,                       unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 271  */
- ENTRY("sem_trywait",              SYS_sem_trywait,                    unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 272  */
- ENTRY("sem_post",                 SYS_sem_post,                       unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 273  */
- ENTRY("sem_getvalue",             SYS_sem_getvalue,                   unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 274  */
- ENTRY("sem_init",                 SYS_sem_init,                       unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 275  */
- ENTRY("sem_destroy",              SYS_sem_destroy,                    unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 276  */
- ENTRY("open_extended",            SYS_open_extended,                  unimpl_unix_syscall,               6, CALL_INDIRECT, VOID)   /* 277  */
- ENTRY("umask_extended",           SYS_umask_extended,                 unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 278  */
- ENTRY("stat_extended",            SYS_stat_extended,                  unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 279  */
- ENTRY("lstat_extended",           SYS_lstat_extended,                 unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 280  */
- ENTRY("fstat_extended",           SYS_fstat_extended,                 unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 281  */
- ENTRY("chmod_extended",           SYS_chmod_extended,                 unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 282  */
- ENTRY("fchmod_extended",          SYS_fchmod_extended,                unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 283  */
- ENTRY("access_extended",          SYS_access_extended,                unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 284  */
- ENTRY("settid",                   SYS_settid,                         unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 285  */
- ENTRY("gettid",                   SYS_gettid,                         unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 286  */
- ENTRY("setsgroups",               SYS_setsgroups,                     unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 287  */
- ENTRY("getsgroups",               SYS_getsgroups,                     unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 288  */
- ENTRY("setwgroups",               SYS_setwgroups,                     unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 289  */
- ENTRY("getwgroups",               SYS_getwgroups,                     unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 290  */
- ENTRY("mkfifo_extended",          SYS_mkfifo_extended,                unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 291  */
- ENTRY("mkdir_extended",           SYS_mkdir_extended,                 unimpl_unix_syscall,               5, CALL_INDIRECT, VOID)   /* 292  */
- ENTRY("identitysvc",              SYS_identitysvc,                    unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 293  */
- ENTRY("",                         294,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 294  */
- ENTRY("",                         295,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 295  */
- ENTRY("load_shared_file",         SYS_load_shared_file,               unimpl_unix_syscall,               7, CALL_INDIRECT, VOID)   /* 296  */
- ENTRY("reset_shared_file",        SYS_reset_shared_file,              unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 297  */
- ENTRY("new_system_shared_regions",  SYS_new_system_shared_regions,    unimpl_unix_syscall,               0, CALL_INDIRECT, VOID)   /* 298  */
- ENTRY("shared_region_map_file_np",  SYS_shared_region_map_file_np,    unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 299  */
- ENTRY("shared_region_make_private_np",  SYS_shared_region_make_private_np,  unimpl_unix_syscall,         2, CALL_INDIRECT, VOID)   /* 300  */
- ENTRY("",                         301,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 301  */
- ENTRY("",                         302,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 302  */
- ENTRY("",                         303,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 303  */
- ENTRY("",                         304,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 304  */
- ENTRY("",                         305,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 305  */
- ENTRY("",                         306,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 306  */
- ENTRY("",                         307,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 307  */
- ENTRY("",                         308,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 308  */
- ENTRY("",                         309,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 309  */
- ENTRY("getsid",                   SYS_getsid,                         getsid,                            1, CALL_DIRECT, INT)   /* 310  */
- ENTRY("settid_with_pid",          SYS_settid_with_pid,                unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 311  */
- ENTRY("",                         312,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 312  */
- ENTRY("aio_fsync",                SYS_aio_fsync,                      unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 313  */
- ENTRY("aio_return",               SYS_aio_return,                     unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 314  */
- ENTRY("aio_suspend",              SYS_aio_suspend,                    unimpl_unix_syscall,               3, CALL_INDIRECT, VOID)   /* 315  */
- ENTRY("aio_cancel",               SYS_aio_cancel,                     unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 316  */
- ENTRY("aio_error",                SYS_aio_error,                      unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 317  */
- ENTRY("aio_read",                 SYS_aio_read,                       unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 318  */
- ENTRY("aio_write",                SYS_aio_write,                      unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 319  */
- ENTRY("lio_listio",               SYS_lio_listio,                     unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 320  */
- ENTRY("",                         321,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 321  */
- ENTRY("",                         322,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 322  */
- ENTRY("",                         323,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 323  */
- ENTRY("mlockall",                 SYS_mlockall,                       mlockall,                          1, CALL_DIRECT, INT)   /* 324  */
- ENTRY("munlockall",               SYS_munlockall,                     unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 325  */
- ENTRY("",                         326,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 326  */
- ENTRY("issetugid",                SYS_issetugid,                      issetugid,                         0, CALL_DIRECT, VOID)   /* 327  */
- ENTRY("__pthread_kill",           SYS___pthread_kill,                 unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 328  */
- ENTRY("pthread_sigmask",          SYS_pthread_sigmask,                pthread_sigmask,                   3, CALL_DIRECT, INT, PTR, PTR)   /* 329  */
- ENTRY("sigwait",                  SYS_sigwait,                        sigwait,                           2, CALL_DIRECT, PTR, PTR)   /* 330  */
- ENTRY("__disable_threadsignal",   SYS___disable_threadsignal,         unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 331  */
- ENTRY("__pthread_markcancel",     SYS___pthread_markcancel,           unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 332  */
- ENTRY("__pthread_canceled",       SYS___pthread_canceled,             unimpl_unix_syscall,               1, CALL_INDIRECT, VOID)   /* 333  */
- ENTRY("__semwait_signal",         SYS___semwait_signal,               unimpl_unix_syscall,               6, CALL_INDIRECT, VOID)   /* 334  */
- ENTRY("utrace",                   SYS_utrace,                         unimpl_unix_syscall,               2, CALL_INDIRECT, VOID)   /* 335  */
- ENTRY("proc_info",                SYS_proc_info,                      unimpl_unix_syscall,               6, CALL_INDIRECT, VOID)   /* 336  */
- ENTRY("",                         337,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 337  */
- ENTRY("",                         338,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 338  */
- ENTRY("",                         339,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 339  */
- ENTRY("",                         340,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 340  */
- ENTRY("",                         341,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 341  */
- ENTRY("",                         342,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 342  */
- ENTRY("",                         343,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 343  */
- ENTRY("",                         344,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 344  */
- ENTRY("",                         345,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 345  */
- ENTRY("",                         346,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 346  */
- ENTRY("",                         347,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 347  */
- ENTRY("",                         348,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 348  */
- ENTRY("",                         349,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 349  */
- ENTRY("audit",                    SYS_audit,                          audit,                             2, CALL_DIRECT, PTR, INT)   /* 350  */
- ENTRY("auditon",                  SYS_auditon,                        auditon,                           3, CALL_DIRECT, INT, PTR, INT)   /* 351  */
- ENTRY("",                         352,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 352  */
- ENTRY("getauid",                  SYS_getauid,                        getauid,                           1, CALL_DIRECT, PTR)   /* 353  */
- ENTRY("setauid",                  SYS_setauid,                        setauid,                           1, CALL_DIRECT, PTR)   /* 354  */
- ENTRY("getaudit",                 SYS_getaudit,                       getaudit,                          1, CALL_DIRECT, PTR)   /* 355  */
- ENTRY("setaudit",                 SYS_setaudit,                       setaudit,                          1, CALL_DIRECT, PTR)   /* 356  */
- ENTRY("getaudit_addr",            SYS_getaudit_addr,                  getaudit_addr,                     2, CALL_DIRECT, PTR, INT)   /* 357  */
- ENTRY("setaudit_addr",            SYS_setaudit_addr,                  setaudit_addr,                     2, CALL_DIRECT, PTR, INT)   /* 358  */
- ENTRY("auditctl",                 SYS_auditctl,                       auditctl,                          1, CALL_DIRECT, PTR)   /* 359  */
- ENTRY("",                         360,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 360  */
- ENTRY("",                         361,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 361  */
- ENTRY("kqueue",                   SYS_kqueue,                         kqueue,                            0, CALL_DIRECT, VOID)   /* 362  */
- ENTRY("kevent",                   SYS_kevent,                         kevent,                            6, CALL_DIRECT, INT, PTR, INT, PTR, INT, PTR)   /* 363  */
- ENTRY("lchown",                   SYS_lchown,                         lchown,                            3, CALL_DIRECT, PTR, INT , INT)   /* 364  */
- ENTRY("stack_snapshot",           SYS_stack_snapshot,                 unimpl_unix_syscall,               4, CALL_INDIRECT, VOID)   /* 365  */
- ENTRY("",                         366,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 366  */
- ENTRY("",                         367,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 367  */
- ENTRY("",                         368,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 368  */
- ENTRY("",                         369,                                no_syscall,                        0, CALL_INDIRECT, VOID) /* 369  */
diff --git a/default-configs/i386-darwin-user.mak b/default-configs/i386-darwin-user.mak
deleted file mode 100644
index 19afd3d..0000000
--- a/default-configs/i386-darwin-user.mak
+++ /dev/null
@@ -1 +0,0 @@
-# Default configuration for i386-darwin-user
diff --git a/default-configs/ppc-darwin-user.mak b/default-configs/ppc-darwin-user.mak
deleted file mode 100644
index 153ed12..0000000
--- a/default-configs/ppc-darwin-user.mak
+++ /dev/null
@@ -1,3 +0,0 @@
-# Default configuration for ppc-darwin-user
-
-CONFIG_GDBSTUB_XML=y
diff --git a/qemu-doc.texi b/qemu-doc.texi
index 9e07ba6..e5d7ac4 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -2270,7 +2270,6 @@ so should only be used with trusted guest OS.
 @menu
 * Supported Operating Systems ::
 * Linux User space emulator::
-* Mac OS X/Darwin User space emulator ::
 * BSD User space emulator ::
 @end menu
 
@@ -2283,8 +2282,6 @@ The following OS are supported in user space emulation:
 @item
 Linux (referred as qemu-linux-user)
 @item
-Mac OS X/Darwin (referred as qemu-darwin-user)
- at item
 BSD (referred as qemu-bsd-user)
 @end itemize
 
@@ -2489,93 +2486,6 @@ The binary format is detected automatically.
 @command{qemu-sparc64} can execute some Sparc64 (Sparc64 CPU, 64 bit ABI) and
 SPARC32PLUS binaries (Sparc64 CPU, 32 bit ABI).
 
- at node Mac OS X/Darwin User space emulator
- at section Mac OS X/Darwin User space emulator
-
- at menu
-* Mac OS X/Darwin Status::
-* Mac OS X/Darwin Quick Start::
-* Mac OS X/Darwin Command line options::
- at end menu
-
- at node Mac OS X/Darwin Status
- at subsection Mac OS X/Darwin Status
-
- at itemize @minus
- at item
-target x86 on x86: Most apps (Cocoa and Carbon too) works. [1]
- at item
-target PowerPC on x86: Not working as the ppc commpage can't be mapped (yet!)
- at item
-target PowerPC on PowerPC: Most apps (Cocoa and Carbon too) works. [1]
- at item
-target x86 on PowerPC: most utilities work. Cocoa and Carbon apps are not yet supported.
- at end itemize
-
-[1] If you're host commpage can be executed by qemu.
-
- at node Mac OS X/Darwin Quick Start
- at subsection Quick Start
-
-In order to launch a Mac OS X/Darwin process, QEMU needs the process executable
-itself and all the target dynamic libraries used by it. If you don't have the FAT
-libraries (you're running Mac OS X/ppc) you'll need to obtain it from a Mac OS X
-CD or compile them by hand.
-
- at itemize
-
- at item On x86, you can just try to launch any process by using the native
-libraries:
-
- at example
-qemu-i386 /bin/ls
- at end example
-
-or to run the ppc version of the executable:
-
- at example
-qemu-ppc /bin/ls
- at end example
-
- at item On ppc, you'll have to tell qemu where your x86 libraries (and dynamic linker)
-are installed:
-
- at example
-qemu-i386 -L /opt/x86_root/ /bin/ls
- at end example
-
- at code{-L /opt/x86_root/} tells that the dynamic linker (dyld) path is in
- at file{/opt/x86_root/usr/bin/dyld}.
-
- at end itemize
-
- at node Mac OS X/Darwin Command line options
- at subsection Command line options
-
- at example
-usage: qemu-i386 [-h] [-d] [-L path] [-s size] program [arguments...]
- at end example
-
- at table @option
- at item -h
-Print the help
- at item -L path
-Set the library root path (default=/)
- at item -s size
-Set the stack size in bytes (default=524288)
- at end table
-
-Debug options:
-
- at table @option
- at item -d
-Activate log (logfile=/tmp/qemu.log)
- at item -p pagesize
-Act as if the host page size was 'pagesize' bytes
- at item -singlestep
-Run the emulation in single step mode.
- at end table
-
 @node BSD User space emulator
 @section BSD User space emulator
 
diff --git a/qemu-tech.texi b/qemu-tech.texi
index 5676fb7..b51a58a 100644
--- a/qemu-tech.texi
+++ b/qemu-tech.texi
@@ -112,8 +112,7 @@ QEMU user mode emulation features:
 @end itemize
 
 Linux user emulator (Linux host only) can be used to launch the Wine
-Windows API emulator (@url{http://www.winehq.org}). A Darwin user
-emulator (Darwin hosts only) exists and a BSD user emulator for BSD
+Windows API emulator (@url{http://www.winehq.org}). A BSD user emulator for BSD
 hosts is under development. It would also be possible to develop a
 similar user emulator for Solaris.
 
commit 148210301e334694badcc8ae72ecb522c6d7bac6
Author: Pavel Borzenkov <pavel.borzenkov at gmail.com>
Date:   Thu Nov 10 22:40:07 2011 +0400

    configure: add '--disable-cocoa' switch
    
    When SDL support is disabled, there is no way to build QEMU without
    Cocoa support on MacOS X. This patch adds '--disable-cocoa' switch and
    allows to build QEMU without both SDL and Cocoa frontends.
    
    Signed-off-by: Pavel Borzenkov <pavel.borzenkov at gmail.com>
    [AF: Adapt help output]
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/configure b/configure
index 25697bb..0cf3bbb 100755
--- a/configure
+++ b/configure
@@ -714,6 +714,8 @@ for opt do
   ;;
   --enable-profiler) profiler="yes"
   ;;
+  --disable-cocoa) cocoa="no"
+  ;;
   --enable-cocoa)
       cocoa="yes" ;
       sdl="no" ;
@@ -1027,7 +1029,8 @@ echo "  --disable-virtfs         disable VirtFS"
 echo "  --enable-virtfs          enable VirtFS"
 echo "  --disable-vnc            disable VNC"
 echo "  --enable-vnc             enable VNC"
-echo "  --enable-cocoa           enable COCOA (Mac OS X only)"
+echo "  --disable-cocoa          disable Cocoa (Mac OS X only)"
+echo "  --enable-cocoa           enable Cocoa (default on Mac OS X)"
 echo "  --audio-drv-list=LIST    set audio drivers list:"
 echo "                           Available drivers: $audio_possible_drivers"
 echo "  --audio-card-list=LIST   set list of emulated audio cards [$audio_card_list]"
commit 83affaa622a938e0a12a1f7079f00c7a3333d72a
Author: Pavel Borzenkov <pavel.borzenkov at gmail.com>
Date:   Thu Nov 10 22:40:06 2011 +0400

    raw-posix: Do not use CONFIG_COCOA macro
    
    Use __APPLE__ and __MACH__ macros instead of CONFIG_COCOA to detect Mac
    OS X host. The patch is based on Ben Leslie's patch:
    http://patchwork.ozlabs.org/patch/97859/
    
    Signed-off-by: Ben Leslie <benno at benno.id.au>
    Signed-off-by: Pavel Borzenkov <pavel.borzenkov at gmail.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 2d1bc13..03fcfcc 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -29,7 +29,7 @@
 #include "module.h"
 #include "block/raw-posix-aio.h"
 
-#ifdef CONFIG_COCOA
+#if defined(__APPLE__) && (__MACH__)
 #include <paths.h>
 #include <sys/param.h>
 #include <IOKit/IOKitLib.h>
@@ -505,7 +505,7 @@ again:
         }
         if (size == 0)
 #endif
-#ifdef CONFIG_COCOA
+#if defined(__APPLE__) && defined(__MACH__)
         size = LONG_LONG_MAX;
 #else
         size = lseek(fd, 0LL, SEEK_END);
@@ -650,7 +650,7 @@ static BlockDriver bdrv_file = {
 /***********************************************/
 /* host device */
 
-#ifdef CONFIG_COCOA
+#if defined(__APPLE__) && defined(__MACH__)
 static kern_return_t FindEjectableCDMedia( io_iterator_t *mediaIterator );
 static kern_return_t GetBSDPath( io_iterator_t mediaIterator, char *bsdPath, CFIndex maxPathSize );
 
@@ -728,7 +728,7 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVRawState *s = bs->opaque;
 
-#ifdef CONFIG_COCOA
+#if defined(__APPLE__) && defined(__MACH__)
     if (strstart(filename, "/dev/cdrom", NULL)) {
         kern_return_t kernResult;
         io_iterator_t mediaIterator;
commit 6c84ce0dc762999591bbef9e76e45cb260fe84e2
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat Apr 14 22:48:37 2012 +0200

    prep: Move int-ack register from PReP to Raven PCI emulation
    
    Register is one byte-wide (as per specification), so there is no need
    to specify endianness.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    [AF: Limit access validity to size 1]
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 61c655c..b1da114 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -86,38 +86,6 @@ static int ne2000_irq[NE2000_NB_MAX] = { 9, 10, 11, 3, 4, 5 };
 /* ISA IO ports bridge */
 #define PPC_IO_BASE 0x80000000
 
-/* PCI intack register */
-/* Read-only register (?) */
-static void PPC_intack_write (void *opaque, target_phys_addr_t addr,
-                              uint64_t value, unsigned size)
-{
-#if 0
-    printf("%s: 0x" TARGET_FMT_plx " => 0x%08" PRIx64 "\n", __func__, addr,
-           value);
-#endif
-}
-
-static uint64_t PPC_intack_read(void *opaque, target_phys_addr_t addr,
-                                unsigned size)
-{
-    uint32_t retval = 0;
-
-    if ((addr & 0xf) == 0)
-        retval = pic_read_irq(isa_pic);
-#if 0
-    printf("%s: 0x" TARGET_FMT_plx " <= %08" PRIx32 "\n", __func__, addr,
-           retval);
-#endif
-
-    return retval;
-}
-
-static const MemoryRegionOps PPC_intack_ops = {
-    .read = PPC_intack_read,
-    .write = PPC_intack_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 /* PowerPC control and status registers */
 #if 0 // Not used
 static struct {
@@ -492,7 +460,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
     nvram_t nvram;
     M48t59State *m48t59;
     MemoryRegion *PPC_io_memory = g_new(MemoryRegion, 1);
-    MemoryRegion *intack = g_new(MemoryRegion, 1);
 #if 0
     MemoryRegion *xcsr = g_new(MemoryRegion, 1);
 #endif
@@ -685,9 +652,6 @@ static void ppc_prep_init (ram_addr_t ram_size,
     register_ioport_write(0x0092, 0x01, 1, &PREP_io_800_writeb, sysctrl);
     register_ioport_read(0x0800, 0x52, 1, &PREP_io_800_readb, sysctrl);
     register_ioport_write(0x0800, 0x52, 1, &PREP_io_800_writeb, sysctrl);
-    /* PCI intack location */
-    memory_region_init_io(intack, &PPC_intack_ops, NULL, "ppc-intack", 4);
-    memory_region_add_subregion(sysmem, 0xBFFFFFF0, intack);
     /* PowerPC control and status register group */
 #if 0
     memory_region_init_io(xcsr, &PPC_XCSR_ops, NULL, "ppc-xcsr", 0x1000);
diff --git a/hw/prep_pci.c b/hw/prep_pci.c
index 8b29da9..38dbff4 100644
--- a/hw/prep_pci.c
+++ b/hw/prep_pci.c
@@ -25,10 +25,12 @@
 #include "hw.h"
 #include "pci.h"
 #include "pci_host.h"
+#include "pc.h"
 #include "exec-memory.h"
 
 typedef struct PRePPCIState {
     PCIHostState host_state;
+    MemoryRegion intack;
     qemu_irq irq[4];
 } PREPPCIState;
 
@@ -67,6 +69,19 @@ static const MemoryRegionOps PPC_PCIIO_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
+static uint64_t ppc_intack_read(void *opaque, target_phys_addr_t addr,
+                                unsigned int size)
+{
+    return pic_read_irq(isa_pic);
+}
+
+static const MemoryRegionOps PPC_intack_ops = {
+    .read = ppc_intack_read,
+    .valid = {
+        .max_access_size = 1,
+    },
+};
+
 static int prep_map_irq(PCIDevice *pci_dev, int irq_num)
 {
     return (irq_num + (pci_dev->devfn >> 3)) & 1;
@@ -110,6 +125,8 @@ static int raven_pcihost_init(SysBusDevice *dev)
     memory_region_init_io(&h->mmcfg, &PPC_PCIIO_ops, s, "pciio", 0x00400000);
     memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
 
+    memory_region_init_io(&s->intack, &PPC_intack_ops, s, "pci-intack", 1);
+    memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->intack);
     pci_create_simple(bus, 0, "raven");
 
     return 0;
commit f789aa7baff33e74c549a249aba3ae7a364d7642
Author: Michael Roth <mdroth at linux.vnet.ibm.com>
Date:   Wed Apr 18 16:28:01 2012 -0500

    qemu-ga: persist tracking of fsfreeze state via filesystem
    
    Currently, qemu-ga may die/get killed/go away for whatever reason after
    guest-fsfreeze-freeze has been issued, and before guest-fsfreeze-thaw
    has been issued. This means the only way to unfreeze the guest is via
    VNC/network/console access, but obtaining that access after-the-fact can
    often be very difficult when filesystems are frozen. Logins will almost
    always hang, for instance. In many cases the only recourse would be to
    reboot the guest without any quiescing of volatile state, which makes
    this a corner-case worth giving some attention to.
    
    A likely failsafe for this situation would be to use a watchdog to
    restart qemu-ga if it goes away. There are some precautions qemu-ga
    needs to take in order to avoid immediately hanging itself on I/O,
    however, namely, we must disable logging and defer to processing/creation
    of user-specific logfiles, along with creation of the pid file if we're
    running as a daemon. We also need to disable non-fsfreeze-safe commands,
    as we normally would when processing the guest-fsfreeze-freeze command.
    
    To track when we need to do this in a way that persists between multiple
    invocations of qemu-ga, we create a file on the guest filesystem before
    issuing the fsfreeze, and delete it when doing the thaw. On qemu-ga
    startup, we check for the existance of this file to determine
    the need to take the above precautions.
    
    We're forced to do it this way since a more traditional approach such as
    reading/writing state to a dedicated state file will cause
    access/modification time updates, respectively, both of which will hang
    if the file resides on a frozen filesystem. Both can occur even if
    relatime is enabled. Checking for file existence will not update the
    access time, however, so it's a safe way to check for fsfreeze state.
    
    An actual watchdog-based restart of qemu-ga can itself cause an access
    time update that would thus hang the invocation of qemu-ga, but the
    logic to workaround that can be handled via the watchdog, so we don't
    address that here (for relatime we'd periodically touch the qemu-ga
    binary if the file $qga_statedir/qga.state.isfrozen is not present, this
    avoids qemu-ga updates or the 1 day relatime threshold causing an
    access-time update if we try to respawn qemu-ga shortly after it goes
    away)
    
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qapi-schema-guest.json b/qapi-schema-guest.json
index 0eedb98..d7a073e 100644
--- a/qapi-schema-guest.json
+++ b/qapi-schema-guest.json
@@ -309,8 +309,7 @@
 # Returns: GuestFsfreezeStatus ("thawed", "frozen", etc., as defined below)
 #
 # Note: This may fail to properly report the current state as a result of
-# qemu-ga having been restarted, or other guest processes having issued
-# an fs freeze/thaw.
+# some other guest processes having issued an fs freeze/thaw.
 #
 # Since: 0.15.0
 ##
diff --git a/qemu-ga.c b/qemu-ga.c
index ac29b73..216be39 100644
--- a/qemu-ga.c
+++ b/qemu-ga.c
@@ -18,6 +18,7 @@
 #ifndef _WIN32
 #include <syslog.h>
 #include <sys/wait.h>
+#include <sys/stat.h>
 #endif
 #include "json-streamer.h"
 #include "json-parser.h"
@@ -41,6 +42,7 @@
 #define QGA_VIRTIO_PATH_DEFAULT "\\\\.\\Global\\org.qemu.guest_agent.0"
 #endif
 #define QGA_PIDFILE_DEFAULT "/var/run/qemu-ga.pid"
+#define QGA_STATEDIR_DEFAULT "/tmp"
 #define QGA_SENTINEL_BYTE 0xFF
 
 struct GAState {
@@ -58,6 +60,11 @@ struct GAState {
     bool delimit_response;
     bool frozen;
     GList *blacklist;
+    const char *state_filepath_isfrozen;
+    struct {
+        const char *log_filepath;
+        const char *pid_filepath;
+    } deferred_options;
 };
 
 struct GAState *ga_state;
@@ -147,6 +154,8 @@ static void usage(const char *cmd)
 "                    %s)\n"
 "  -l, --logfile     set logfile path, logs to stderr by default\n"
 "  -f, --pidfile     specify pidfile (default is %s)\n"
+"  -t, --statedir    specify dir to store state information (absolute paths\n"
+"                    only, default is %s)\n"
 "  -v, --verbose     log extra debugging information\n"
 "  -V, --version     print version information and exit\n"
 "  -d, --daemonize   become a daemon\n"
@@ -158,7 +167,8 @@ static void usage(const char *cmd)
 "  -h, --help        display this help and exit\n"
 "\n"
 "Report bugs to <mdroth at linux.vnet.ibm.com>\n"
-    , cmd, QGA_VERSION, QGA_VIRTIO_PATH_DEFAULT, QGA_PIDFILE_DEFAULT);
+    , cmd, QGA_VERSION, QGA_VIRTIO_PATH_DEFAULT, QGA_PIDFILE_DEFAULT,
+    QGA_STATEDIR_DEFAULT);
 }
 
 static const char *ga_log_level_str(GLogLevelFlags level)
@@ -227,6 +237,41 @@ void ga_set_response_delimited(GAState *s)
     s->delimit_response = true;
 }
 
+#ifndef _WIN32
+static bool ga_open_pidfile(const char *pidfile)
+{
+    int pidfd;
+    char pidstr[32];
+
+    pidfd = open(pidfile, O_CREAT|O_WRONLY, S_IRUSR|S_IWUSR);
+    if (pidfd == -1 || lockf(pidfd, F_TLOCK, 0)) {
+        g_critical("Cannot lock pid file, %s", strerror(errno));
+        return false;
+    }
+
+    if (ftruncate(pidfd, 0) || lseek(pidfd, 0, SEEK_SET)) {
+        g_critical("Failed to truncate pid file");
+        goto fail;
+    }
+    sprintf(pidstr, "%d", getpid());
+    if (write(pidfd, pidstr, strlen(pidstr)) != strlen(pidstr)) {
+        g_critical("Failed to write pid file");
+        goto fail;
+    }
+
+    return true;
+
+fail:
+    unlink(pidfile);
+    return false;
+}
+#else /* _WIN32 */
+static bool ga_open_pidfile(const char *pidfile)
+{
+    return true;
+}
+#endif
+
 static gint ga_strcmp(gconstpointer str1, gconstpointer str2)
 {
     return strcmp(str1, str2);
@@ -277,6 +322,28 @@ static void ga_enable_non_blacklisted(GList *blacklist)
     g_free(list_head);
 }
 
+static bool ga_create_file(const char *path)
+{
+    int fd = open(path, O_CREAT | O_WRONLY, S_IWUSR | S_IRUSR);
+    if (fd == -1) {
+        g_warning("unable to open/create file %s: %s", path, strerror(errno));
+        return false;
+    }
+    close(fd);
+    return true;
+}
+
+static bool ga_delete_file(const char *path)
+{
+    int ret = unlink(path);
+    if (ret == -1) {
+        g_warning("unable to delete file: %s: %s", path, strerror(errno));
+        return false;
+    }
+
+    return true;
+}
+
 bool ga_is_frozen(GAState *s)
 {
     return s->frozen;
@@ -292,6 +359,10 @@ void ga_set_frozen(GAState *s)
     g_warning("disabling logging due to filesystem freeze");
     ga_disable_logging(s);
     s->frozen = true;
+    if (!ga_create_file(s->state_filepath_isfrozen)) {
+        g_warning("unable to create %s, fsfreeze may not function properly",
+                  s->state_filepath_isfrozen);
+    }
 }
 
 void ga_unset_frozen(GAState *s)
@@ -300,20 +371,38 @@ void ga_unset_frozen(GAState *s)
         return;
     }
 
+    /* if we delayed creation/opening of pid/log files due to being
+     * in a frozen state at start up, do it now
+     */
+    if (s->deferred_options.log_filepath) {
+        s->log_file = fopen(s->deferred_options.log_filepath, "a");
+        if (!s->log_file) {
+            s->log_file = stderr;
+        }
+        s->deferred_options.log_filepath = NULL;
+    }
     ga_enable_logging(s);
-    g_warning("logging re-enabled");
+    g_warning("logging re-enabled due to filesystem unfreeze");
+    if (s->deferred_options.pid_filepath) {
+        if (!ga_open_pidfile(s->deferred_options.pid_filepath)) {
+            g_warning("failed to create/open pid file");
+        }
+        s->deferred_options.pid_filepath = NULL;
+    }
 
     /* enable all disabled, non-blacklisted commands */
     ga_enable_non_blacklisted(s->blacklist);
     s->frozen = false;
+    if (!ga_delete_file(s->state_filepath_isfrozen)) {
+        g_warning("unable to delete %s, fsfreeze may not function properly",
+                  s->state_filepath_isfrozen);
+    }
 }
 
-#ifndef _WIN32
 static void become_daemon(const char *pidfile)
 {
+#ifndef _WIN32
     pid_t pid, sid;
-    int pidfd;
-    char *pidstr = NULL;
 
     pid = fork();
     if (pid < 0) {
@@ -323,20 +412,11 @@ static void become_daemon(const char *pidfile)
         exit(EXIT_SUCCESS);
     }
 
-    pidfd = open(pidfile, O_CREAT|O_WRONLY|O_EXCL, S_IRUSR|S_IWUSR);
-    if (pidfd == -1) {
-        g_critical("Cannot create pid file, %s", strerror(errno));
-        exit(EXIT_FAILURE);
-    }
-
-    if (asprintf(&pidstr, "%d", getpid()) == -1) {
-        g_critical("Cannot allocate memory");
-        goto fail;
-    }
-    if (write(pidfd, pidstr, strlen(pidstr)) != strlen(pidstr)) {
-        free(pidstr);
-        g_critical("Failed to write pid file");
-        goto fail;
+    if (pidfile) {
+        if (!ga_open_pidfile(pidfile)) {
+            g_critical("failed to create pidfile");
+            exit(EXIT_FAILURE);
+        }
     }
 
     umask(0);
@@ -351,15 +431,14 @@ static void become_daemon(const char *pidfile)
     close(STDIN_FILENO);
     close(STDOUT_FILENO);
     close(STDERR_FILENO);
-    free(pidstr);
     return;
 
 fail:
     unlink(pidfile);
     g_critical("failed to daemonize");
     exit(EXIT_FAILURE);
-}
 #endif
+}
 
 static int send_response(GAState *s, QObject *payload)
 {
@@ -597,9 +676,11 @@ VOID WINAPI service_main(DWORD argc, TCHAR *argv[])
 
 int main(int argc, char **argv)
 {
-    const char *sopt = "hVvdm:p:l:f:b:s:";
-    const char *method = NULL, *path = NULL, *pidfile = QGA_PIDFILE_DEFAULT;
-    const char *log_file_name = NULL;
+    const char *sopt = "hVvdm:p:l:f:b:s:t:";
+    const char *method = NULL, *path = NULL;
+    const char *log_filepath = NULL;
+    const char *pid_filepath = QGA_PIDFILE_DEFAULT;
+    const char *state_dir = QGA_STATEDIR_DEFAULT;
 #ifdef _WIN32
     const char *service = NULL;
 #endif
@@ -616,11 +697,11 @@ int main(int argc, char **argv)
 #ifdef _WIN32
         { "service", 1, NULL, 's' },
 #endif
+        { "statedir", 1, NULL, 't' },
         { NULL, 0, NULL, 0 }
     };
     int opt_ind = 0, ch, daemonize = 0, i, j, len;
     GLogLevelFlags log_level = G_LOG_LEVEL_ERROR | G_LOG_LEVEL_CRITICAL;
-    FILE *log_file = stderr;
     GList *blacklist = NULL;
     GAState *s;
 
@@ -635,17 +716,14 @@ int main(int argc, char **argv)
             path = optarg;
             break;
         case 'l':
-            log_file_name = optarg;
-            log_file = fopen(log_file_name, "a");
-            if (!log_file) {
-                g_critical("unable to open specified log file: %s",
-                           strerror(errno));
-                return EXIT_FAILURE;
-            }
+            log_filepath = optarg;
             break;
         case 'f':
-            pidfile = optarg;
+            pid_filepath = optarg;
             break;
+        case 't':
+             state_dir = optarg;
+             break;
         case 'v':
             /* enable all log levels */
             log_level = G_LOG_LEVEL_MASK;
@@ -684,7 +762,7 @@ int main(int argc, char **argv)
         case 's':
             service = optarg;
             if (strcmp(service, "install") == 0) {
-                return ga_install_service(path, log_file_name);
+                return ga_install_service(path, log_filepath);
             } else if (strcmp(service, "uninstall") == 0) {
                 return ga_uninstall_service();
             } else {
@@ -703,20 +781,70 @@ int main(int argc, char **argv)
         }
     }
 
-#ifndef _WIN32
-    if (daemonize) {
-        g_debug("starting daemon");
-        become_daemon(pidfile);
-    }
-#endif
-
     s = g_malloc0(sizeof(GAState));
-    s->log_file = log_file;
     s->log_level = log_level;
+    s->log_file = stderr;
     g_log_set_default_handler(ga_log, s);
     g_log_set_fatal_mask(NULL, G_LOG_LEVEL_ERROR);
-    s->logging_enabled = true;
+    ga_enable_logging(s);
+    s->state_filepath_isfrozen = g_strdup_printf("%s/qga.state.isfrozen",
+                                                 state_dir);
     s->frozen = false;
+#ifndef _WIN32
+    /* check if a previous instance of qemu-ga exited with filesystems' state
+     * marked as frozen. this could be a stale value (a non-qemu-ga process
+     * or reboot may have since unfrozen them), but better to require an
+     * uneeded unfreeze than to risk hanging on start-up
+     */
+    struct stat st;
+    if (stat(s->state_filepath_isfrozen, &st) == -1) {
+        /* it's okay if the file doesn't exist, but if we can't access for
+         * some other reason, such as permissions, there's a configuration
+         * that needs to be addressed. so just bail now before we get into
+         * more trouble later
+         */
+        if (errno != ENOENT) {
+            g_critical("unable to access state file at path %s: %s",
+                       s->state_filepath_isfrozen, strerror(errno));
+            return EXIT_FAILURE;
+        }
+    } else {
+        g_warning("previous instance appears to have exited with frozen"
+                  " filesystems. deferring logging/pidfile creation and"
+                  " disabling non-fsfreeze-safe commands until"
+                  " guest-fsfreeze-thaw is issued, or filesystems are"
+                  " manually unfrozen and the file %s is removed",
+                  s->state_filepath_isfrozen);
+        s->frozen = true;
+    }
+#endif
+
+    if (ga_is_frozen(s)) {
+        if (daemonize) {
+            /* delay opening/locking of pidfile till filesystem are unfrozen */
+            s->deferred_options.pid_filepath = pid_filepath;
+            become_daemon(NULL);
+        }
+        if (log_filepath) {
+            /* delay opening the log file till filesystems are unfrozen */
+            s->deferred_options.log_filepath = log_filepath;
+        }
+        ga_disable_logging(s);
+        ga_disable_non_whitelisted();
+    } else {
+        if (daemonize) {
+            become_daemon(pid_filepath);
+        }
+        if (log_filepath) {
+            s->log_file = fopen(log_filepath, "a");
+            if (!s->log_file) {
+                g_critical("unable to open specified log file: %s",
+                           strerror(errno));
+                goto out_bad;
+            }
+        }
+    }
+
     if (blacklist) {
         s->blacklist = blacklist;
         do {
@@ -758,13 +886,13 @@ int main(int argc, char **argv)
     ga_channel_free(ga_state->channel);
 
     if (daemonize) {
-        unlink(pidfile);
+        unlink(pid_filepath);
     }
     return 0;
 
 out_bad:
     if (daemonize) {
-        unlink(pidfile);
+        unlink(pid_filepath);
     }
     return EXIT_FAILURE;
 }
commit f22d85e9e67262db34504f4079745f9843da6a92
Author: Michael Roth <mdroth at linux.vnet.ibm.com>
Date:   Tue Apr 17 19:01:45 2012 -0500

    qemu-ga: add a whitelist for fsfreeze-safe commands
    
    Currently we rely on fsfreeze/thaw commands disabling/enabling logging
    then having other commands check whether logging is disabled to avoid
    executing if they aren't safe for running while a filesystem is frozen.
    
    Instead, have an explicit whitelist of fsfreeze-safe commands, and
    consolidate logging and command enablement/disablement into a pair
    of helper functions: ga_set_frozen()/ga_unset_frozen()
    
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qapi/qmp-core.h b/qapi/qmp-core.h
index 3bb3acb..431ddbb 100644
--- a/qapi/qmp-core.h
+++ b/qapi/qmp-core.h
@@ -38,6 +38,7 @@ void qmp_register_command(const char *name, QmpCommandFunc *fn);
 QmpCommand *qmp_find_command(const char *name);
 QObject *qmp_dispatch(QObject *request);
 void qmp_disable_command(const char *name);
+void qmp_enable_command(const char *name);
 bool qmp_command_is_enabled(const char *name);
 char **qmp_get_command_list(void);
 
diff --git a/qapi/qmp-registry.c b/qapi/qmp-registry.c
index 25c89ad..43d5cde 100644
--- a/qapi/qmp-registry.c
+++ b/qapi/qmp-registry.c
@@ -40,18 +40,28 @@ QmpCommand *qmp_find_command(const char *name)
     return NULL;
 }
 
-void qmp_disable_command(const char *name)
+static void qmp_toggle_command(const char *name, bool enabled)
 {
     QmpCommand *cmd;
 
     QTAILQ_FOREACH(cmd, &qmp_commands, node) {
         if (strcmp(cmd->name, name) == 0) {
-            cmd->enabled = false;
+            cmd->enabled = enabled;
             return;
         }
     }
 }
 
+void qmp_disable_command(const char *name)
+{
+    qmp_toggle_command(name, false);
+}
+
+void qmp_enable_command(const char *name)
+{
+    qmp_toggle_command(name, true);
+}
+
 bool qmp_command_is_enabled(const char *name)
 {
     QmpCommand *cmd;
diff --git a/qemu-ga.c b/qemu-ga.c
index 74a1b02..ac29b73 100644
--- a/qemu-ga.c
+++ b/qemu-ga.c
@@ -56,10 +56,22 @@ struct GAState {
     GAService service;
 #endif
     bool delimit_response;
+    bool frozen;
+    GList *blacklist;
 };
 
 struct GAState *ga_state;
 
+/* commands that are safe to issue while filesystems are frozen */
+static const char *ga_freeze_whitelist[] = {
+    "guest-ping",
+    "guest-info",
+    "guest-sync",
+    "guest-fsfreeze-status",
+    "guest-fsfreeze-thaw",
+    NULL
+};
+
 #ifdef _WIN32
 DWORD WINAPI service_ctrl_handler(DWORD ctrl, DWORD type, LPVOID data,
                                   LPVOID ctx);
@@ -68,6 +80,15 @@ VOID WINAPI service_main(DWORD argc, TCHAR *argv[]);
 
 static void quit_handler(int sig)
 {
+    /* if we're frozen, don't exit unless we're absolutely forced to,
+     * because it's basically impossible for graceful exit to complete
+     * unless all log/pid files are on unfreezable filesystems. there's
+     * also a very likely chance killing the agent before unfreezing
+     * the filesystems is a mistake (or will be viewed as one later).
+     */
+    if (ga_is_frozen(ga_state)) {
+        return;
+    }
     g_debug("received signal num %d, quitting", sig);
 
     if (g_main_loop_is_running(ga_state->main_loop)) {
@@ -206,6 +227,87 @@ void ga_set_response_delimited(GAState *s)
     s->delimit_response = true;
 }
 
+static gint ga_strcmp(gconstpointer str1, gconstpointer str2)
+{
+    return strcmp(str1, str2);
+}
+
+/* disable commands that aren't safe for fsfreeze */
+static void ga_disable_non_whitelisted(void)
+{
+    char **list_head, **list;
+    bool whitelisted;
+    int i;
+
+    list_head = list = qmp_get_command_list();
+    while (*list != NULL) {
+        whitelisted = false;
+        i = 0;
+        while (ga_freeze_whitelist[i] != NULL) {
+            if (strcmp(*list, ga_freeze_whitelist[i]) == 0) {
+                whitelisted = true;
+            }
+            i++;
+        }
+        if (!whitelisted) {
+            g_debug("disabling command: %s", *list);
+            qmp_disable_command(*list);
+        }
+        g_free(*list);
+        list++;
+    }
+    g_free(list_head);
+}
+
+/* [re-]enable all commands, except those explictly blacklisted by user */
+static void ga_enable_non_blacklisted(GList *blacklist)
+{
+    char **list_head, **list;
+
+    list_head = list = qmp_get_command_list();
+    while (*list != NULL) {
+        if (g_list_find_custom(blacklist, *list, ga_strcmp) == NULL &&
+            !qmp_command_is_enabled(*list)) {
+            g_debug("enabling command: %s", *list);
+            qmp_enable_command(*list);
+        }
+        g_free(*list);
+        list++;
+    }
+    g_free(list_head);
+}
+
+bool ga_is_frozen(GAState *s)
+{
+    return s->frozen;
+}
+
+void ga_set_frozen(GAState *s)
+{
+    if (ga_is_frozen(s)) {
+        return;
+    }
+    /* disable all non-whitelisted (for frozen state) commands */
+    ga_disable_non_whitelisted();
+    g_warning("disabling logging due to filesystem freeze");
+    ga_disable_logging(s);
+    s->frozen = true;
+}
+
+void ga_unset_frozen(GAState *s)
+{
+    if (!ga_is_frozen(s)) {
+        return;
+    }
+
+    ga_enable_logging(s);
+    g_warning("logging re-enabled");
+
+    /* enable all disabled, non-blacklisted commands */
+    ga_enable_non_blacklisted(s->blacklist);
+    s->frozen = false;
+}
+
 #ifndef _WIN32
 static void become_daemon(const char *pidfile)
 {
@@ -513,12 +615,13 @@ int main(int argc, char **argv)
         { "blacklist", 1, NULL, 'b' },
 #ifdef _WIN32
         { "service", 1, NULL, 's' },
-#endif        
+#endif
         { NULL, 0, NULL, 0 }
     };
     int opt_ind = 0, ch, daemonize = 0, i, j, len;
     GLogLevelFlags log_level = G_LOG_LEVEL_ERROR | G_LOG_LEVEL_CRITICAL;
     FILE *log_file = stderr;
+    GList *blacklist = NULL;
     GAState *s;
 
     module_call_init(MODULE_INIT_QAPI);
@@ -568,14 +671,12 @@ int main(int argc, char **argv)
             for (j = 0, i = 0, len = strlen(optarg); i < len; i++) {
                 if (optarg[i] == ',') {
                     optarg[i] = 0;
-                    qmp_disable_command(&optarg[j]);
-                    g_debug("disabling command: %s", &optarg[j]);
+                    blacklist = g_list_append(blacklist, &optarg[j]);
                     j = i + 1;
                 }
             }
             if (j < i) {
-                qmp_disable_command(&optarg[j]);
-                g_debug("disabling command: %s", &optarg[j]);
+                blacklist = g_list_append(blacklist, &optarg[j]);
             }
             break;
         }
@@ -615,6 +716,15 @@ int main(int argc, char **argv)
     g_log_set_default_handler(ga_log, s);
     g_log_set_fatal_mask(NULL, G_LOG_LEVEL_ERROR);
     s->logging_enabled = true;
+    s->frozen = false;
+    if (blacklist) {
+        s->blacklist = blacklist;
+        do {
+            g_debug("disabling command: %s", (char *)blacklist->data);
+            qmp_disable_command(blacklist->data);
+            blacklist = g_list_next(blacklist);
+        } while (blacklist);
+    }
     s->command_state = ga_command_state_new();
     ga_command_state_init(s, s->command_state);
     ga_command_state_init_all(s->command_state);
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 869d6ee..d58730a 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -316,16 +316,6 @@ static void guest_file_init(void)
 
 #if defined(CONFIG_FSFREEZE)
 
-static void disable_logging(void)
-{
-    ga_disable_logging(ga_state);
-}
-
-static void enable_logging(void)
-{
-    ga_enable_logging(ga_state);
-}
-
 typedef struct GuestFsfreezeMount {
     char *dirname;
     char *devtype;
@@ -334,10 +324,6 @@ typedef struct GuestFsfreezeMount {
 
 typedef QTAILQ_HEAD(, GuestFsfreezeMount) GuestFsfreezeMountList;
 
-struct {
-    GuestFsfreezeStatus status;
-} guest_fsfreeze_state;
-
 static void guest_fsfreeze_free_mount_list(GuestFsfreezeMountList *mounts)
 {
      GuestFsfreezeMount *mount, *temp;
@@ -400,7 +386,11 @@ static int guest_fsfreeze_build_mount_list(GuestFsfreezeMountList *mounts)
  */
 GuestFsfreezeStatus qmp_guest_fsfreeze_status(Error **err)
 {
-    return guest_fsfreeze_state.status;
+    if (ga_is_frozen(ga_state)) {
+        return GUEST_FSFREEZE_STATUS_FROZEN;
+    }
+
+    return GUEST_FSFREEZE_STATUS_THAWED;
 }
 
 /*
@@ -424,7 +414,7 @@ int64_t qmp_guest_fsfreeze_freeze(Error **err)
     }
 
     /* cannot risk guest agent blocking itself on a write in this state */
-    disable_logging();
+    ga_set_frozen(ga_state);
 
     QTAILQ_FOREACH(mount, &mounts, next) {
         fd = qemu_open(mount->dirname, O_RDONLY);
@@ -459,7 +449,6 @@ int64_t qmp_guest_fsfreeze_freeze(Error **err)
         close(fd);
     }
 
-    guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_FROZEN;
     guest_fsfreeze_free_mount_list(&mounts);
     return i;
 
@@ -519,23 +508,17 @@ int64_t qmp_guest_fsfreeze_thaw(Error **err)
         close(fd);
     }
 
-    guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;
-    enable_logging();
+    ga_unset_frozen(ga_state);
     guest_fsfreeze_free_mount_list(&mounts);
     return i;
 }
 
-static void guest_fsfreeze_init(void)
-{
-    guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;
-}
-
 static void guest_fsfreeze_cleanup(void)
 {
     int64_t ret;
     Error *err = NULL;
 
-    if (guest_fsfreeze_state.status == GUEST_FSFREEZE_STATUS_FROZEN) {
+    if (ga_is_frozen(ga_state) == GUEST_FSFREEZE_STATUS_FROZEN) {
         ret = qmp_guest_fsfreeze_thaw(&err);
         if (ret < 0 || err) {
             slog("failed to clean up frozen filesystems");
@@ -964,7 +947,7 @@ int64_t qmp_guest_fsfreeze_thaw(Error **err)
 void ga_command_state_init(GAState *s, GACommandState *cs)
 {
 #if defined(CONFIG_FSFREEZE)
-    ga_command_state_add(cs, guest_fsfreeze_init, guest_fsfreeze_cleanup);
+    ga_command_state_add(cs, NULL, guest_fsfreeze_cleanup);
 #endif
     ga_command_state_add(cs, guest_file_init, NULL);
 }
diff --git a/qga/guest-agent-core.h b/qga/guest-agent-core.h
index 304525d..bbb8b9b 100644
--- a/qga/guest-agent-core.h
+++ b/qga/guest-agent-core.h
@@ -32,3 +32,6 @@ void ga_disable_logging(GAState *s);
 void ga_enable_logging(GAState *s);
 void slog(const gchar *fmt, ...);
 void ga_set_response_delimited(GAState *s);
+bool ga_is_frozen(GAState *s);
+void ga_set_frozen(GAState *s);
+void ga_unset_frozen(GAState *s);
commit 9e8aded432884477bcd4fa1c7e849a196412bcc4
Author: Michael Roth <mdroth at linux.vnet.ibm.com>
Date:   Mon Apr 16 19:52:17 2012 -0500

    qemu-ga: improve recovery options for fsfreeze
    
    guest-fsfreeze-thaw relies on state information obtained from
    guest-fsfreeze-freeze to determine what filesystems to unfreeze.
    This is unreliable due to the fact that that state does not account
    for FIFREEZE being issued by other processes, or previous instances
    of qemu-ga. This means in certain situations we cannot thaw
    filesystems even with a responsive qemu-ga instance at our disposal.
    
    This patch allows guest-fsfreeze-thaw to be issued unconditionally.
    It also adds some additional logic to allow us to thaw filesystems
    regardless of how many times the filesystem's "frozen" refcount has
    been incremented by any guest processes.
    
    Also, guest-fsfreeze-freeze now operates atomically: on success all
    freezable filesystems are frozen, and on error all filesystems are
    thawed. The ambiguous "GUEST_FSFREEZE_STATUS_ERROR" state is no
    longer entered.
    
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qapi-schema-guest.json b/qapi-schema-guest.json
index cf18876..0eedb98 100644
--- a/qapi-schema-guest.json
+++ b/qapi-schema-guest.json
@@ -296,14 +296,10 @@
 #
 # @frozen: all non-network guest filesystems frozen
 #
-# @error: failure to thaw 1 or more
-#         previously frozen filesystems, or failure to open a previously
-#         cached filesytem (filesystem unmounted/directory changes, etc).
-#
 # Since: 0.15.0
 ##
 { 'enum': 'GuestFsfreezeStatus',
-  'data': [ 'thawed', 'frozen', 'error' ] }
+  'data': [ 'thawed', 'frozen' ] }
 
 ##
 # @guest-fsfreeze-status:
@@ -312,6 +308,10 @@
 #
 # Returns: GuestFsfreezeStatus ("thawed", "frozen", etc., as defined below)
 #
+# Note: This may fail to properly report the current state as a result of
+# qemu-ga having been restarted, or other guest processes having issued
+# an fs freeze/thaw.
+#
 # Since: 0.15.0
 ##
 { 'command': 'guest-fsfreeze-status',
@@ -320,9 +320,10 @@
 ##
 # @guest-fsfreeze-freeze:
 #
-# Sync and freeze all non-network guest filesystems
+# Sync and freeze all freezable, local guest filesystems
 #
-# Returns: Number of file systems frozen on success
+# Returns: Number of file systems currently frozen. On error, all filesystems
+# will be thawed.
 #
 # Since: 0.15.0
 ##
@@ -332,10 +333,15 @@
 ##
 # @guest-fsfreeze-thaw:
 #
-# Unfreeze frozen guest fileystems
+# Unfreeze all frozen guest filesystems
+#
+# Returns: Number of file systems thawed by this call
 #
-# Returns: Number of file systems thawed
-#          If error, -1 (unknown error) or -errno
+# Note: if return value does not match the previous call to
+#       guest-fsfreeze-freeze, this likely means some freezable
+#       filesystems were unfrozen before this call, and that the
+#       filesystem state may have changed before issuing this
+#       command.
 #
 # Since: 0.15.0
 ##
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 087c3af..869d6ee 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -332,28 +332,38 @@ typedef struct GuestFsfreezeMount {
     QTAILQ_ENTRY(GuestFsfreezeMount) next;
 } GuestFsfreezeMount;
 
+typedef QTAILQ_HEAD(, GuestFsfreezeMount) GuestFsfreezeMountList;
+
 struct {
     GuestFsfreezeStatus status;
-    QTAILQ_HEAD(, GuestFsfreezeMount) mount_list;
 } guest_fsfreeze_state;
 
+static void guest_fsfreeze_free_mount_list(GuestFsfreezeMountList *mounts)
+{
+     GuestFsfreezeMount *mount, *temp;
+
+     if (!mounts) {
+         return;
+     }
+
+     QTAILQ_FOREACH_SAFE(mount, mounts, next, temp) {
+         QTAILQ_REMOVE(mounts, mount, next);
+         g_free(mount->dirname);
+         g_free(mount->devtype);
+         g_free(mount);
+     }
+}
+
 /*
  * Walk the mount table and build a list of local file systems
  */
-static int guest_fsfreeze_build_mount_list(void)
+static int guest_fsfreeze_build_mount_list(GuestFsfreezeMountList *mounts)
 {
     struct mntent *ment;
-    GuestFsfreezeMount *mount, *temp;
+    GuestFsfreezeMount *mount;
     char const *mtab = MOUNTED;
     FILE *fp;
 
-    QTAILQ_FOREACH_SAFE(mount, &guest_fsfreeze_state.mount_list, next, temp) {
-        QTAILQ_REMOVE(&guest_fsfreeze_state.mount_list, mount, next);
-        g_free(mount->dirname);
-        g_free(mount->devtype);
-        g_free(mount);
-    }
-
     fp = setmntent(mtab, "r");
     if (!fp) {
         g_warning("fsfreeze: unable to read mtab");
@@ -377,7 +387,7 @@ static int guest_fsfreeze_build_mount_list(void)
         mount->dirname = g_strdup(ment->mnt_dir);
         mount->devtype = g_strdup(ment->mnt_type);
 
-        QTAILQ_INSERT_TAIL(&guest_fsfreeze_state.mount_list, mount, next);
+        QTAILQ_INSERT_TAIL(mounts, mount, next);
     }
 
     endmntent(fp);
@@ -400,17 +410,15 @@ GuestFsfreezeStatus qmp_guest_fsfreeze_status(Error **err)
 int64_t qmp_guest_fsfreeze_freeze(Error **err)
 {
     int ret = 0, i = 0;
-    struct GuestFsfreezeMount *mount, *temp;
+    GuestFsfreezeMountList mounts;
+    struct GuestFsfreezeMount *mount;
     int fd;
     char err_msg[512];
 
     slog("guest-fsfreeze called");
 
-    if (guest_fsfreeze_state.status == GUEST_FSFREEZE_STATUS_FROZEN) {
-        return 0;
-    }
-
-    ret = guest_fsfreeze_build_mount_list();
+    QTAILQ_INIT(&mounts);
+    ret = guest_fsfreeze_build_mount_list(&mounts);
     if (ret < 0) {
         return ret;
     }
@@ -418,43 +426,46 @@ int64_t qmp_guest_fsfreeze_freeze(Error **err)
     /* cannot risk guest agent blocking itself on a write in this state */
     disable_logging();
 
-    QTAILQ_FOREACH_SAFE(mount, &guest_fsfreeze_state.mount_list, next, temp) {
+    QTAILQ_FOREACH(mount, &mounts, next) {
         fd = qemu_open(mount->dirname, O_RDONLY);
         if (fd == -1) {
-            sprintf(err_msg, "failed to open %s, %s", mount->dirname, strerror(errno));
+            sprintf(err_msg, "failed to open %s, %s", mount->dirname,
+                    strerror(errno));
             error_set(err, QERR_QGA_COMMAND_FAILED, err_msg);
             goto error;
         }
 
         /* we try to cull filesytems we know won't work in advance, but other
          * filesytems may not implement fsfreeze for less obvious reasons.
-         * these will report EOPNOTSUPP, so we simply ignore them. when
-         * thawing, these filesystems will return an EINVAL instead, due to
-         * not being in a frozen state. Other filesystem-specific
-         * errors may result in EINVAL, however, so the user should check the
-         * number * of filesystems returned here against those returned by the
-         * thaw operation to determine whether everything completed
-         * successfully
+         * these will report EOPNOTSUPP. we simply ignore these when tallying
+         * the number of frozen filesystems.
+         *
+         * any other error means a failure to freeze a filesystem we
+         * expect to be freezable, so return an error in those cases
+         * and return system to thawed state.
          */
         ret = ioctl(fd, FIFREEZE);
-        if (ret < 0 && errno != EOPNOTSUPP) {
-            sprintf(err_msg, "failed to freeze %s, %s", mount->dirname, strerror(errno));
-            error_set(err, QERR_QGA_COMMAND_FAILED, err_msg);
-            close(fd);
-            goto error;
+        if (ret == -1) {
+            if (errno != EOPNOTSUPP) {
+                sprintf(err_msg, "failed to freeze %s, %s",
+                        mount->dirname, strerror(errno));
+                error_set(err, QERR_QGA_COMMAND_FAILED, err_msg);
+                close(fd);
+                goto error;
+            }
+        } else {
+            i++;
         }
         close(fd);
-
-        i++;
     }
 
     guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_FROZEN;
+    guest_fsfreeze_free_mount_list(&mounts);
     return i;
 
 error:
-    if (i > 0) {
-        qmp_guest_fsfreeze_thaw(NULL);
-    }
+    guest_fsfreeze_free_mount_list(&mounts);
+    qmp_guest_fsfreeze_thaw(NULL);
     return 0;
 }
 
@@ -464,39 +475,59 @@ error:
 int64_t qmp_guest_fsfreeze_thaw(Error **err)
 {
     int ret;
-    GuestFsfreezeMount *mount, *temp;
-    int fd, i = 0;
-    bool has_error = false;
+    GuestFsfreezeMountList mounts;
+    GuestFsfreezeMount *mount;
+    int fd, i = 0, logged;
+
+    QTAILQ_INIT(&mounts);
+    ret = guest_fsfreeze_build_mount_list(&mounts);
+    if (ret) {
+        error_set(err, QERR_QGA_COMMAND_FAILED,
+                  "failed to enumerate filesystems");
+        return 0;
+    }
 
-    QTAILQ_FOREACH_SAFE(mount, &guest_fsfreeze_state.mount_list, next, temp) {
+    QTAILQ_FOREACH(mount, &mounts, next) {
+        logged = false;
         fd = qemu_open(mount->dirname, O_RDONLY);
         if (fd == -1) {
-            has_error = true;
-            continue;
-        }
-        ret = ioctl(fd, FITHAW);
-        if (ret < 0 && errno != EOPNOTSUPP && errno != EINVAL) {
-            has_error = true;
-            close(fd);
             continue;
         }
+        /* we have no way of knowing whether a filesystem was actually unfrozen
+         * as a result of a successful call to FITHAW, only that if an error
+         * was returned the filesystem was *not* unfrozen by that particular
+         * call.
+         *
+         * since multiple preceeding FIFREEZEs require multiple calls to FITHAW
+         * to unfreeze, continuing issuing FITHAW until an error is returned,
+         * in which case either the filesystem is in an unfreezable state, or,
+         * more likely, it was thawed previously (and remains so afterward).
+         *
+         * also, since the most recent successful call is the one that did
+         * the actual unfreeze, we can use this to provide an accurate count
+         * of the number of filesystems unfrozen by guest-fsfreeze-thaw, which
+         * may * be useful for determining whether a filesystem was unfrozen
+         * during the freeze/thaw phase by a process other than qemu-ga.
+         */
+        do {
+            ret = ioctl(fd, FITHAW);
+            if (ret == 0 && !logged) {
+                i++;
+                logged = true;
+            }
+        } while (ret == 0);
         close(fd);
-        i++;
     }
 
-    if (has_error) {
-        guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_ERROR;
-    } else {
-        guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;
-    }
+    guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;
     enable_logging();
+    guest_fsfreeze_free_mount_list(&mounts);
     return i;
 }
 
 static void guest_fsfreeze_init(void)
 {
     guest_fsfreeze_state.status = GUEST_FSFREEZE_STATUS_THAWED;
-    QTAILQ_INIT(&guest_fsfreeze_state.mount_list);
 }
 
 static void guest_fsfreeze_cleanup(void)
commit 894a84e632e4e71eaa3588d7ca9854bf4d9027ea
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Feb 20 06:28:33 2012 +0100

    Makefile: Simplify compilation of target-*/cpu.c
    
    All targets except for ppc now have a standalone cpu.c file.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/Makefile.target b/Makefile.target
index f7b2e71..364aea2 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -87,32 +87,18 @@ libobj-y += op_helper.o
 endif
 endif
 libobj-y += helper.o
-ifeq ($(TARGET_BASE_ARCH), i386)
+ifneq ($(TARGET_BASE_ARCH), ppc)
 libobj-y += cpu.o
 endif
 libobj-$(TARGET_SPARC64) += vis_helper.o
 libobj-$(CONFIG_NEED_MMU) += mmu.o
 libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
-libobj-$(TARGET_ARM) += cpu.o
-libobj-$(TARGET_CRIS) += cpu.o
-libobj-$(TARGET_LM32) += cpu.o
-libobj-$(TARGET_M68K) += cpu.o
-libobj-$(TARGET_MICROBLAZE) += cpu.o
-ifeq ($(TARGET_BASE_ARCH), mips)
-libobj-y += cpu.o
-endif
-libobj-$(TARGET_S390X) += cpu.o
-libobj-$(TARGET_SH4) += cpu.o
 ifeq ($(TARGET_BASE_ARCH), sparc)
 libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
-libobj-y += cpu.o
 endif
 libobj-$(TARGET_SPARC) += int32_helper.o
 libobj-$(TARGET_SPARC64) += int64_helper.o
-libobj-$(TARGET_UNICORE32) += cpu.o
-libobj-$(TARGET_XTENSA) += cpu.o
 libobj-$(TARGET_ALPHA) += int_helper.o fpu_helper.o sys_helper.o mem_helper.o
-libobj-$(TARGET_ALPHA) += cpu.o
 
 libobj-y += disas.o
 libobj-$(CONFIG_TCI_DIS) += tci-dis.o
commit 5b0c40f7460a017d0322d942a6abda9e8815676b
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Apr 16 02:37:56 2012 +0200

    target-mips: Start QOM'ifying CPU init
    
    Move code not dependent on mips_def_t from cpu_mips_init() into a
    QOM initfn, as a start.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Richard Henderson <rth at twiddle.net>

diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index d573ec8..0044062 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -34,6 +34,14 @@ static void mips_cpu_reset(CPUState *s)
     cpu_state_reset(env);
 }
 
+static void mips_cpu_initfn(Object *obj)
+{
+    MIPSCPU *cpu = MIPS_CPU(obj);
+    CPUMIPSState *env = &cpu->env;
+
+    cpu_exec_init(env);
+}
+
 static void mips_cpu_class_init(ObjectClass *c, void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
@@ -47,6 +55,7 @@ static const TypeInfo mips_cpu_type_info = {
     .name = TYPE_MIPS_CPU,
     .parent = TYPE_CPU,
     .instance_size = sizeof(MIPSCPU),
+    .instance_init = mips_cpu_initfn,
     .abstract = false,
     .class_size = sizeof(MIPSCPUClass),
     .class_init = mips_cpu_class_init,
diff --git a/target-mips/translate.c b/target-mips/translate.c
index b10ec21..f5297b0 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -12703,7 +12703,6 @@ CPUMIPSState *cpu_mips_init (const char *cpu_model)
     env->cpu_model = def;
     env->cpu_model_str = cpu_model;
 
-    cpu_exec_init(env);
 #ifndef CONFIG_USER_ONLY
     mmu_init(env, def);
 #endif
commit 0f71a7095db6bc055bc5bb520d85ea650cca8a33
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Apr 15 23:29:19 2012 +0200

    target-mips: QOM'ify CPU
    
    Embed CPUMIPSState as first member of QOM MIPSCPU.
    
    Let CPUClass::reset() call cpu_state_reset() for now.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Richard Henderson <rth at twiddle.net>

diff --git a/Makefile.target b/Makefile.target
index e735064..f7b2e71 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -98,6 +98,9 @@ libobj-$(TARGET_CRIS) += cpu.o
 libobj-$(TARGET_LM32) += cpu.o
 libobj-$(TARGET_M68K) += cpu.o
 libobj-$(TARGET_MICROBLAZE) += cpu.o
+ifeq ($(TARGET_BASE_ARCH), mips)
+libobj-y += cpu.o
+endif
 libobj-$(TARGET_S390X) += cpu.o
 libobj-$(TARGET_SH4) += cpu.o
 ifeq ($(TARGET_BASE_ARCH), sparc)
diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
new file mode 100644
index 0000000..6e22371
--- /dev/null
+++ b/target-mips/cpu-qom.h
@@ -0,0 +1,74 @@
+/*
+ * QEMU MIPS CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+#ifndef QEMU_MIPS_CPU_QOM_H
+#define QEMU_MIPS_CPU_QOM_H
+
+#include "qemu/cpu.h"
+
+#ifdef TARGET_MIPS64
+#define TYPE_MIPS_CPU "mips64-cpu"
+#else
+#define TYPE_MIPS_CPU "mips-cpu"
+#endif
+
+#define MIPS_CPU_CLASS(klass) \
+    OBJECT_CLASS_CHECK(MIPSCPUClass, (klass), TYPE_MIPS_CPU)
+#define MIPS_CPU(obj) \
+    OBJECT_CHECK(MIPSCPU, (obj), TYPE_MIPS_CPU)
+#define MIPS_CPU_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(MIPSCPUClass, (obj), TYPE_MIPS_CPU)
+
+/**
+ * MIPSCPUClass:
+ * @parent_reset: The parent class' reset handler.
+ *
+ * A MIPS CPU model.
+ */
+typedef struct MIPSCPUClass {
+    /*< private >*/
+    CPUClass parent_class;
+    /*< public >*/
+
+    void (*parent_reset)(CPUState *cpu);
+} MIPSCPUClass;
+
+/**
+ * MIPSCPU:
+ * @env: #CPUMIPSState
+ *
+ * A MIPS CPU.
+ */
+typedef struct MIPSCPU {
+    /*< private >*/
+    CPUState parent_obj;
+    /*< public >*/
+
+    CPUMIPSState env;
+} MIPSCPU;
+
+static inline MIPSCPU *mips_env_get_cpu(CPUMIPSState *env)
+{
+    return MIPS_CPU(container_of(env, MIPSCPU, env));
+}
+
+#define ENV_GET_CPU(e) CPU(mips_env_get_cpu(e))
+
+
+#endif
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
new file mode 100644
index 0000000..d573ec8
--- /dev/null
+++ b/target-mips/cpu.c
@@ -0,0 +1,60 @@
+/*
+ * QEMU MIPS CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+
+#include "cpu.h"
+#include "qemu-common.h"
+
+
+/* CPUClass::reset() */
+static void mips_cpu_reset(CPUState *s)
+{
+    MIPSCPU *cpu = MIPS_CPU(s);
+    MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(cpu);
+    CPUMIPSState *env = &cpu->env;
+
+    mcc->parent_reset(s);
+
+    cpu_state_reset(env);
+}
+
+static void mips_cpu_class_init(ObjectClass *c, void *data)
+{
+    MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
+    CPUClass *cc = CPU_CLASS(c);
+
+    mcc->parent_reset = cc->reset;
+    cc->reset = mips_cpu_reset;
+}
+
+static const TypeInfo mips_cpu_type_info = {
+    .name = TYPE_MIPS_CPU,
+    .parent = TYPE_CPU,
+    .instance_size = sizeof(MIPSCPU),
+    .abstract = false,
+    .class_size = sizeof(MIPSCPUClass),
+    .class_init = mips_cpu_class_init,
+};
+
+static void mips_cpu_register_types(void)
+{
+    type_register_static(&mips_cpu_type_info);
+}
+
+type_init(mips_cpu_register_types)
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 257c4c4..99b416c 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -483,6 +483,8 @@ struct CPUMIPSState {
     struct QEMUTimer *timer; /* Internal timer */
 };
 
+#include "cpu-qom.h"
+
 #if !defined(CONFIG_USER_ONLY)
 int no_mmu_map_address (CPUMIPSState *env, target_phys_addr_t *physical, int *prot,
                         target_ulong address, int rw, int access_type);
diff --git a/target-mips/translate.c b/target-mips/translate.c
index a663b74..b10ec21 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -12691,13 +12691,15 @@ static void mips_tcg_init(void)
 
 CPUMIPSState *cpu_mips_init (const char *cpu_model)
 {
+    MIPSCPU *cpu;
     CPUMIPSState *env;
     const mips_def_t *def;
 
     def = cpu_mips_find_by_name(cpu_model);
     if (!def)
         return NULL;
-    env = g_malloc0(sizeof(CPUMIPSState));
+    cpu = MIPS_CPU(object_new(TYPE_MIPS_CPU));
+    env = &cpu->env;
     env->cpu_model = def;
     env->cpu_model_str = cpu_model;
 
commit 11150915fcfc44aaf35c807eaa16599eabc9e718
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Apr 15 03:30:10 2012 +0200

    target-m68k: Add QOM CPU subclasses
    
    Move code from cpu_m68k_set_model() into model-specific initfns
    and inline the remaining parts into cpu_m68k_init().
    
    Let m68k_cpu_list() print CPU classes alphabetically except for "any".
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Laurent Vivier <Laurent at Vivier.EU>
    Tested-by: Laurent Vivier <Laurent at Vivier.EU>

diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 0bb1b2c..3e70bb0 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -22,6 +22,11 @@
 #include "qemu-common.h"
 
 
+static void m68k_set_feature(CPUM68KState *env, int feature)
+{
+    env->features |= (1u << feature);
+}
+
 /* CPUClass::reset() */
 static void m68k_cpu_reset(CPUState *s)
 {
@@ -48,6 +53,72 @@ static void m68k_cpu_reset(CPUState *s)
     tlb_flush(env, 1);
 }
 
+/* CPU models */
+
+static void m5206_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+}
+
+static void m5208_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+}
+
+static void cfv4e_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_FPU);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+}
+
+static void any_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
+    m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
+    m68k_set_feature(env, M68K_FEATURE_BRAL);
+    m68k_set_feature(env, M68K_FEATURE_CF_FPU);
+    /* MAC and EMAC are mututally exclusive, so pick EMAC.
+       It's mostly backwards compatible.  */
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
+    m68k_set_feature(env, M68K_FEATURE_CF_EMAC_B);
+    m68k_set_feature(env, M68K_FEATURE_USP);
+    m68k_set_feature(env, M68K_FEATURE_EXT_FULL);
+    m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
+}
+
+typedef struct M68kCPUInfo {
+    const char *name;
+    void (*instance_init)(Object *obj);
+} M68kCPUInfo;
+
+static const M68kCPUInfo m68k_cpus[] = {
+    { .name = "m5206", .instance_init = m5206_cpu_initfn },
+    { .name = "m5208", .instance_init = m5208_cpu_initfn },
+    { .name = "cfv4e", .instance_init = cfv4e_cpu_initfn },
+    { .name = "any",   .instance_init = any_cpu_initfn },
+};
+
 static void m68k_cpu_initfn(Object *obj)
 {
     M68kCPU *cpu = M68K_CPU(obj);
@@ -65,19 +136,35 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     cc->reset = m68k_cpu_reset;
 }
 
+static void register_cpu_type(const M68kCPUInfo *info)
+{
+    TypeInfo type_info = {
+        .name = info->name,
+        .parent = TYPE_M68K_CPU,
+        .instance_init = info->instance_init,
+    };
+
+    type_register_static(&type_info);
+}
+
 static const TypeInfo m68k_cpu_type_info = {
     .name = TYPE_M68K_CPU,
     .parent = TYPE_CPU,
     .instance_size = sizeof(M68kCPU),
     .instance_init = m68k_cpu_initfn,
-    .abstract = false,
+    .abstract = true,
     .class_size = sizeof(M68kCPUClass),
     .class_init = m68k_cpu_class_init,
 };
 
 static void m68k_cpu_register_types(void)
 {
+    int i;
+
     type_register_static(&m68k_cpu_type_info);
+    for (i = 0; i < ARRAY_SIZE(m68k_cpus); i++) {
+        register_cpu_type(&m68k_cpus[i]);
+    }
 }
 
 type_init(m68k_cpu_register_types)
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index e850d53..f428375 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -25,35 +25,50 @@
 
 #define SIGNBIT (1u << 31)
 
-enum m68k_cpuid {
-    M68K_CPUID_M5206,
-    M68K_CPUID_M5208,
-    M68K_CPUID_CFV4E,
-    M68K_CPUID_ANY,
-};
-
-typedef struct m68k_def_t m68k_def_t;
-
-struct m68k_def_t {
-    const char * name;
-    enum m68k_cpuid id;
-};
-
-static m68k_def_t m68k_cpu_defs[] = {
-    {"m5206", M68K_CPUID_M5206},
-    {"m5208", M68K_CPUID_M5208},
-    {"cfv4e", M68K_CPUID_CFV4E},
-    {"any", M68K_CPUID_ANY},
-    {NULL, 0},
-};
+typedef struct M68kCPUListState {
+    fprintf_function cpu_fprintf;
+    FILE *file;
+} M68kCPUListState;
+
+/* Sort alphabetically, except for "any". */
+static gint m68k_cpu_list_compare(gconstpointer a, gconstpointer b)
+{
+    ObjectClass *class_a = (ObjectClass *)a;
+    ObjectClass *class_b = (ObjectClass *)b;
+    const char *name_a, *name_b;
+
+    name_a = object_class_get_name(class_a);
+    name_b = object_class_get_name(class_b);
+    if (strcmp(name_a, "any") == 0) {
+        return 1;
+    } else if (strcmp(name_b, "any") == 0) {
+        return -1;
+    } else {
+        return strcasecmp(name_a, name_b);
+    }
+}
+
+static void m68k_cpu_list_entry(gpointer data, gpointer user_data)
+{
+    ObjectClass *c = data;
+    M68kCPUListState *s = user_data;
+
+    (*s->cpu_fprintf)(s->file, "%s\n",
+                      object_class_get_name(c));
+}
 
 void m68k_cpu_list(FILE *f, fprintf_function cpu_fprintf)
 {
-    unsigned int i;
+    M68kCPUListState s = {
+        .file = f,
+        .cpu_fprintf = cpu_fprintf,
+    };
+    GSList *list;
 
-    for (i = 0; m68k_cpu_defs[i].name; i++) {
-        (*cpu_fprintf)(f, "%s\n", m68k_cpu_defs[i].name);
-    }
+    list = object_class_get_list(TYPE_M68K_CPU, false);
+    list = g_slist_sort(list, m68k_cpu_list_compare);
+    g_slist_foreach(list, m68k_cpu_list_entry, &s);
+    g_slist_free(list);
 }
 
 static int fpu_gdb_get_reg(CPUM68KState *env, uint8_t *mem_buf, int n)
@@ -83,66 +98,6 @@ static int fpu_gdb_set_reg(CPUM68KState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-static void m68k_set_feature(CPUM68KState *env, int feature)
-{
-    env->features |= (1u << feature);
-}
-
-static int cpu_m68k_set_model(CPUM68KState *env, const char *name)
-{
-    m68k_def_t *def;
-
-    for (def = m68k_cpu_defs; def->name; def++) {
-        if (strcmp(def->name, name) == 0)
-            break;
-    }
-    if (!def->name)
-        return -1;
-
-    switch (def->id) {
-    case M68K_CPUID_M5206:
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
-        break;
-    case M68K_CPUID_M5208:
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
-        m68k_set_feature(env, M68K_FEATURE_BRAL);
-        m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
-        m68k_set_feature(env, M68K_FEATURE_USP);
-        break;
-    case M68K_CPUID_CFV4E:
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
-        m68k_set_feature(env, M68K_FEATURE_BRAL);
-        m68k_set_feature(env, M68K_FEATURE_CF_FPU);
-        m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
-        m68k_set_feature(env, M68K_FEATURE_USP);
-        break;
-    case M68K_CPUID_ANY:
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_A);
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_B);
-        m68k_set_feature(env, M68K_FEATURE_CF_ISA_APLUSC);
-        m68k_set_feature(env, M68K_FEATURE_BRAL);
-        m68k_set_feature(env, M68K_FEATURE_CF_FPU);
-        /* MAC and EMAC are mututally exclusive, so pick EMAC.
-           It's mostly backwards compatible.  */
-        m68k_set_feature(env, M68K_FEATURE_CF_EMAC);
-        m68k_set_feature(env, M68K_FEATURE_CF_EMAC_B);
-        m68k_set_feature(env, M68K_FEATURE_USP);
-        m68k_set_feature(env, M68K_FEATURE_EXT_FULL);
-        m68k_set_feature(env, M68K_FEATURE_WORD_INDEX);
-        break;
-    }
-
-    register_m68k_insns(env);
-    if (m68k_feature (env, M68K_FEATURE_CF_FPU)) {
-        gdb_register_coprocessor(env, fpu_gdb_get_reg, fpu_gdb_set_reg,
-                                 11, "cf-fp.xml", 18);
-    }
-    /* TODO: Add [E]MAC registers.  */
-    return 0;
-}
-
 void cpu_state_reset(CPUM68KState *env)
 {
     cpu_reset(ENV_GET_CPU(env));
@@ -154,7 +109,10 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     CPUM68KState *env;
     static int inited;
 
-    cpu = M68K_CPU(object_new(TYPE_M68K_CPU));
+    if (object_class_by_name(cpu_model) == NULL) {
+        return NULL;
+    }
+    cpu = M68K_CPU(object_new(cpu_model));
     env = &cpu->env;
 
     if (!inited) {
@@ -164,10 +122,12 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
 
     env->cpu_model_str = cpu_model;
 
-    if (cpu_m68k_set_model(env, cpu_model) < 0) {
-        object_delete(OBJECT(cpu));
-        return NULL;
+    register_m68k_insns(env);
+    if (m68k_feature(env, M68K_FEATURE_CF_FPU)) {
+        gdb_register_coprocessor(env, fpu_gdb_get_reg, fpu_gdb_set_reg,
+                                 11, "cf-fp.xml", 18);
     }
+    /* TODO: Add [E]MAC registers.  */
 
     cpu_reset(ENV_GET_CPU(env));
     qemu_init_vcpu(env);
commit 9b7060396e16b0b5a81e21373f27e63bdcacb5bf
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Apr 15 01:10:56 2012 +0200

    target-m68k: Start QOM'ifying CPU init
    
    Move model-independent code from cpu_m68k_init() into a QOM initfn.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Laurent Vivier <Laurent at Vivier.EU>
    Tested-by: Laurent Vivier <Laurent at Vivier.EU>

diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index e599ece..0bb1b2c 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -48,6 +48,14 @@ static void m68k_cpu_reset(CPUState *s)
     tlb_flush(env, 1);
 }
 
+static void m68k_cpu_initfn(Object *obj)
+{
+    M68kCPU *cpu = M68K_CPU(obj);
+    CPUM68KState *env = &cpu->env;
+
+    cpu_exec_init(env);
+}
+
 static void m68k_cpu_class_init(ObjectClass *c, void *data)
 {
     M68kCPUClass *mcc = M68K_CPU_CLASS(c);
@@ -61,6 +69,7 @@ static const TypeInfo m68k_cpu_type_info = {
     .name = TYPE_M68K_CPU,
     .parent = TYPE_CPU,
     .instance_size = sizeof(M68kCPU),
+    .instance_init = m68k_cpu_initfn,
     .abstract = false,
     .class_size = sizeof(M68kCPUClass),
     .class_init = m68k_cpu_class_init,
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 69fb147..e850d53 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -156,7 +156,7 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
 
     cpu = M68K_CPU(object_new(TYPE_M68K_CPU));
     env = &cpu->env;
-    cpu_exec_init(env);
+
     if (!inited) {
         inited = 1;
         m68k_tcg_init();
commit 11c1986817fa8ec515b87291445786734f78e4e0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Apr 15 00:59:50 2012 +0200

    target-m68k: QOM'ify CPU reset
    
    Move code from cpu_state_reset() into QOM m68k_cpu_reset().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Laurent Vivier <Laurent at Vivier.EU>
    Tested-by: Laurent Vivier <Laurent at Vivier.EU>

diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 457c5c1..e599ece 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -29,9 +29,23 @@ static void m68k_cpu_reset(CPUState *s)
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);
     CPUM68KState *env = &cpu->env;
 
+    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
+        qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
+        log_cpu_state(env, 0);
+    }
+
     mcc->parent_reset(s);
 
-    cpu_state_reset(env);
+    memset(env, 0, offsetof(CPUM68KState, breakpoints));
+#if !defined(CONFIG_USER_ONLY)
+    env->sr = 0x2700;
+#endif
+    m68k_switch_sp(env);
+    /* ??? FP regs should be initialized to NaN.  */
+    env->cc_op = CC_OP_FLAGS;
+    /* TODO: We should set PC from the interrupt vector.  */
+    env->pc = 0;
+    tlb_flush(env, 1);
 }
 
 static void m68k_cpu_class_init(ObjectClass *c, void *data)
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index e91acdb..69fb147 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -145,21 +145,7 @@ static int cpu_m68k_set_model(CPUM68KState *env, const char *name)
 
 void cpu_state_reset(CPUM68KState *env)
 {
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
-        log_cpu_state(env, 0);
-    }
-
-    memset(env, 0, offsetof(CPUM68KState, breakpoints));
-#if !defined (CONFIG_USER_ONLY)
-    env->sr = 0x2700;
-#endif
-    m68k_switch_sp(env);
-    /* ??? FP regs should be initialized to NaN.  */
-    env->cc_op = CC_OP_FLAGS;
-    /* TODO: We should set PC from the interrupt vector.  */
-    env->pc = 0;
-    tlb_flush(env, 1);
+    cpu_reset(ENV_GET_CPU(env));
 }
 
 CPUM68KState *cpu_m68k_init(const char *cpu_model)
@@ -183,7 +169,7 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
         return NULL;
     }
 
-    cpu_state_reset(env);
+    cpu_reset(ENV_GET_CPU(env));
     qemu_init_vcpu(env);
     return env;
 }
commit b9e7a234343501e2498680fd7bc0cd2aad947560
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Apr 15 00:35:50 2012 +0200

    target-m68k: QOM'ify CPU
    
    Embed CPUM68KState as first member of QOM M68kCPU.
    Drop cpu_m68k_close() in favor of object_delete().
    
    Let CPUClass::reset() call cpu_state_reset() for now.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Laurent Vivier <Laurent at Vivier.EU>
    Tested-by: Laurent Vivier <Laurent at Vivier.EU>

diff --git a/Makefile.target b/Makefile.target
index ace1182..e735064 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -96,6 +96,7 @@ libobj-$(TARGET_ARM) += neon_helper.o iwmmxt_helper.o
 libobj-$(TARGET_ARM) += cpu.o
 libobj-$(TARGET_CRIS) += cpu.o
 libobj-$(TARGET_LM32) += cpu.o
+libobj-$(TARGET_M68K) += cpu.o
 libobj-$(TARGET_MICROBLAZE) += cpu.o
 libobj-$(TARGET_S390X) += cpu.o
 libobj-$(TARGET_SH4) += cpu.o
diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
new file mode 100644
index 0000000..805786b
--- /dev/null
+++ b/target-m68k/cpu-qom.h
@@ -0,0 +1,70 @@
+/*
+ * QEMU Motorola 68k CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+#ifndef QEMU_M68K_CPU_QOM_H
+#define QEMU_M68K_CPU_QOM_H
+
+#include "qemu/cpu.h"
+
+#define TYPE_M68K_CPU "m68k-cpu"
+
+#define M68K_CPU_CLASS(klass) \
+    OBJECT_CLASS_CHECK(M68kCPUClass, (klass), TYPE_M68K_CPU)
+#define M68K_CPU(obj) \
+    OBJECT_CHECK(M68kCPU, (obj), TYPE_M68K_CPU)
+#define M68K_CPU_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(M68kCPUClass, (obj), TYPE_M68K_CPU)
+
+/**
+ * M68kCPUClass:
+ * @parent_reset: The parent class' reset handler.
+ *
+ * A Motorola 68k CPU model.
+ */
+typedef struct M68kCPUClass {
+    /*< private >*/
+    CPUClass parent_class;
+    /*< public >*/
+
+    void (*parent_reset)(CPUState *cpu);
+} M68kCPUClass;
+
+/**
+ * M68kCPU:
+ * @env: #CPUM68KState
+ *
+ * A Motorola 68k CPU.
+ */
+typedef struct M68kCPU {
+    /*< private >*/
+    CPUState parent_obj;
+    /*< public >*/
+
+    CPUM68KState env;
+} M68kCPU;
+
+static inline M68kCPU *m68k_env_get_cpu(CPUM68KState *env)
+{
+    return M68K_CPU(container_of(env, M68kCPU, env));
+}
+
+#define ENV_GET_CPU(e) CPU(m68k_env_get_cpu(e))
+
+
+#endif
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
new file mode 100644
index 0000000..457c5c1
--- /dev/null
+++ b/target-m68k/cpu.c
@@ -0,0 +1,60 @@
+/*
+ * QEMU Motorola 68k CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+
+#include "cpu.h"
+#include "qemu-common.h"
+
+
+/* CPUClass::reset() */
+static void m68k_cpu_reset(CPUState *s)
+{
+    M68kCPU *cpu = M68K_CPU(s);
+    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(cpu);
+    CPUM68KState *env = &cpu->env;
+
+    mcc->parent_reset(s);
+
+    cpu_state_reset(env);
+}
+
+static void m68k_cpu_class_init(ObjectClass *c, void *data)
+{
+    M68kCPUClass *mcc = M68K_CPU_CLASS(c);
+    CPUClass *cc = CPU_CLASS(c);
+
+    mcc->parent_reset = cc->reset;
+    cc->reset = m68k_cpu_reset;
+}
+
+static const TypeInfo m68k_cpu_type_info = {
+    .name = TYPE_M68K_CPU,
+    .parent = TYPE_CPU,
+    .instance_size = sizeof(M68kCPU),
+    .abstract = false,
+    .class_size = sizeof(M68kCPUClass),
+    .class_init = m68k_cpu_class_init,
+};
+
+static void m68k_cpu_register_types(void)
+{
+    type_register_static(&m68k_cpu_type_info);
+}
+
+type_init(m68k_cpu_register_types)
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index 6696e30..5e6ee50 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -116,10 +116,11 @@ typedef struct CPUM68KState {
     uint32_t features;
 } CPUM68KState;
 
+#include "cpu-qom.h"
+
 void m68k_tcg_init(void);
 CPUM68KState *cpu_m68k_init(const char *cpu_model);
 int cpu_m68k_exec(CPUM68KState *s);
-void cpu_m68k_close(CPUM68KState *s);
 void do_interrupt(CPUM68KState *env1);
 void do_interrupt_m68k_hardirq(CPUM68KState *env1);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 1feed9b..e91acdb 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -164,10 +164,12 @@ void cpu_state_reset(CPUM68KState *env)
 
 CPUM68KState *cpu_m68k_init(const char *cpu_model)
 {
+    M68kCPU *cpu;
     CPUM68KState *env;
     static int inited;
 
-    env = g_malloc0(sizeof(CPUM68KState));
+    cpu = M68K_CPU(object_new(TYPE_M68K_CPU));
+    env = &cpu->env;
     cpu_exec_init(env);
     if (!inited) {
         inited = 1;
@@ -177,7 +179,7 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     env->cpu_model_str = cpu_model;
 
     if (cpu_m68k_set_model(env, cpu_model) < 0) {
-        cpu_m68k_close(env);
+        object_delete(OBJECT(cpu));
         return NULL;
     }
 
@@ -186,11 +188,6 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     return env;
 }
 
-void cpu_m68k_close(CPUM68KState *env)
-{
-    g_free(env);
-}
-
 void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
 {
     int flags;
commit 2b4b49065670b46b424a329da5d35838180fc209
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 02:32:12 2012 +0200

    target-sh4: Start QOM'ifying CPU init
    
    Move code from cpu_sh4_init() into a QOM initfn.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index 84d4672..a1a177f 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -53,6 +53,16 @@ static void superh_cpu_reset(CPUState *s)
     set_default_nan_mode(1, &env->fp_status);
 }
 
+static void superh_cpu_initfn(Object *obj)
+{
+    SuperHCPU *cpu = SUPERH_CPU(obj);
+    CPUSH4State *env = &cpu->env;
+
+    cpu_exec_init(env);
+
+    env->movcal_backup_tail = &(env->movcal_backup);
+}
+
 static void superh_cpu_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
@@ -66,6 +76,7 @@ static const TypeInfo superh_cpu_type_info = {
     .name = TYPE_SUPERH_CPU,
     .parent = TYPE_CPU,
     .instance_size = sizeof(SuperHCPU),
+    .instance_init = superh_cpu_initfn,
     .abstract = false,
     .class_size = sizeof(SuperHCPUClass),
     .class_init = superh_cpu_class_init,
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index d0568e2..d25f0c5 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -259,8 +259,6 @@ CPUSH4State *cpu_sh4_init(const char *cpu_model)
     cpu = SUPERH_CPU(object_new(TYPE_SUPERH_CPU));
     env = &cpu->env;
     env->features = def->features;
-    cpu_exec_init(env);
-    env->movcal_backup_tail = &(env->movcal_backup);
     sh4_translate_init();
     env->cpu_model_str = cpu_model;
     cpu_reset(CPU(cpu));
commit c4bb0f99e797e5e5720c27544a2fc61a0b722023
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 02:16:02 2012 +0200

    target-sh4: QOM'ify CPU reset
    
    Move code from cpu_state_reset() to QOM superh_cpu_reset().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index e110f98..84d4672 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -1,6 +1,7 @@
 /*
  * QEMU SuperH CPU
  *
+ * Copyright (c) 2005 Samuel Tardieu
  * Copyright (c) 2012 SUSE LINUX Products GmbH
  *
  * This library is free software; you can redistribute it and/or
@@ -29,9 +30,27 @@ static void superh_cpu_reset(CPUState *s)
     SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(cpu);
     CPUSH4State *env = &cpu->env;
 
+    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
+        qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
+        log_cpu_state(env, 0);
+    }
+
     scc->parent_reset(s);
 
-    cpu_state_reset(env);
+    memset(env, 0, offsetof(CPUSH4State, breakpoints));
+    tlb_flush(env, 1);
+
+    env->pc = 0xA0000000;
+#if defined(CONFIG_USER_ONLY)
+    env->fpscr = FPSCR_PR; /* value for userspace according to the kernel */
+    set_float_rounding_mode(float_round_nearest_even, &env->fp_status); /* ?! */
+#else
+    env->sr = SR_MD | SR_RB | SR_BL | SR_I3 | SR_I2 | SR_I1 | SR_I0;
+    env->fpscr = FPSCR_DN | FPSCR_RM_ZERO; /* CPU reset value according to SH4 manual */
+    set_float_rounding_mode(float_round_to_zero, &env->fp_status);
+    set_flush_to_zero(1, &env->fp_status);
+#endif
+    set_default_nan_mode(1, &env->fp_status);
 }
 
 static void superh_cpu_class_init(ObjectClass *oc, void *data)
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 6309e85..d0568e2 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -180,25 +180,7 @@ void cpu_dump_state(CPUSH4State * env, FILE * f,
 
 void cpu_state_reset(CPUSH4State *env)
 {
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
-        log_cpu_state(env, 0);
-    }
-
-    memset(env, 0, offsetof(CPUSH4State, breakpoints));
-    tlb_flush(env, 1);
-
-    env->pc = 0xA0000000;
-#if defined(CONFIG_USER_ONLY)
-    env->fpscr = FPSCR_PR; /* value for userspace according to the kernel */
-    set_float_rounding_mode(float_round_nearest_even, &env->fp_status); /* ?! */
-#else
-    env->sr = SR_MD | SR_RB | SR_BL | SR_I3 | SR_I2 | SR_I1 | SR_I0;
-    env->fpscr = FPSCR_DN | FPSCR_RM_ZERO; /* CPU reset value according to SH4 manual */
-    set_float_rounding_mode(float_round_to_zero, &env->fp_status);
-    set_flush_to_zero(1, &env->fp_status);
-#endif
-    set_default_nan_mode(1, &env->fp_status);
+    cpu_reset(ENV_GET_CPU(env));
 }
 
 typedef struct {
@@ -281,7 +263,7 @@ CPUSH4State *cpu_sh4_init(const char *cpu_model)
     env->movcal_backup_tail = &(env->movcal_backup);
     sh4_translate_init();
     env->cpu_model_str = cpu_model;
-    cpu_state_reset(env);
+    cpu_reset(CPU(cpu));
     cpu_register(env, def);
     qemu_init_vcpu(env);
     return env;
commit 339894bec9bb99aaeb695173006322c37a102408
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 11 17:26:17 2012 +0100

    target-sh4: QOM'ify CPU
    
    Embed CPUSH4State as first member of SuperHCPU.
    
    Let CPUClass::reset() call cpu_state_reset() for now.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/Makefile.target b/Makefile.target
index 4fbbabf..ace1182 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -98,6 +98,7 @@ libobj-$(TARGET_CRIS) += cpu.o
 libobj-$(TARGET_LM32) += cpu.o
 libobj-$(TARGET_MICROBLAZE) += cpu.o
 libobj-$(TARGET_S390X) += cpu.o
+libobj-$(TARGET_SH4) += cpu.o
 ifeq ($(TARGET_BASE_ARCH), sparc)
 libobj-y += fop_helper.o cc_helper.o win_helper.o mmu_helper.o ldst_helper.o
 libobj-y += cpu.o
diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
new file mode 100644
index 0000000..c41164a
--- /dev/null
+++ b/target-sh4/cpu-qom.h
@@ -0,0 +1,70 @@
+/*
+ * QEMU SuperH CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+#ifndef QEMU_SUPERH_CPU_QOM_H
+#define QEMU_SUPERH_CPU_QOM_H
+
+#include "qemu/cpu.h"
+
+#define TYPE_SUPERH_CPU "superh-cpu"
+
+#define SUPERH_CPU_CLASS(klass) \
+    OBJECT_CLASS_CHECK(SuperHCPUClass, (klass), TYPE_SUPERH_CPU)
+#define SUPERH_CPU(obj) \
+    OBJECT_CHECK(SuperHCPU, (obj), TYPE_SUPERH_CPU)
+#define SUPERH_CPU_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(SuperHCPUClass, (obj), TYPE_SUPERH_CPU)
+
+/**
+ * SuperHCPUClass:
+ * @parent_reset: The parent class' reset handler.
+ *
+ * A SuperH CPU model.
+ */
+typedef struct SuperHCPUClass {
+    /*< private >*/
+    CPUClass parent_class;
+    /*< public >*/
+
+    void (*parent_reset)(CPUState *cpu);
+} SuperHCPUClass;
+
+/**
+ * SuperHCPU:
+ * @env: #CPUSH4State
+ *
+ * A SuperH CPU.
+ */
+typedef struct SuperHCPU {
+    /*< private >*/
+    CPUState parent_obj;
+    /*< public >*/
+
+    CPUSH4State env;
+} SuperHCPU;
+
+static inline SuperHCPU *sh_env_get_cpu(CPUSH4State *env)
+{
+    return SUPERH_CPU(container_of(env, SuperHCPU, env));
+}
+
+#define ENV_GET_CPU(e) CPU(sh_env_get_cpu(e))
+
+
+#endif
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
new file mode 100644
index 0000000..e110f98
--- /dev/null
+++ b/target-sh4/cpu.c
@@ -0,0 +1,60 @@
+/*
+ * QEMU SuperH CPU
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+
+#include "cpu.h"
+#include "qemu-common.h"
+
+
+/* CPUClass::reset() */
+static void superh_cpu_reset(CPUState *s)
+{
+    SuperHCPU *cpu = SUPERH_CPU(s);
+    SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(cpu);
+    CPUSH4State *env = &cpu->env;
+
+    scc->parent_reset(s);
+
+    cpu_state_reset(env);
+}
+
+static void superh_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CPUClass *cc = CPU_CLASS(oc);
+    SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);
+
+    scc->parent_reset = cc->reset;
+    cc->reset = superh_cpu_reset;
+}
+
+static const TypeInfo superh_cpu_type_info = {
+    .name = TYPE_SUPERH_CPU,
+    .parent = TYPE_CPU,
+    .instance_size = sizeof(SuperHCPU),
+    .abstract = false,
+    .class_size = sizeof(SuperHCPUClass),
+    .class_init = superh_cpu_class_init,
+};
+
+static void superh_cpu_register_types(void)
+{
+    type_register_static(&superh_cpu_type_info);
+}
+
+type_init(superh_cpu_register_types)
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index 965536d..b6768f1 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -189,6 +189,8 @@ typedef struct CPUSH4State {
     memory_content **movcal_backup_tail;
 } CPUSH4State;
 
+#include "cpu-qom.h"
+
 CPUSH4State *cpu_sh4_init(const char *cpu_model);
 int cpu_sh4_exec(CPUSH4State * s);
 int cpu_sh4_signal_handler(int host_signum, void *pinfo,
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index a337beb..6309e85 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -267,13 +267,15 @@ static void cpu_register(CPUSH4State *env, const sh4_def_t *def)
 
 CPUSH4State *cpu_sh4_init(const char *cpu_model)
 {
+    SuperHCPU *cpu;
     CPUSH4State *env;
     const sh4_def_t *def;
 
     def = cpu_sh4_find_by_name(cpu_model);
     if (!def)
 	return NULL;
-    env = g_malloc0(sizeof(CPUSH4State));
+    cpu = SUPERH_CPU(object_new(TYPE_SUPERH_CPU));
+    env = &cpu->env;
     env->features = def->features;
     cpu_exec_init(env);
     env->movcal_backup_tail = &(env->movcal_backup);
commit 2c9b7d1ab4e06ab742f669366c70d97e54598c36
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 18:33:43 2012 +0200

    MAINTAINERS: Downgrade target-mips and target-sh4 to Odd Fixes
    
    Patches are not being handled, so let's downgrade to Odd Fixes.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Aurélien Jarno <aurelien at aurel32.net>

diff --git a/MAINTAINERS b/MAINTAINERS
index 8ae9158..32d8dc7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -88,7 +88,7 @@ F: target-microblaze/
 
 MIPS
 M: Aurelien Jarno <aurelien at aurel32.net>
-S: Maintained
+S: Odd Fixes
 F: target-mips/
 
 PowerPC
@@ -104,7 +104,7 @@ F: target-s390x/
 
 SH4
 M: Aurelien Jarno <aurelien at aurel32.net>
-S: Maintained
+S: Odd Fixes
 F: target-sh4/
 
 SPARC
commit 84c9d9d1e932460c1d8c60b1d96a58d1e47ec4a3
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 18:30:29 2012 +0200

    MAINTAINERS: Downgrade target-m68k to Odd Fixes
    
    m68k patches are not being handled, so let's downgrade to Odd Fixes.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index cce37e7..8ae9158 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -78,7 +78,7 @@ F: target-lm32/
 
 M68K
 M: Paul Brook <paul at codesourcery.com>
-S: Maintained
+S: Odd Fixes
 F: target-m68k/
 
 MicroBlaze
commit 9357b1449a6daa6fd79e2375f0aa8b1f60635bcb
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat Apr 14 22:51:34 2012 +0200

    prep: Initialize PC speaker
    
    Speaker init has been added in 506b7ddf889312659b36c667f7ae17bc9e909418,
    but audio subsystem init was missing.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/ppc_prep.c b/hw/ppc_prep.c
index 9d8e659..61c655c 100644
--- a/hw/ppc_prep.c
+++ b/hw/ppc_prep.c
@@ -37,6 +37,7 @@
 #include "loader.h"
 #include "mc146818rtc.h"
 #include "blockdev.h"
+#include "arch_init.h"
 #include "exec-memory.h"
 
 //#define HARD_DEBUG_PPC_IO
@@ -716,6 +717,9 @@ static void ppc_prep_init (ram_addr_t ram_size,
 
     /* Special port to get debug messages from Open-Firmware */
     register_ioport_write(0x0F00, 4, 1, &PPC_debug_write, NULL);
+
+    /* Initialize audio subsystem */
+    audio_init(isa_bus, pci_bus);
 }
 
 static QEMUMachine prep_machine = {
commit a527b5452eb6bb7ee00c940c450e592f0b448042
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat Mar 17 15:39:43 2012 +0100

    isa: Add isa_bus_from_device() method
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Acked-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/isa.h b/hw/isa.h
index 40373fb..f7bc4b5 100644
--- a/hw/isa.h
+++ b/hw/isa.h
@@ -76,6 +76,11 @@ void isa_register_portio_list(ISADevice *dev, uint16_t start,
                               const MemoryRegionPortio *portio,
                               void *opaque, const char *name);
 
+static inline ISABus *isa_bus_from_device(ISADevice *d)
+{
+    return DO_UPCAST(ISABus, qbus, d->qdev.parent_bus);
+}
+
 extern target_phys_addr_t isa_mem_base;
 
 void isa_mmio_setup(MemoryRegion *mr, target_phys_addr_t size);
commit c9ae703dd16f7ada889e88127a5e60527a62a005
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat Mar 17 15:39:44 2012 +0100

    fdc: Parametrize ISA base, IRQ and DMA
    
    Keep the PC values as defaults but allow to override them for PReP.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>

diff --git a/hw/fdc.c b/hw/fdc.c
index a0236b7..756d4ce 100644
--- a/hw/fdc.c
+++ b/hw/fdc.c
@@ -438,6 +438,9 @@ typedef struct FDCtrlSysBus {
 
 typedef struct FDCtrlISABus {
     ISADevice busdev;
+    uint32_t iobase;
+    uint32_t irq;
+    uint32_t dma;
     struct FDCtrl state;
     int32_t bootindexA;
     int32_t bootindexB;
@@ -1971,17 +1974,14 @@ static int isabus_fdc_init1(ISADevice *dev)
 {
     FDCtrlISABus *isa = DO_UPCAST(FDCtrlISABus, busdev, dev);
     FDCtrl *fdctrl = &isa->state;
-    int iobase = 0x3f0;
-    int isairq = 6;
-    int dma_chann = 2;
     int ret;
 
-    isa_register_portio_list(dev, iobase, fdc_portio_list, fdctrl, "fdc");
+    isa_register_portio_list(dev, isa->iobase, fdc_portio_list, fdctrl, "fdc");
 
-    isa_init_irq(&isa->busdev, &fdctrl->irq, isairq);
-    fdctrl->dma_chann = dma_chann;
+    isa_init_irq(&isa->busdev, &fdctrl->irq, isa->irq);
+    fdctrl->dma_chann = isa->dma;
 
-    qdev_set_legacy_instance_id(&dev->qdev, iobase, 2);
+    qdev_set_legacy_instance_id(&dev->qdev, isa->iobase, 2);
     ret = fdctrl_init_common(fdctrl);
 
     add_boot_device_path(isa->bootindexA, &dev->qdev, "/floppy at 0");
@@ -2046,6 +2046,9 @@ static const VMStateDescription vmstate_isa_fdc ={
 };
 
 static Property isa_fdc_properties[] = {
+    DEFINE_PROP_HEX32("iobase", FDCtrlISABus, iobase, 0x3f0),
+    DEFINE_PROP_UINT32("irq", FDCtrlISABus, irq, 6),
+    DEFINE_PROP_UINT32("dma", FDCtrlISABus, dma, 2),
     DEFINE_PROP_DRIVE("driveA", FDCtrlISABus, state.drives[0].bs),
     DEFINE_PROP_DRIVE("driveB", FDCtrlISABus, state.drives[1].bs),
     DEFINE_PROP_INT32("bootindexA", FDCtrlISABus, bootindexA, -1),
commit 049a9f7b946fe1d3ff97127f8905881dbb78cb00
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Sat Mar 17 15:39:41 2012 +0100

    i82378/i82374: Do not create DMA controller twice
    
    This fixes a crash in PReP emulation when using DMA controller to access
    floppy drive.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>

diff --git a/hw/i82374.c b/hw/i82374.c
index 67298a3..4a922c3 100644
--- a/hw/i82374.c
+++ b/hw/i82374.c
@@ -38,6 +38,7 @@ do { fprintf(stderr, "i82374 ERROR: " fmt , ## __VA_ARGS__); } while (0)
 
 typedef struct I82374State {
     uint8_t commands[8];
+    qemu_irq out;
 } I82374State;
 
 static const VMStateDescription vmstate_i82374 = {
@@ -99,7 +100,7 @@ static uint32_t i82374_read_descriptor(void *opaque, uint32_t nport)
 
 static void i82374_init(I82374State *s)
 {
-    DMA_init(1, NULL);
+    DMA_init(1, &s->out);
     memset(s->commands, 0, sizeof(s->commands));
 }
 
@@ -132,6 +133,8 @@ static int i82374_isa_init(ISADevice *dev)
 
     i82374_init(s);
 
+    qdev_init_gpio_out(&dev->qdev, &s->out, 1);
+
     return 0;
 }
 
diff --git a/hw/i82378.c b/hw/i82378.c
index faad1a3..9b11d90 100644
--- a/hw/i82378.c
+++ b/hw/i82378.c
@@ -170,6 +170,7 @@ static void i82378_init(DeviceState *dev, I82378State *s)
 {
     ISABus *isabus = DO_UPCAST(ISABus, qbus, qdev_get_child_bus(dev, "isa.0"));
     ISADevice *pit;
+    ISADevice *isa;
     qemu_irq *out0_irq;
 
     /* This device has:
@@ -199,8 +200,8 @@ static void i82378_init(DeviceState *dev, I82378State *s)
     pcspk_init(isabus, pit);
 
     /* 2 82C37 (dma) */
-    DMA_init(1, &s->out[1]);
-    isa_create_simple(isabus, "i82374");
+    isa = isa_create_simple(isabus, "i82374");
+    qdev_connect_gpio_out(&isa->qdev, 0, s->out[1]);
 
     /* timer */
     isa_create_simple(isabus, "mc146818rtc");
commit 42fe1c245f0239ebcdc084740a1777ac3699d071
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 27 17:02:08 2012 +0200

    main-loop: Fix build for w32 and w64
    
    This patch fixes a build regression with MinGW which was introduced by
    commit 7c7db75576bd5a31508208f153c5aada64b2c8df.
    
    The 3rd argument of g_main_context_query must point to a gint value.
    Using a pointer to an uint32_t value is wrong.
    
    The timeout argument of function os_host_main_loop_wait was never
    used for w32 / w64.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/main-loop.c b/main-loop.c
index 0457bf2..24cf540 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -410,6 +410,7 @@ static int os_host_main_loop_wait(uint32_t timeout)
     int ret, i;
     PollingEntry *pe;
     WaitObjects *w = &wait_objects;
+    gint poll_timeout;
     static struct timeval tv0;
 
     /* XXX: need to suppress polling by better using win32 events */
@@ -424,12 +425,12 @@ static int os_host_main_loop_wait(uint32_t timeout)
     if (nfds >= 0) {
         ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv0);
         if (ret != 0) {
-            timeout = 0;
+            /* TODO. */
         }
     }
 
     g_main_context_prepare(context, &max_priority);
-    n_poll_fds = g_main_context_query(context, max_priority, &timeout,
+    n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
                                       poll_fds, ARRAY_SIZE(poll_fds));
     g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
 
@@ -439,7 +440,7 @@ static int os_host_main_loop_wait(uint32_t timeout)
     }
 
     qemu_mutex_unlock_iothread();
-    ret = g_poll(poll_fds, n_poll_fds + w->num, timeout);
+    ret = g_poll(poll_fds, n_poll_fds + w->num, poll_timeout);
     qemu_mutex_lock_iothread();
     if (ret > 0) {
         for (i = 0; i < w->num; i++) {
commit 08de3949bd021aece439d396ad8de96f29dcd090
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Thu Apr 26 11:57:39 2012 +0200

    configure: Don't build bsd-user on Mac OS X by default
    
    Fixes the build when combined with the drop of darwin-user.
    Enthusiasts can still try building it using --enable-bsd-user.
    
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Cc: Bernhard Walle <bernhard at bwalle.de>
    Tested-by: Bernhard Walle <bernhard at bwalle.de> [Mac OS 10.7.3]
    Acked-by: Bernhard Walle <bernhard at bwalle.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/configure b/configure
index 15bbc73..25697bb 100755
--- a/configure
+++ b/configure
@@ -498,8 +498,8 @@ esac
 if [ "$bsd" = "yes" ] ; then
   if [ "$darwin" != "yes" ] ; then
     usb="bsd"
+    bsd_user="yes"
   fi
-  bsd_user="yes"
 fi
 
 : ${make=${MAKE-make}}
commit 94a49d86c536af37bf18722c23cb9b85acfb00ec
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Apr 26 00:15:56 2012 +0200

    softfloat: Replace int16 type with int_fast16_t
    
    Based on the following Coccinelle patch:
    
    @@
    typedef int16, int_fast16_t;
    @@
    -int16
    +int_fast16_t
    
    Avoids a workaround for AIX.
    
    Add typedef for pre-10 Solaris.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: malc <av1474 at comtv.ru>
    Cc: Ben Taylor <bentaylor.solx86 at gmail.com>
    Tested-by: Bernhard Walle <bernhard at bwalle.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/fpu/softfloat-macros.h b/fpu/softfloat-macros.h
index e82ce23..b5164af 100644
--- a/fpu/softfloat-macros.h
+++ b/fpu/softfloat-macros.h
@@ -55,7 +55,7 @@ these four paragraphs for those parts of this code that are retained.
 | The result is stored in the location pointed to by `zPtr'.
 *----------------------------------------------------------------------------*/
 
-INLINE void shift32RightJamming( uint32_t a, int16 count, uint32_t *zPtr )
+INLINE void shift32RightJamming(uint32_t a, int_fast16_t count, uint32_t *zPtr)
 {
     uint32_t z;
 
@@ -81,7 +81,7 @@ INLINE void shift32RightJamming( uint32_t a, int16 count, uint32_t *zPtr )
 | The result is stored in the location pointed to by `zPtr'.
 *----------------------------------------------------------------------------*/
 
-INLINE void shift64RightJamming( uint64_t a, int16 count, uint64_t *zPtr )
+INLINE void shift64RightJamming(uint64_t a, int_fast16_t count, uint64_t *zPtr)
 {
     uint64_t z;
 
@@ -117,7 +117,7 @@ INLINE void shift64RightJamming( uint64_t a, int16 count, uint64_t *zPtr )
 
 INLINE void
  shift64ExtraRightJamming(
-     uint64_t a0, uint64_t a1, int16 count, uint64_t *z0Ptr, uint64_t *z1Ptr )
+     uint64_t a0, uint64_t a1, int_fast16_t count, uint64_t *z0Ptr, uint64_t *z1Ptr)
 {
     uint64_t z0, z1;
     int8 negCount = ( - count ) & 63;
@@ -154,7 +154,7 @@ INLINE void
 
 INLINE void
  shift128Right(
-     uint64_t a0, uint64_t a1, int16 count, uint64_t *z0Ptr, uint64_t *z1Ptr )
+     uint64_t a0, uint64_t a1, int_fast16_t count, uint64_t *z0Ptr, uint64_t *z1Ptr)
 {
     uint64_t z0, z1;
     int8 negCount = ( - count ) & 63;
@@ -189,7 +189,7 @@ INLINE void
 
 INLINE void
  shift128RightJamming(
-     uint64_t a0, uint64_t a1, int16 count, uint64_t *z0Ptr, uint64_t *z1Ptr )
+     uint64_t a0, uint64_t a1, int_fast16_t count, uint64_t *z0Ptr, uint64_t *z1Ptr)
 {
     uint64_t z0, z1;
     int8 negCount = ( - count ) & 63;
@@ -243,7 +243,7 @@ INLINE void
      uint64_t a0,
      uint64_t a1,
      uint64_t a2,
-     int16 count,
+     int_fast16_t count,
      uint64_t *z0Ptr,
      uint64_t *z1Ptr,
      uint64_t *z2Ptr
@@ -298,7 +298,7 @@ INLINE void
 
 INLINE void
  shortShift128Left(
-     uint64_t a0, uint64_t a1, int16 count, uint64_t *z0Ptr, uint64_t *z1Ptr )
+     uint64_t a0, uint64_t a1, int_fast16_t count, uint64_t *z0Ptr, uint64_t *z1Ptr)
 {
 
     *z1Ptr = a1<<count;
@@ -320,7 +320,7 @@ INLINE void
      uint64_t a0,
      uint64_t a1,
      uint64_t a2,
-     int16 count,
+     int_fast16_t count,
      uint64_t *z0Ptr,
      uint64_t *z1Ptr,
      uint64_t *z2Ptr
@@ -591,7 +591,7 @@ static uint64_t estimateDiv128To64( uint64_t a0, uint64_t a1, uint64_t b )
 | value.
 *----------------------------------------------------------------------------*/
 
-static uint32_t estimateSqrt32( int16 aExp, uint32_t a )
+static uint32_t estimateSqrt32(int_fast16_t aExp, uint32_t a)
 {
     static const uint16_t sqrtOddAdjustments[] = {
         0x0004, 0x0022, 0x005D, 0x00B1, 0x011D, 0x019F, 0x0236, 0x02E0,
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 50fce01..b29256a 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -87,7 +87,7 @@ INLINE uint32_t extractFloat16Frac(float16 a)
 | Returns the exponent bits of the half-precision floating-point value `a'.
 *----------------------------------------------------------------------------*/
 
-INLINE int16 extractFloat16Exp(float16 a)
+INLINE int_fast16_t extractFloat16Exp(float16 a)
 {
     return (float16_val(a) >> 10) & 0x1f;
 }
@@ -218,7 +218,7 @@ INLINE uint32_t extractFloat32Frac( float32 a )
 | Returns the exponent bits of the single-precision floating-point value `a'.
 *----------------------------------------------------------------------------*/
 
-INLINE int16 extractFloat32Exp( float32 a )
+INLINE int_fast16_t extractFloat32Exp(float32 a)
 {
 
     return ( float32_val(a)>>23 ) & 0xFF;
@@ -259,7 +259,7 @@ static float32 float32_squash_input_denormal(float32 a STATUS_PARAM)
 *----------------------------------------------------------------------------*/
 
 static void
- normalizeFloat32Subnormal( uint32_t aSig, int16 *zExpPtr, uint32_t *zSigPtr )
+ normalizeFloat32Subnormal(uint32_t aSig, int_fast16_t *zExpPtr, uint32_t *zSigPtr)
 {
     int8 shiftCount;
 
@@ -280,7 +280,7 @@ static void
 | significand.
 *----------------------------------------------------------------------------*/
 
-INLINE float32 packFloat32( flag zSign, int16 zExp, uint32_t zSig )
+INLINE float32 packFloat32(flag zSign, int_fast16_t zExp, uint32_t zSig)
 {
 
     return make_float32(
@@ -310,7 +310,7 @@ INLINE float32 packFloat32( flag zSign, int16 zExp, uint32_t zSig )
 | Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-static float32 roundAndPackFloat32( flag zSign, int16 zExp, uint32_t zSig STATUS_PARAM)
+static float32 roundAndPackFloat32(flag zSign, int_fast16_t zExp, uint32_t zSig STATUS_PARAM)
 {
     int8 roundingMode;
     flag roundNearestEven;
@@ -376,7 +376,7 @@ static float32 roundAndPackFloat32( flag zSign, int16 zExp, uint32_t zSig STATUS
 *----------------------------------------------------------------------------*/
 
 static float32
- normalizeRoundAndPackFloat32( flag zSign, int16 zExp, uint32_t zSig STATUS_PARAM)
+ normalizeRoundAndPackFloat32(flag zSign, int_fast16_t zExp, uint32_t zSig STATUS_PARAM)
 {
     int8 shiftCount;
 
@@ -400,7 +400,7 @@ INLINE uint64_t extractFloat64Frac( float64 a )
 | Returns the exponent bits of the double-precision floating-point value `a'.
 *----------------------------------------------------------------------------*/
 
-INLINE int16 extractFloat64Exp( float64 a )
+INLINE int_fast16_t extractFloat64Exp(float64 a)
 {
 
     return ( float64_val(a)>>52 ) & 0x7FF;
@@ -441,7 +441,7 @@ static float64 float64_squash_input_denormal(float64 a STATUS_PARAM)
 *----------------------------------------------------------------------------*/
 
 static void
- normalizeFloat64Subnormal( uint64_t aSig, int16 *zExpPtr, uint64_t *zSigPtr )
+ normalizeFloat64Subnormal(uint64_t aSig, int_fast16_t *zExpPtr, uint64_t *zSigPtr)
 {
     int8 shiftCount;
 
@@ -462,7 +462,7 @@ static void
 | significand.
 *----------------------------------------------------------------------------*/
 
-INLINE float64 packFloat64( flag zSign, int16 zExp, uint64_t zSig )
+INLINE float64 packFloat64(flag zSign, int_fast16_t zExp, uint64_t zSig)
 {
 
     return make_float64(
@@ -492,11 +492,11 @@ INLINE float64 packFloat64( flag zSign, int16 zExp, uint64_t zSig )
 | Binary Floating-Point Arithmetic.
 *----------------------------------------------------------------------------*/
 
-static float64 roundAndPackFloat64( flag zSign, int16 zExp, uint64_t zSig STATUS_PARAM)
+static float64 roundAndPackFloat64(flag zSign, int_fast16_t zExp, uint64_t zSig STATUS_PARAM)
 {
     int8 roundingMode;
     flag roundNearestEven;
-    int16 roundIncrement, roundBits;
+    int_fast16_t roundIncrement, roundBits;
     flag isTiny;
 
     roundingMode = STATUS(float_rounding_mode);
@@ -558,7 +558,7 @@ static float64 roundAndPackFloat64( flag zSign, int16 zExp, uint64_t zSig STATUS
 *----------------------------------------------------------------------------*/
 
 static float64
- normalizeRoundAndPackFloat64( flag zSign, int16 zExp, uint64_t zSig STATUS_PARAM)
+ normalizeRoundAndPackFloat64(flag zSign, int_fast16_t zExp, uint64_t zSig STATUS_PARAM)
 {
     int8 shiftCount;
 
@@ -1345,7 +1345,7 @@ float128 int64_to_float128( int64 a STATUS_PARAM )
 int32 float32_to_int32( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint32_t aSig;
     uint64_t aSig64;
 
@@ -1376,7 +1376,7 @@ int32 float32_to_int32( float32 a STATUS_PARAM )
 int32 float32_to_int32_round_to_zero( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint32_t aSig;
     int32_t z;
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -1416,10 +1416,10 @@ int32 float32_to_int32_round_to_zero( float32 a STATUS_PARAM )
 | returned.
 *----------------------------------------------------------------------------*/
 
-int16 float32_to_int16_round_to_zero( float32 a STATUS_PARAM )
+int_fast16_t float32_to_int16_round_to_zero(float32 a STATUS_PARAM)
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint32_t aSig;
     int32 z;
 
@@ -1468,7 +1468,7 @@ int16 float32_to_int16_round_to_zero( float32 a STATUS_PARAM )
 int64 float32_to_int64( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint32_t aSig;
     uint64_t aSig64, aSigExtra;
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -1505,7 +1505,7 @@ int64 float32_to_int64( float32 a STATUS_PARAM )
 int64 float32_to_int64_round_to_zero( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint32_t aSig;
     uint64_t aSig64;
     int64 z;
@@ -1549,7 +1549,7 @@ int64 float32_to_int64_round_to_zero( float32 a STATUS_PARAM )
 float64 float32_to_float64( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
     a = float32_squash_input_denormal(a STATUS_VAR);
 
@@ -1579,7 +1579,7 @@ float64 float32_to_float64( float32 a STATUS_PARAM )
 floatx80 float32_to_floatx80( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
 
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -1609,7 +1609,7 @@ floatx80 float32_to_floatx80( float32 a STATUS_PARAM )
 float128 float32_to_float128( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
 
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -1639,7 +1639,7 @@ float128 float32_to_float128( float32 a STATUS_PARAM )
 float32 float32_round_to_int( float32 a STATUS_PARAM)
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t lastBitMask, roundBitsMask;
     int8 roundingMode;
     uint32_t z;
@@ -1699,9 +1699,9 @@ float32 float32_round_to_int( float32 a STATUS_PARAM)
 
 static float32 addFloat32Sigs( float32 a, float32 b, flag zSign STATUS_PARAM)
 {
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint32_t aSig, bSig, zSig;
-    int16 expDiff;
+    int_fast16_t expDiff;
 
     aSig = extractFloat32Frac( a );
     aExp = extractFloat32Exp( a );
@@ -1778,9 +1778,9 @@ static float32 addFloat32Sigs( float32 a, float32 b, flag zSign STATUS_PARAM)
 
 static float32 subFloat32Sigs( float32 a, float32 b, flag zSign STATUS_PARAM)
 {
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint32_t aSig, bSig, zSig;
-    int16 expDiff;
+    int_fast16_t expDiff;
 
     aSig = extractFloat32Frac( a );
     aExp = extractFloat32Exp( a );
@@ -1898,7 +1898,7 @@ float32 float32_sub( float32 a, float32 b STATUS_PARAM )
 float32 float32_mul( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign, zSign;
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint32_t aSig, bSig;
     uint64_t zSig64;
     uint32_t zSig;
@@ -1961,7 +1961,7 @@ float32 float32_mul( float32 a, float32 b STATUS_PARAM )
 float32 float32_div( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, bSign, zSign;
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint32_t aSig, bSig, zSig;
     a = float32_squash_input_denormal(a STATUS_VAR);
     b = float32_squash_input_denormal(b STATUS_VAR);
@@ -2025,7 +2025,7 @@ float32 float32_div( float32 a, float32 b STATUS_PARAM )
 float32 float32_rem( float32 a, float32 b STATUS_PARAM )
 {
     flag aSign, zSign;
-    int16 aExp, bExp, expDiff;
+    int_fast16_t aExp, bExp, expDiff;
     uint32_t aSig, bSig;
     uint32_t q;
     uint64_t aSig64, bSig64, q64;
@@ -2131,7 +2131,7 @@ float32 float32_rem( float32 a, float32 b STATUS_PARAM )
 float32 float32_muladd(float32 a, float32 b, float32 c, int flags STATUS_PARAM)
 {
     flag aSign, bSign, cSign, zSign;
-    int16 aExp, bExp, cExp, pExp, zExp, expDiff;
+    int_fast16_t aExp, bExp, cExp, pExp, zExp, expDiff;
     uint32_t aSig, bSig, cSig;
     flag pInf, pZero, pSign;
     uint64_t pSig64, cSig64, zSig64;
@@ -2333,7 +2333,7 @@ float32 float32_muladd(float32 a, float32 b, float32 c, int flags STATUS_PARAM)
 float32 float32_sqrt( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, zExp;
+    int_fast16_t aExp, zExp;
     uint32_t aSig, zSig;
     uint64_t rem, term;
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -2419,7 +2419,7 @@ static const float64 float32_exp2_coefficients[15] =
 float32 float32_exp2( float32 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
     float64 r, x, xn;
     int i;
@@ -2467,7 +2467,7 @@ float32 float32_exp2( float32 a STATUS_PARAM )
 float32 float32_log2( float32 a STATUS_PARAM )
 {
     flag aSign, zSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig, zSig, i;
 
     a = float32_squash_input_denormal(a STATUS_VAR);
@@ -2732,7 +2732,7 @@ int float32_unordered_quiet( float32 a, float32 b STATUS_PARAM )
 int32 float64_to_int32( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint64_t aSig;
     a = float64_squash_input_denormal(a STATUS_VAR);
 
@@ -2760,7 +2760,7 @@ int32 float64_to_int32( float64 a STATUS_PARAM )
 int32 float64_to_int32_round_to_zero( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint64_t aSig, savedASig;
     int32_t z;
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -2804,10 +2804,10 @@ int32 float64_to_int32_round_to_zero( float64 a STATUS_PARAM )
 | returned.
 *----------------------------------------------------------------------------*/
 
-int16 float64_to_int16_round_to_zero( float64 a STATUS_PARAM )
+int_fast16_t float64_to_int16_round_to_zero(float64 a STATUS_PARAM)
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint64_t aSig, savedASig;
     int32 z;
 
@@ -2858,7 +2858,7 @@ int16 float64_to_int16_round_to_zero( float64 a STATUS_PARAM )
 int64 float64_to_int64( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint64_t aSig, aSigExtra;
     a = float64_squash_input_denormal(a STATUS_VAR);
 
@@ -2901,7 +2901,7 @@ int64 float64_to_int64( float64 a STATUS_PARAM )
 int64 float64_to_int64_round_to_zero( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, shiftCount;
+    int_fast16_t aExp, shiftCount;
     uint64_t aSig;
     int64 z;
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -2951,7 +2951,7 @@ int64 float64_to_int64_round_to_zero( float64 a STATUS_PARAM )
 float32 float64_to_float32( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t aSig;
     uint32_t zSig;
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -2984,7 +2984,7 @@ float32 float64_to_float32( float64 a STATUS_PARAM )
 | than the desired result exponent whenever `zSig' is a complete, normalized
 | significand.
 *----------------------------------------------------------------------------*/
-static float16 packFloat16(flag zSign, int16 zExp, uint16_t zSig)
+static float16 packFloat16(flag zSign, int_fast16_t zExp, uint16_t zSig)
 {
     return make_float16(
         (((uint32_t)zSign) << 15) + (((uint32_t)zExp) << 10) + zSig);
@@ -2996,7 +2996,7 @@ static float16 packFloat16(flag zSign, int16 zExp, uint16_t zSig)
 float32 float16_to_float32(float16 a, flag ieee STATUS_PARAM)
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
 
     aSign = extractFloat16Sign(a);
@@ -3026,7 +3026,7 @@ float32 float16_to_float32(float16 a, flag ieee STATUS_PARAM)
 float16 float32_to_float16(float32 a, flag ieee STATUS_PARAM)
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint32_t aSig;
     uint32_t mask;
     uint32_t increment;
@@ -3127,7 +3127,7 @@ float16 float32_to_float16(float32 a, flag ieee STATUS_PARAM)
 floatx80 float64_to_floatx80( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t aSig;
 
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -3158,7 +3158,7 @@ floatx80 float64_to_floatx80( float64 a STATUS_PARAM )
 float128 float64_to_float128( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t aSig, zSig0, zSig1;
 
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -3189,7 +3189,7 @@ float128 float64_to_float128( float64 a STATUS_PARAM )
 float64 float64_round_to_int( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t lastBitMask, roundBitsMask;
     int8 roundingMode;
     uint64_t z;
@@ -3262,9 +3262,9 @@ float64 float64_trunc_to_int( float64 a STATUS_PARAM)
 
 static float64 addFloat64Sigs( float64 a, float64 b, flag zSign STATUS_PARAM )
 {
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint64_t aSig, bSig, zSig;
-    int16 expDiff;
+    int_fast16_t expDiff;
 
     aSig = extractFloat64Frac( a );
     aExp = extractFloat64Exp( a );
@@ -3341,9 +3341,9 @@ static float64 addFloat64Sigs( float64 a, float64 b, flag zSign STATUS_PARAM )
 
 static float64 subFloat64Sigs( float64 a, float64 b, flag zSign STATUS_PARAM )
 {
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint64_t aSig, bSig, zSig;
-    int16 expDiff;
+    int_fast16_t expDiff;
 
     aSig = extractFloat64Frac( a );
     aExp = extractFloat64Exp( a );
@@ -3461,7 +3461,7 @@ float64 float64_sub( float64 a, float64 b STATUS_PARAM )
 float64 float64_mul( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign, zSign;
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint64_t aSig, bSig, zSig0, zSig1;
 
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -3522,7 +3522,7 @@ float64 float64_mul( float64 a, float64 b STATUS_PARAM )
 float64 float64_div( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, bSign, zSign;
-    int16 aExp, bExp, zExp;
+    int_fast16_t aExp, bExp, zExp;
     uint64_t aSig, bSig, zSig;
     uint64_t rem0, rem1;
     uint64_t term0, term1;
@@ -3594,7 +3594,7 @@ float64 float64_div( float64 a, float64 b STATUS_PARAM )
 float64 float64_rem( float64 a, float64 b STATUS_PARAM )
 {
     flag aSign, zSign;
-    int16 aExp, bExp, expDiff;
+    int_fast16_t aExp, bExp, expDiff;
     uint64_t aSig, bSig;
     uint64_t q, alternateASig;
     int64_t sigMean;
@@ -3685,7 +3685,7 @@ float64 float64_rem( float64 a, float64 b STATUS_PARAM )
 float64 float64_muladd(float64 a, float64 b, float64 c, int flags STATUS_PARAM)
 {
     flag aSign, bSign, cSign, zSign;
-    int16 aExp, bExp, cExp, pExp, zExp, expDiff;
+    int_fast16_t aExp, bExp, cExp, pExp, zExp, expDiff;
     uint64_t aSig, bSig, cSig;
     flag pInf, pZero, pSign;
     uint64_t pSig0, pSig1, cSig0, cSig1, zSig0, zSig1;
@@ -3900,7 +3900,7 @@ float64 float64_muladd(float64 a, float64 b, float64 c, int flags STATUS_PARAM)
 float64 float64_sqrt( float64 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp, zExp;
+    int_fast16_t aExp, zExp;
     uint64_t aSig, zSig, doubleZSig;
     uint64_t rem0, rem1, term0, term1;
     a = float64_squash_input_denormal(a STATUS_VAR);
@@ -3951,7 +3951,7 @@ float64 float64_sqrt( float64 a STATUS_PARAM )
 float64 float64_log2( float64 a STATUS_PARAM )
 {
     flag aSign, zSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t aSig, aSig0, aSig1, zSig, i;
     a = float64_squash_input_denormal(a STATUS_VAR);
 
@@ -4428,7 +4428,7 @@ float64 floatx80_to_float64( floatx80 a STATUS_PARAM )
 float128 floatx80_to_float128( floatx80 a STATUS_PARAM )
 {
     flag aSign;
-    int16 aExp;
+    int_fast16_t aExp;
     uint64_t aSig, zSig0, zSig1;
 
     aSig = extractFloatx80Frac( a );
diff --git a/fpu/softfloat.h b/fpu/softfloat.h
index 75246c4..feec3a1 100644
--- a/fpu/softfloat.h
+++ b/fpu/softfloat.h
@@ -57,9 +57,6 @@ these four paragraphs for those parts of this code that are retained.
 typedef uint8_t flag;
 typedef uint8_t uint8;
 typedef int8_t int8;
-#ifndef _AIX
-typedef int int16;
-#endif
 typedef unsigned int uint32;
 typedef signed int int32;
 typedef uint64_t uint64;
@@ -262,7 +259,7 @@ extern const float16 float16_default_nan;
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE single-precision conversion routines.
 *----------------------------------------------------------------------------*/
-int16 float32_to_int16_round_to_zero( float32 STATUS_PARAM );
+int_fast16_t float32_to_int16_round_to_zero(float32 STATUS_PARAM);
 uint_fast16_t float32_to_uint16_round_to_zero(float32 STATUS_PARAM);
 int32 float32_to_int32( float32 STATUS_PARAM );
 int32 float32_to_int32_round_to_zero( float32 STATUS_PARAM );
@@ -366,7 +363,7 @@ extern const float32 float32_default_nan;
 /*----------------------------------------------------------------------------
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
-int16 float64_to_int16_round_to_zero( float64 STATUS_PARAM );
+int_fast16_t float64_to_int16_round_to_zero(float64 STATUS_PARAM);
 uint_fast16_t float64_to_uint16_round_to_zero(float64 STATUS_PARAM);
 int32 float64_to_int32( float64 STATUS_PARAM );
 int32 float64_to_int32_round_to_zero( float64 STATUS_PARAM );
diff --git a/osdep.h b/osdep.h
index 095407d..9db8766 100644
--- a/osdep.h
+++ b/osdep.h
@@ -14,6 +14,7 @@
 /* [u]int_fast*_t not in <sys/int_types.h> */
 typedef unsigned char           uint_fast8_t;
 typedef unsigned int            uint_fast16_t;
+typedef signed int              int_fast16_t;
 #endif
 
 #ifndef glue
commit 5aea4c589aa16d30227a71e137faa9dca6a45748
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Apr 26 00:15:55 2012 +0200

    softfloat: Replace uint16 type with uint_fast16_t
    
    Based on the following Coccinelle patch:
    
    @@
    typedef uint16, uint_fast16_t;
    @@
    -uint16
    +uint_fast16_t
    
    Fixes the build of the Cocoa frontend on Mac OS X and avoids a
    workaround for AIX.
    
    For pre-10 Solaris include osdep.h.
    
    Reported-by: Pavel Borzenkov <pavel.borzenkov at gmail.com>
    Reported-by: Rui Carmo <rui.carmo at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: Juan Pineda <juan at logician.com>
    Cc: malc <av1474 at comtv.ru>
    Cc: Ben Taylor <bentaylor.solx86 at gmail.com>
    Tested-by: Bernhard Walle <bernhard at bwalle.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index a1c658e..50fce01 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -6443,10 +6443,10 @@ uint32 float32_to_uint32_round_to_zero( float32 a STATUS_PARAM )
     return res;
 }
 
-uint16 float32_to_uint16_round_to_zero( float32 a STATUS_PARAM )
+uint_fast16_t float32_to_uint16_round_to_zero(float32 a STATUS_PARAM)
 {
     int64_t v;
-    uint16 res;
+    uint_fast16_t res;
 
     v = float32_to_int64_round_to_zero(a STATUS_VAR);
     if (v < 0) {
@@ -6497,10 +6497,10 @@ uint32 float64_to_uint32_round_to_zero( float64 a STATUS_PARAM )
     return res;
 }
 
-uint16 float64_to_uint16_round_to_zero( float64 a STATUS_PARAM )
+uint_fast16_t float64_to_uint16_round_to_zero(float64 a STATUS_PARAM)
 {
     int64_t v;
-    uint16 res;
+    uint_fast16_t res;
 
     v = float64_to_int64_round_to_zero(a STATUS_VAR);
     if (v < 0) {
diff --git a/fpu/softfloat.h b/fpu/softfloat.h
index 2ce4110..75246c4 100644
--- a/fpu/softfloat.h
+++ b/fpu/softfloat.h
@@ -44,6 +44,7 @@ these four paragraphs for those parts of this code that are retained.
 
 #include <inttypes.h>
 #include "config-host.h"
+#include "osdep.h"
 
 /*----------------------------------------------------------------------------
 | Each of the following `typedef's defines the most convenient type that holds
@@ -57,7 +58,6 @@ typedef uint8_t flag;
 typedef uint8_t uint8;
 typedef int8_t int8;
 #ifndef _AIX
-typedef int uint16;
 typedef int int16;
 #endif
 typedef unsigned int uint32;
@@ -263,7 +263,7 @@ extern const float16 float16_default_nan;
 | Software IEC/IEEE single-precision conversion routines.
 *----------------------------------------------------------------------------*/
 int16 float32_to_int16_round_to_zero( float32 STATUS_PARAM );
-uint16 float32_to_uint16_round_to_zero( float32 STATUS_PARAM );
+uint_fast16_t float32_to_uint16_round_to_zero(float32 STATUS_PARAM);
 int32 float32_to_int32( float32 STATUS_PARAM );
 int32 float32_to_int32_round_to_zero( float32 STATUS_PARAM );
 uint32 float32_to_uint32( float32 STATUS_PARAM );
@@ -367,7 +367,7 @@ extern const float32 float32_default_nan;
 | Software IEC/IEEE double-precision conversion routines.
 *----------------------------------------------------------------------------*/
 int16 float64_to_int16_round_to_zero( float64 STATUS_PARAM );
-uint16 float64_to_uint16_round_to_zero( float64 STATUS_PARAM );
+uint_fast16_t float64_to_uint16_round_to_zero(float64 STATUS_PARAM);
 int32 float64_to_int32( float64 STATUS_PARAM );
 int32 float64_to_int32_round_to_zero( float64 STATUS_PARAM );
 uint32 float64_to_uint32( float64 STATUS_PARAM );
commit dda3c2ee335480c52acfe354d0f4d1198268f7b2
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Apr 26 00:15:54 2012 +0200

    target-mips: Move definition of uint_fast{8, 16}_t to osdep.h
    
    osdep.h is included via qemu-common.h.
    
    Prepares for use of [u]int_fast*_t types in softfloat code.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: Ben Taylor <bentaylor.solx86 at gmail.com>
    Cc: Aurélien Jarno <aurelien at aurel32.net>
    Cc: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Bernhard Walle <bernhard at bwalle.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/osdep.h b/osdep.h
index 428285c..095407d 100644
--- a/osdep.h
+++ b/osdep.h
@@ -10,6 +10,12 @@
 
 #include <sys/time.h>
 
+#if defined(CONFIG_SOLARIS) && CONFIG_SOLARIS_VERSION < 10
+/* [u]int_fast*_t not in <sys/int_types.h> */
+typedef unsigned char           uint_fast8_t;
+typedef unsigned int            uint_fast16_t;
+#endif
+
 #ifndef glue
 #define xglue(x, y) x ## y
 #define glue(x, y) xglue(x, y)
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 257c4c4..f156c06 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -15,13 +15,6 @@
 #include "cpu-defs.h"
 #include "softfloat.h"
 
-// uint_fast8_t and uint_fast16_t not in <sys/int_types.h>
-// XXX: move that elsewhere
-#if defined(CONFIG_SOLARIS) && CONFIG_SOLARIS_VERSION < 10
-typedef unsigned char           uint_fast8_t;
-typedef unsigned int            uint_fast16_t;
-#endif
-
 struct CPUMIPSState;
 
 typedef struct r4k_tlb_t r4k_tlb_t;
commit c9696547d4b2d4da9e27d87a56f246d0c6551b96
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Apr 26 00:15:53 2012 +0200

    softfloat: Fix mixups of int and int16
    
    normalizeFloat{32,64}Subnormal() expect the exponent as int16, not int.
    This went unnoticed since int16 and uint16 were both typedef'ed to int.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Tested-by: Bernhard Walle <bernhard at bwalle.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index 9e1b5f9..a1c658e 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -2131,7 +2131,7 @@ float32 float32_rem( float32 a, float32 b STATUS_PARAM )
 float32 float32_muladd(float32 a, float32 b, float32 c, int flags STATUS_PARAM)
 {
     flag aSign, bSign, cSign, zSign;
-    int aExp, bExp, cExp, pExp, zExp, expDiff;
+    int16 aExp, bExp, cExp, pExp, zExp, expDiff;
     uint32_t aSig, bSig, cSig;
     flag pInf, pZero, pSign;
     uint64_t pSig64, cSig64, zSig64;
@@ -3685,7 +3685,7 @@ float64 float64_rem( float64 a, float64 b STATUS_PARAM )
 float64 float64_muladd(float64 a, float64 b, float64 c, int flags STATUS_PARAM)
 {
     flag aSign, bSign, cSign, zSign;
-    int aExp, bExp, cExp, pExp, zExp, expDiff;
+    int16 aExp, bExp, cExp, pExp, zExp, expDiff;
     uint64_t aSig, bSig, cSig;
     flag pInf, pZero, pSign;
     uint64_t pSig0, pSig1, cSig0, cSig1, zSig0, zSig1;
commit c4c50b9edd61140af5112b196b75057ab5d98b4e
Merge: 2ff0f66... 10962fd...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 28 08:57:56 2012 +0000

    Merge branch 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm
    
    * 'target-arm.for-upstream' of git://git.linaro.org/people/pmaydell/qemu-arm:
      target-arm: Make SETEND respect bswap_code (BE8) setting
      target-arm: Move A9 config_base_address reset value to ARMCPU
      target-arm: Change cpu_arm_init() return type to ARMCPU

commit 2ff0f668512bde20ef9e7ee3216ccc353830e6fd
Merge: a8b69b8... 9a14b29...
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 28 08:19:50 2012 +0000

    Merge branch 'timer' of git://qemu.weilnetz.de/qemu
    
    * 'timer' of git://qemu.weilnetz.de/qemu:
      qemu-timer: Optimize data structures
      qemu-timer: Remove function alarm_has_dynticks
      qemu-timer: Use bool, false, true for boolean values
      qemu-timer: Remove unused function qemu_alarm_pending
      qemu-timer: Remove redundant include statements

commit a8b69b8e2431edfcb6c4cfb069787e9071d6235b
Merge: a75bfc5... b3c83a2...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Apr 27 12:00:06 2012 -0500

    Merge remote-tracking branch 'qmp/queue/qmp' into staging
    
    * qmp/queue/qmp:
      qapi: fix qmp_balloon() conversion
      qemu-iotests: add block-stream speed value test case
      block: add 'speed' optional parameter to block-stream
      block: change block-job-set-speed argument from 'value' to 'speed'
      block: use Error mechanism instead of -errno for block_job_set_speed()
      block: use Error mechanism instead of -errno for block_job_create()

commit b3c83a2265261594d0a24507a17ad2f5c83eea81
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Thu Apr 26 17:15:02 2012 -0300

    qapi: fix qmp_balloon() conversion
    
    Commit d72f326431 forgot to convert a call from qerror_report() to
    error_set(). Fix it.
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/balloon.c b/balloon.c
index 0166744..aa354f7 100644
--- a/balloon.c
+++ b/balloon.c
@@ -108,7 +108,7 @@ void qmp_balloon(int64_t value, Error **errp)
     }
 
     if (value <= 0) {
-        qerror_report(QERR_INVALID_PARAMETER_VALUE, "target", "a size");
+        error_set(errp, QERR_INVALID_PARAMETER_VALUE, "target", "a size");
         return;
     }
     
commit e425306a27ef02b6ef19408d588974953f0f28c0
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 16:51:04 2012 +0100

    qemu-iotests: add block-stream speed value test case
    
    Add tests to exercise the InvalidParameter 'speed' error code path, as
    well as the regular success case for setting the speed.  The
    block-stream 'speed' parameter allows the speed limit of the job to be
    applied immediately when the job starts instead of issuing a separate
    block-job-set-speed command later.  If the parameter has an invalid
    value we expect to get an error and the job is not created.
    
    It turns out that cancelling a block job is a common operation in these
    test cases, let's extract a cancel_and_wait() function instead of
    duplicating the QMP commands.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030
index 978fd82..38abc2c 100755
--- a/tests/qemu-iotests/030
+++ b/tests/qemu-iotests/030
@@ -32,6 +32,21 @@ class ImageStreamingTestCase(iotests.QMPTestCase):
         result = self.vm.qmp('query-block-jobs')
         self.assert_qmp(result, 'return', [])
 
+    def cancel_and_wait(self, drive='drive0'):
+        '''Cancel a block job and wait for it to finish'''
+        result = self.vm.qmp('block-job-cancel', device=drive)
+        self.assert_qmp(result, 'return', {})
+
+        cancelled = False
+        while not cancelled:
+            for event in self.vm.get_qmp_events(wait=True):
+                if event['event'] == 'BLOCK_JOB_CANCELLED':
+                    self.assert_qmp(event, 'data/type', 'stream')
+                    self.assert_qmp(event, 'data/device', drive)
+                    cancelled = True
+
+        self.assert_no_active_streams()
+
 class TestSingleDrive(ImageStreamingTestCase):
     image_len = 1 * 1024 * 1024 # MB
 
@@ -97,21 +112,8 @@ class TestStreamStop(ImageStreamingTestCase):
         events = self.vm.get_qmp_events(wait=False)
         self.assertEqual(events, [], 'unexpected QMP event: %s' % events)
 
-        self.vm.qmp('block-job-cancel', device='drive0')
-        self.assert_qmp(result, 'return', {})
+        self.cancel_and_wait()
 
-        cancelled = False
-        while not cancelled:
-            for event in self.vm.get_qmp_events(wait=True):
-                if event['event'] == 'BLOCK_JOB_CANCELLED':
-                    self.assert_qmp(event, 'data/type', 'stream')
-                    self.assert_qmp(event, 'data/device', 'drive0')
-                    cancelled = True
-
-        self.assert_no_active_streams()
-
-# This is a short performance test which is not run by default.
-# Invoke "IMGFMT=qed ./030 TestSetSpeed.perf_test_set_speed"
 class TestSetSpeed(ImageStreamingTestCase):
     image_len = 80 * 1024 * 1024 # MB
 
@@ -126,13 +128,15 @@ class TestSetSpeed(ImageStreamingTestCase):
         os.remove(test_img)
         os.remove(backing_img)
 
-    def perf_test_set_speed(self):
+    # This is a short performance test which is not run by default.
+    # Invoke "IMGFMT=qed ./030 TestSetSpeed.perf_test_throughput"
+    def perf_test_throughput(self):
         self.assert_no_active_streams()
 
         result = self.vm.qmp('block-stream', device='drive0')
         self.assert_qmp(result, 'return', {})
 
-        result = self.vm.qmp('block-job-set-speed', device='drive0', value=8 * 1024 * 1024)
+        result = self.vm.qmp('block-job-set-speed', device='drive0', speed=8 * 1024 * 1024)
         self.assert_qmp(result, 'return', {})
 
         completed = False
@@ -147,5 +151,54 @@ class TestSetSpeed(ImageStreamingTestCase):
 
         self.assert_no_active_streams()
 
+    def test_set_speed(self):
+        self.assert_no_active_streams()
+
+        result = self.vm.qmp('block-stream', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        # Default speed is 0
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 0)
+
+        result = self.vm.qmp('block-job-set-speed', device='drive0', speed=8 * 1024 * 1024)
+        self.assert_qmp(result, 'return', {})
+
+        # Ensure the speed we set was accepted
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 8 * 1024 * 1024)
+
+        self.cancel_and_wait()
+
+        # Check setting speed in block-stream works
+        result = self.vm.qmp('block-stream', device='drive0', speed=4 * 1024 * 1024)
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('query-block-jobs')
+        self.assert_qmp(result, 'return[0]/device', 'drive0')
+        self.assert_qmp(result, 'return[0]/speed', 4 * 1024 * 1024)
+
+        self.cancel_and_wait()
+
+    def test_set_speed_invalid(self):
+        self.assert_no_active_streams()
+
+        result = self.vm.qmp('block-stream', device='drive0', speed=-1)
+        self.assert_qmp(result, 'error/class', 'InvalidParameter')
+        self.assert_qmp(result, 'error/data/name', 'speed')
+
+        self.assert_no_active_streams()
+
+        result = self.vm.qmp('block-stream', device='drive0')
+        self.assert_qmp(result, 'return', {})
+
+        result = self.vm.qmp('block-job-set-speed', device='drive0', speed=-1)
+        self.assert_qmp(result, 'error/class', 'InvalidParameter')
+        self.assert_qmp(result, 'error/data/name', 'speed')
+
+        self.cancel_and_wait()
+
 if __name__ == '__main__':
     iotests.main(supported_fmts=['qcow2', 'qed'])
diff --git a/tests/qemu-iotests/030.out b/tests/qemu-iotests/030.out
index 8d7e996..914e373 100644
--- a/tests/qemu-iotests/030.out
+++ b/tests/qemu-iotests/030.out
@@ -1,5 +1,5 @@
-...
+.....
 ----------------------------------------------------------------------
-Ran 3 tests
+Ran 5 tests
 
 OK
commit c83c66c3b58893a4dc056e272822beb88fe9ec7f
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 16:51:03 2012 +0100

    block: add 'speed' optional parameter to block-stream
    
    Allow streaming operations to be started with an initial speed limit.
    This eliminates the window of time between starting streaming and
    issuing block-job-set-speed.  Users should use the new optional 'speed'
    parameter instead so that speed limits are in effect immediately when
    the job starts.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/block.c b/block.c
index 1ab6e52..43c794c 100644
--- a/block.c
+++ b/block.c
@@ -4083,8 +4083,8 @@ out:
 }
 
 void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
-                       BlockDriverCompletionFunc *cb, void *opaque,
-                       Error **errp)
+                       int64_t speed, BlockDriverCompletionFunc *cb,
+                       void *opaque, Error **errp)
 {
     BlockJob *job;
 
@@ -4100,6 +4100,20 @@ void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
     job->cb            = cb;
     job->opaque        = opaque;
     bs->job = job;
+
+    /* Only set speed when necessary to avoid NotSupported error */
+    if (speed != 0) {
+        Error *local_err = NULL;
+
+        block_job_set_speed(job, speed, &local_err);
+        if (error_is_set(&local_err)) {
+            bs->job = NULL;
+            g_free(job);
+            bdrv_set_in_use(bs, 0);
+            error_propagate(errp, local_err);
+            return NULL;
+        }
+    }
     return job;
 }
 
diff --git a/block/stream.c b/block/stream.c
index b66242a..6724af2 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -281,13 +281,14 @@ static BlockJobType stream_job_type = {
 };
 
 void stream_start(BlockDriverState *bs, BlockDriverState *base,
-                  const char *base_id, BlockDriverCompletionFunc *cb,
+                  const char *base_id, int64_t speed,
+                  BlockDriverCompletionFunc *cb,
                   void *opaque, Error **errp)
 {
     StreamBlockJob *s;
     Coroutine *co;
 
-    s = block_job_create(&stream_job_type, bs, cb, opaque, errp);
+    s = block_job_create(&stream_job_type, bs, speed, cb, opaque, errp);
     if (!s) {
         return;
     }
diff --git a/block_int.h b/block_int.h
index 624b2e6..086832a 100644
--- a/block_int.h
+++ b/block_int.h
@@ -344,6 +344,7 @@ int is_windows_drive(const char *filename);
  * block_job_create:
  * @job_type: The class object for the newly-created job.
  * @bs: The block
+ * @speed: The maximum speed, in bytes per second, or 0 for unlimited.
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
  * @errp: Error object.
@@ -358,8 +359,8 @@ int is_windows_drive(const char *filename);
  * called from a wrapper that is specific to the job type.
  */
 void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
-                       BlockDriverCompletionFunc *cb, void *opaque,
-                       Error **errp);
+                       int64_t speed, BlockDriverCompletionFunc *cb,
+                       void *opaque, Error **errp);
 
 /**
  * block_job_complete:
@@ -418,6 +419,7 @@ void block_job_cancel_sync(BlockJob *job);
  * flatten the whole backing file chain onto @bs.
  * @base_id: The file name that will be written to @bs as the new
  * backing file if the job completes.  Ignored if @base is %NULL.
+ * @speed: The maximum speed, in bytes per second, or 0 for unlimited.
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
  * @errp: Error object.
@@ -429,7 +431,8 @@ void block_job_cancel_sync(BlockJob *job);
  * @base_id in the written image and to @base in the live BlockDriverState.
  */
 void stream_start(BlockDriverState *bs, BlockDriverState *base,
-                  const char *base_id, BlockDriverCompletionFunc *cb,
+                  const char *base_id, int64_t speed,
+                  BlockDriverCompletionFunc *cb,
                   void *opaque, Error **errp);
 
 #endif /* BLOCK_INT_H */
diff --git a/blockdev.c b/blockdev.c
index 80b62c3..d25ffea 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1091,7 +1091,8 @@ static void block_stream_cb(void *opaque, int ret)
 }
 
 void qmp_block_stream(const char *device, bool has_base,
-                      const char *base, Error **errp)
+                      const char *base, bool has_speed,
+                      int64_t speed, Error **errp)
 {
     BlockDriverState *bs;
     BlockDriverState *base_bs = NULL;
@@ -1111,7 +1112,8 @@ void qmp_block_stream(const char *device, bool has_base,
         }
     }
 
-    stream_start(bs, base_bs, base, block_stream_cb, bs, &local_err);
+    stream_start(bs, base_bs, base, has_speed ? speed : 0,
+                 block_stream_cb, bs, &local_err);
     if (error_is_set(&local_err)) {
         error_propagate(errp, local_err);
         return;
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 8a929f0..18cb415 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -71,8 +71,8 @@ ETEXI
 
     {
         .name       = "block_stream",
-        .args_type  = "device:B,base:s?",
-        .params     = "device [base]",
+        .args_type  = "device:B,speed:o?,base:s?",
+        .params     = "device [speed [base]]",
         .help       = "copy data from a backing file into a block device",
         .mhandler.cmd = hmp_block_stream,
     },
diff --git a/hmp.c b/hmp.c
index f3e5163..eb96618 100644
--- a/hmp.c
+++ b/hmp.c
@@ -835,8 +835,10 @@ void hmp_block_stream(Monitor *mon, const QDict *qdict)
     Error *error = NULL;
     const char *device = qdict_get_str(qdict, "device");
     const char *base = qdict_get_try_str(qdict, "base");
+    int64_t speed = qdict_get_try_int(qdict, "speed", 0);
 
-    qmp_block_stream(device, base != NULL, base, &error);
+    qmp_block_stream(device, base != NULL, base,
+                     qdict_haskey(qdict, "speed"), speed, &error);
 
     hmp_handle_error(mon, &error);
 }
diff --git a/qapi-schema.json b/qapi-schema.json
index d56fcb6..9193fb9 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1571,15 +1571,19 @@
 #
 # @base:   #optional the common backing file name
 #
+# @speed:  #optional the maximum speed, in bytes per second
+#
 # Returns: Nothing on success
 #          If streaming is already active on this device, DeviceInUse
 #          If @device does not exist, DeviceNotFound
 #          If image streaming is not supported by this device, NotSupported
 #          If @base does not exist, BaseNotFound
+#          If @speed is invalid, InvalidParameter
 #
 # Since: 1.1
 ##
-{ 'command': 'block-stream', 'data': { 'device': 'str', '*base': 'str' } }
+{ 'command': 'block-stream', 'data': { 'device': 'str', '*base': 'str',
+                                       '*speed': 'int' } }
 
 ##
 # @block-job-set-speed:
@@ -1592,7 +1596,8 @@
 #
 # @device: the device name
 #
-# @speed:  the maximum speed, in bytes per second
+# @speed:  the maximum speed, in bytes per second, or 0 for unlimited.
+#          Defaults to 0.
 #
 # Returns: Nothing on success
 #          If the job type does not support throttling, NotSupported
diff --git a/qmp-commands.hx b/qmp-commands.hx
index b07ed59..c810c74 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -688,7 +688,7 @@ EQMP
 
     {
         .name       = "block-stream",
-        .args_type  = "device:B,base:s?",
+        .args_type  = "device:B,base:s?,speed:o?",
         .mhandler.cmd_new = qmp_marshal_input_block_stream,
     },
 
commit 882ec7ce531091bc0f3ffc6ac71943cf383f86a6
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 16:51:02 2012 +0100

    block: change block-job-set-speed argument from 'value' to 'speed'
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/block.c b/block.c
index dc02736..1ab6e52 100644
--- a/block.c
+++ b/block.c
@@ -4114,7 +4114,7 @@ void block_job_complete(BlockJob *job, int ret)
     bdrv_set_in_use(bs, 0);
 }
 
-void block_job_set_speed(BlockJob *job, int64_t value, Error **errp)
+void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp)
 {
     Error *local_err = NULL;
 
@@ -4122,13 +4122,13 @@ void block_job_set_speed(BlockJob *job, int64_t value, Error **errp)
         error_set(errp, QERR_NOT_SUPPORTED);
         return;
     }
-    job->job_type->set_speed(job, value, &local_err);
+    job->job_type->set_speed(job, speed, &local_err);
     if (error_is_set(&local_err)) {
         error_propagate(errp, local_err);
         return;
     }
 
-    job->speed = value;
+    job->speed = speed;
 }
 
 void block_job_cancel(BlockJob *job)
diff --git a/block/stream.c b/block/stream.c
index 06bc70a..b66242a 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -263,15 +263,15 @@ retry:
     block_job_complete(&s->common, ret);
 }
 
-static void stream_set_speed(BlockJob *job, int64_t value, Error **errp)
+static void stream_set_speed(BlockJob *job, int64_t speed, Error **errp)
 {
     StreamBlockJob *s = container_of(job, StreamBlockJob, common);
 
-    if (value < 0) {
-        error_set(errp, QERR_INVALID_PARAMETER, "value");
+    if (speed < 0) {
+        error_set(errp, QERR_INVALID_PARAMETER, "speed");
         return;
     }
-    ratelimit_set_speed(&s->limit, value / BDRV_SECTOR_SIZE);
+    ratelimit_set_speed(&s->limit, speed / BDRV_SECTOR_SIZE);
 }
 
 static BlockJobType stream_job_type = {
diff --git a/block_int.h b/block_int.h
index e042676..624b2e6 100644
--- a/block_int.h
+++ b/block_int.h
@@ -79,7 +79,7 @@ typedef struct BlockJobType {
     const char *job_type;
 
     /** Optional callback for job types that support setting a speed limit */
-    void (*set_speed)(BlockJob *job, int64_t value, Error **errp);
+    void (*set_speed)(BlockJob *job, int64_t speed, Error **errp);
 } BlockJobType;
 
 /**
@@ -380,7 +380,7 @@ void block_job_complete(BlockJob *job, int ret);
  * Set a rate-limiting parameter for the job; the actual meaning may
  * vary depending on the job type.
  */
-void block_job_set_speed(BlockJob *job, int64_t value, Error **errp);
+void block_job_set_speed(BlockJob *job, int64_t speed, Error **errp);
 
 /**
  * block_job_cancel:
diff --git a/blockdev.c b/blockdev.c
index 7073330..80b62c3 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1136,7 +1136,7 @@ static BlockJob *find_block_job(const char *device)
     return bs->job;
 }
 
-void qmp_block_job_set_speed(const char *device, int64_t value, Error **errp)
+void qmp_block_job_set_speed(const char *device, int64_t speed, Error **errp)
 {
     BlockJob *job = find_block_job(device);
 
@@ -1145,7 +1145,7 @@ void qmp_block_job_set_speed(const char *device, int64_t value, Error **errp)
         return;
     }
 
-    block_job_set_speed(job, value, errp);
+    block_job_set_speed(job, speed, errp);
 }
 
 void qmp_block_job_cancel(const char *device, Error **errp)
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 461fa59..8a929f0 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -85,8 +85,8 @@ ETEXI
 
     {
         .name       = "block_job_set_speed",
-        .args_type  = "device:B,value:o",
-        .params     = "device value",
+        .args_type  = "device:B,speed:o",
+        .params     = "device speed",
         .help       = "set maximum speed for a background block operation",
         .mhandler.cmd = hmp_block_job_set_speed,
     },
diff --git a/qapi-schema.json b/qapi-schema.json
index 49f1e16..d56fcb6 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1592,7 +1592,7 @@
 #
 # @device: the device name
 #
-# @value:  the maximum speed, in bytes per second
+# @speed:  the maximum speed, in bytes per second
 #
 # Returns: Nothing on success
 #          If the job type does not support throttling, NotSupported
@@ -1602,7 +1602,7 @@
 # Since: 1.1
 ##
 { 'command': 'block-job-set-speed',
-  'data': { 'device': 'str', 'value': 'int' } }
+  'data': { 'device': 'str', 'speed': 'int' } }
 
 ##
 # @block-job-cancel:
diff --git a/qmp-commands.hx b/qmp-commands.hx
index f972332..b07ed59 100644
--- a/qmp-commands.hx
+++ b/qmp-commands.hx
@@ -694,7 +694,7 @@ EQMP
 
     {
         .name       = "block-job-set-speed",
-        .args_type  = "device:B,value:o",
+        .args_type  = "device:B,speed:o",
         .mhandler.cmd_new = qmp_marshal_input_block_job_set_speed,
     },
 
commit 9e6636c72d8d6f0605e23ed820c8487686882b12
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 16:51:01 2012 +0100

    block: use Error mechanism instead of -errno for block_job_set_speed()
    
    There are at least two different errors that can occur in
    block_job_set_speed(): the job might not support setting speeds or the
    value might be invalid.
    
    Use the Error mechanism to report the error where it occurs.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/block.c b/block.c
index 2b72a0f..dc02736 100644
--- a/block.c
+++ b/block.c
@@ -4114,18 +4114,21 @@ void block_job_complete(BlockJob *job, int ret)
     bdrv_set_in_use(bs, 0);
 }
 
-int block_job_set_speed(BlockJob *job, int64_t value)
+void block_job_set_speed(BlockJob *job, int64_t value, Error **errp)
 {
-    int rc;
+    Error *local_err = NULL;
 
     if (!job->job_type->set_speed) {
-        return -ENOTSUP;
+        error_set(errp, QERR_NOT_SUPPORTED);
+        return;
     }
-    rc = job->job_type->set_speed(job, value);
-    if (rc == 0) {
-        job->speed = value;
+    job->job_type->set_speed(job, value, &local_err);
+    if (error_is_set(&local_err)) {
+        error_propagate(errp, local_err);
+        return;
     }
-    return rc;
+
+    job->speed = value;
 }
 
 void block_job_cancel(BlockJob *job)
diff --git a/block/stream.c b/block/stream.c
index 7002dc8..06bc70a 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -263,15 +263,15 @@ retry:
     block_job_complete(&s->common, ret);
 }
 
-static int stream_set_speed(BlockJob *job, int64_t value)
+static void stream_set_speed(BlockJob *job, int64_t value, Error **errp)
 {
     StreamBlockJob *s = container_of(job, StreamBlockJob, common);
 
     if (value < 0) {
-        return -EINVAL;
+        error_set(errp, QERR_INVALID_PARAMETER, "value");
+        return;
     }
     ratelimit_set_speed(&s->limit, value / BDRV_SECTOR_SIZE);
-    return 0;
 }
 
 static BlockJobType stream_job_type = {
diff --git a/block_int.h b/block_int.h
index e70a33e..e042676 100644
--- a/block_int.h
+++ b/block_int.h
@@ -79,7 +79,7 @@ typedef struct BlockJobType {
     const char *job_type;
 
     /** Optional callback for job types that support setting a speed limit */
-    int (*set_speed)(BlockJob *job, int64_t value);
+    void (*set_speed)(BlockJob *job, int64_t value, Error **errp);
 } BlockJobType;
 
 /**
@@ -375,11 +375,12 @@ void block_job_complete(BlockJob *job, int ret);
  * block_job_set_speed:
  * @job: The job to set the speed for.
  * @speed: The new value
+ * @errp: Error object.
  *
  * Set a rate-limiting parameter for the job; the actual meaning may
  * vary depending on the job type.
  */
-int block_job_set_speed(BlockJob *job, int64_t value);
+void block_job_set_speed(BlockJob *job, int64_t value, Error **errp);
 
 /**
  * block_job_cancel:
diff --git a/blockdev.c b/blockdev.c
index a411477..7073330 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1145,9 +1145,7 @@ void qmp_block_job_set_speed(const char *device, int64_t value, Error **errp)
         return;
     }
 
-    if (block_job_set_speed(job, value) < 0) {
-        error_set(errp, QERR_NOT_SUPPORTED);
-    }
+    block_job_set_speed(job, value, errp);
 }
 
 void qmp_block_job_cancel(const char *device, Error **errp)
diff --git a/qapi-schema.json b/qapi-schema.json
index 6499895..49f1e16 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1596,6 +1596,7 @@
 #
 # Returns: Nothing on success
 #          If the job type does not support throttling, NotSupported
+#          If the speed value is invalid, InvalidParameter
 #          If streaming is not active on this device, DeviceNotActive
 #
 # Since: 1.1
commit fd7f8c65377ee918479e43b38d44f54f13aa6548
Author: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
Date:   Wed Apr 25 16:51:00 2012 +0100

    block: use Error mechanism instead of -errno for block_job_create()
    
    The block job API uses -errno return values internally and we convert
    these to Error in the QMP functions.  This is ugly because the Error
    should be created at the point where we still have all the relevant
    information.  More importantly, it is hard to add new error cases to
    this case since we quickly run out of -errno values without losing
    information.
    
    Go ahead and use Error directly and don't convert later.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/block.c b/block.c
index fe74ddd..2b72a0f 100644
--- a/block.c
+++ b/block.c
@@ -4083,11 +4083,13 @@ out:
 }
 
 void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
-                       BlockDriverCompletionFunc *cb, void *opaque)
+                       BlockDriverCompletionFunc *cb, void *opaque,
+                       Error **errp)
 {
     BlockJob *job;
 
     if (bs->job || bdrv_in_use(bs)) {
+        error_set(errp, QERR_DEVICE_IN_USE, bdrv_get_device_name(bs));
         return NULL;
     }
     bdrv_set_in_use(bs, 1);
diff --git a/block/stream.c b/block/stream.c
index 0efe1ad..7002dc8 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -280,16 +280,16 @@ static BlockJobType stream_job_type = {
     .set_speed     = stream_set_speed,
 };
 
-int stream_start(BlockDriverState *bs, BlockDriverState *base,
-                 const char *base_id, BlockDriverCompletionFunc *cb,
-                 void *opaque)
+void stream_start(BlockDriverState *bs, BlockDriverState *base,
+                  const char *base_id, BlockDriverCompletionFunc *cb,
+                  void *opaque, Error **errp)
 {
     StreamBlockJob *s;
     Coroutine *co;
 
-    s = block_job_create(&stream_job_type, bs, cb, opaque);
+    s = block_job_create(&stream_job_type, bs, cb, opaque, errp);
     if (!s) {
-        return -EBUSY; /* bs must already be in use */
+        return;
     }
 
     s->base = base;
@@ -300,5 +300,4 @@ int stream_start(BlockDriverState *bs, BlockDriverState *base,
     co = qemu_coroutine_create(stream_run);
     trace_stream_start(bs, base, s, co, opaque);
     qemu_coroutine_enter(co, s);
-    return 0;
 }
diff --git a/block_int.h b/block_int.h
index 0acb49f..e70a33e 100644
--- a/block_int.h
+++ b/block_int.h
@@ -346,6 +346,7 @@ int is_windows_drive(const char *filename);
  * @bs: The block
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
+ * @errp: Error object.
  *
  * Create a new long-running block device job and return it.  The job
  * will call @cb asynchronously when the job completes.  Note that
@@ -357,7 +358,8 @@ int is_windows_drive(const char *filename);
  * called from a wrapper that is specific to the job type.
  */
 void *block_job_create(const BlockJobType *job_type, BlockDriverState *bs,
-                       BlockDriverCompletionFunc *cb, void *opaque);
+                       BlockDriverCompletionFunc *cb, void *opaque,
+                       Error **errp);
 
 /**
  * block_job_complete:
@@ -417,6 +419,7 @@ void block_job_cancel_sync(BlockJob *job);
  * backing file if the job completes.  Ignored if @base is %NULL.
  * @cb: Completion function for the job.
  * @opaque: Opaque pointer value passed to @cb.
+ * @errp: Error object.
  *
  * Start a streaming operation on @bs.  Clusters that are unallocated
  * in @bs, but allocated in any image between @base and @bs (both
@@ -424,8 +427,8 @@ void block_job_cancel_sync(BlockJob *job);
  * streaming job, the backing file of @bs will be changed to
  * @base_id in the written image and to @base in the live BlockDriverState.
  */
-int stream_start(BlockDriverState *bs, BlockDriverState *base,
-                 const char *base_id, BlockDriverCompletionFunc *cb,
-                 void *opaque);
+void stream_start(BlockDriverState *bs, BlockDriverState *base,
+                  const char *base_id, BlockDriverCompletionFunc *cb,
+                  void *opaque, Error **errp);
 
 #endif /* BLOCK_INT_H */
diff --git a/blockdev.c b/blockdev.c
index 0c2440e..a411477 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -1095,7 +1095,7 @@ void qmp_block_stream(const char *device, bool has_base,
 {
     BlockDriverState *bs;
     BlockDriverState *base_bs = NULL;
-    int ret;
+    Error *local_err = NULL;
 
     bs = bdrv_find(device);
     if (!bs) {
@@ -1111,16 +1111,10 @@ void qmp_block_stream(const char *device, bool has_base,
         }
     }
 
-    ret = stream_start(bs, base_bs, base, block_stream_cb, bs);
-    if (ret < 0) {
-        switch (ret) {
-        case -EBUSY:
-            error_set(errp, QERR_DEVICE_IN_USE, device);
-            return;
-        default:
-            error_set(errp, QERR_NOT_SUPPORTED);
-            return;
-        }
+    stream_start(bs, base_bs, base, block_stream_cb, bs, &local_err);
+    if (error_is_set(&local_err)) {
+        error_propagate(errp, local_err);
+        return;
     }
 
     /* Grab a reference so hotplug does not delete the BlockDriverState from
commit 10962fd510bb381acc6694156bd675e5d86f32d8
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Apr 24 18:05:05 2012 +0000

    target-arm: Make SETEND respect bswap_code (BE8) setting
    
    Make the SETEND instruction respect the setting of bswap_code,
    so that in BE8 mode we UNDEF for attempts to switch into
    little-endian mode and nop for attempts to stay in big-endian
    mode. (This is the inverse of the existing handling of SETEND
    in the more common little-endian setup, which we use since
    we don't implement the architecturally-mandated dynamic
    endianness switching.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/translate.c b/target-arm/translate.c
index 7a3c7d6..437d9db 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -6767,8 +6767,8 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
         if ((insn & 0x0ffffdff) == 0x01010000) {
             ARCH(6);
             /* setend */
-            if (insn & (1 << 9)) {
-                /* BE8 mode not implemented.  */
+            if (((insn >> 9) & 1) != s->bswap_code) {
+                /* Dynamic endianness switching not implemented. */
                 goto illegal_op;
             }
             return;
@@ -9710,8 +9710,8 @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
             case 2:
                 /* setend */
                 ARCH(6);
-                if (insn & (1 << 3)) {
-                    /* BE8 mode not implemented.  */
+                if (((insn >> 3) & 1) != s->bswap_code) {
+                    /* Dynamic endianness switching not implemented. */
                     goto illegal_op;
                 }
                 break;
commit c5fad12fa08228d0c2f04089ba0cd27718f1b723
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 20 07:39:15 2012 +0000

    target-arm: Move A9 config_base_address reset value to ARMCPU
    
    Move the A9 config_base_address cp15 register reset value to
    ARMCPU. This should become a QOM property so that the Highbank
    board can set it without having to pull in cpu-qom.h, but at
    least this avoids the implicit dependency on reset ordering
    that the previous workaround had.
    
    Cc: Mark Langsdorf <mark.langsdorf at calxeda.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/highbank.c b/hw/highbank.c
index 906eed5..4d6d728 100644
--- a/hw/highbank.c
+++ b/hw/highbank.c
@@ -35,12 +35,6 @@
 #define NIRQ_GIC      160
 
 /* Board init.  */
-static void highbank_cpu_reset(void *opaque)
-{
-    CPUARMState *env = opaque;
-
-    env->cp15.c15_config_base_address = GIC_BASE_ADDR;
-}
 
 static void hb_write_secondary(CPUARMState *env, const struct arm_boot_info *info)
 {
@@ -213,14 +207,17 @@ static void highbank_init(ram_addr_t ram_size,
     }
 
     for (n = 0; n < smp_cpus; n++) {
-        env = cpu_init(cpu_model);
-        if (!env) {
+        ARMCPU *cpu;
+        cpu = cpu_arm_init(cpu_model);
+        if (cpu == NULL) {
             fprintf(stderr, "Unable to find CPU definition\n");
             exit(1);
         }
+        env = &cpu->env;
+        /* This will become a QOM property eventually */
+        cpu->reset_cbar = GIC_BASE_ADDR;
         irqp = arm_pic_init_cpu(env);
         cpu_irq[n] = irqp[ARM_PIC_CPU_IRQ];
-        qemu_register_reset(highbank_cpu_reset, env);
     }
 
     sysmem = get_system_memory();
diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 2891521..a61c68d 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -93,6 +93,7 @@ typedef struct ARMCPU {
      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
      */
     uint32_t ccsidr[16];
+    uint32_t reset_cbar;
 } ARMCPU;
 
 static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 2e0eccd..7eb323a 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -30,7 +30,6 @@ static void arm_cpu_reset(CPUState *s)
     ARMCPU *cpu = ARM_CPU(s);
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(cpu);
     CPUARMState *env = &cpu->env;
-    uint32_t tmp = 0;
 
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
         qemu_log("CPU Reset (CPU %d)\n", env->cpu_index);
@@ -39,9 +38,8 @@ static void arm_cpu_reset(CPUState *s)
 
     acc->parent_reset(s);
 
-    tmp = env->cp15.c15_config_base_address;
     memset(env, 0, offsetof(CPUARMState, breakpoints));
-    env->cp15.c15_config_base_address = tmp;
+    env->cp15.c15_config_base_address = cpu->reset_cbar;
     env->cp15.c0_cpuid = cpu->midr;
     env->vfp.xregs[ARM_VFP_FPSID] = cpu->reset_fpsid;
     env->vfp.xregs[ARM_VFP_MVFR0] = cpu->mvfr0;
commit 778c3a0619f3b47f94e566ca4f656aabe5f4b3d6
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 20 07:39:14 2012 +0000

    target-arm: Change cpu_arm_init() return type to ARMCPU
    
    Make cpu_arm_init() return a QOM ARMCPU, so that we don't need to
    obtain an ARMCPU through arm_env_get_cpu() in machine init code.
    This requires to adjust the inclusion site of cpu-qom.h and in turn,
    forward-looking, to homogenize its include order.
    
    cpu_init() must still return a CPUARMState for backwards and
    cross-target compatibility, so adjust the cpu_init macro.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index b6c044a..2891521 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -21,7 +21,6 @@
 #define QEMU_ARM_CPU_QOM_H
 
 #include "qemu/cpu.h"
-#include "cpu.h"
 
 #define TYPE_ARM_CPU "arm-cpu"
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index cc67d4d..2e0eccd 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -18,7 +18,7 @@
  * <http://www.gnu.org/licenses/gpl-2.0.html>
  */
 
-#include "cpu-qom.h"
+#include "cpu.h"
 #include "qemu-common.h"
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 01e0e36..5eac070 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -238,7 +238,9 @@ typedef struct CPUARMState {
     const struct arm_boot_info *boot_info;
 } CPUARMState;
 
-CPUARMState *cpu_arm_init(const char *cpu_model);
+#include "cpu-qom.h"
+
+ARMCPU *cpu_arm_init(const char *cpu_model);
 void arm_translate_init(void);
 int cpu_arm_exec(CPUARMState *s);
 void do_interrupt(CPUARMState *);
@@ -456,7 +458,7 @@ void cpu_arm_set_cp_io(CPUARMState *env, int cpnum,
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
-#define cpu_init cpu_arm_init
+#define cpu_init(model) (&cpu_arm_init(model)->env)
 #define cpu_exec cpu_arm_exec
 #define cpu_gen_code cpu_arm_gen_code
 #define cpu_signal_handler cpu_arm_signal_handler
@@ -483,7 +485,6 @@ static inline void cpu_clone_regs(CPUARMState *env, target_ulong newsp)
 #endif
 
 #include "cpu-all.h"
-#include "cpu-qom.h"
 
 /* Bit usage in the TB flags field: */
 #define ARM_TBFLAG_THUMB_SHIFT      0
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 101031d..7e1c2c0 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -61,7 +61,7 @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
-CPUARMState *cpu_arm_init(const char *cpu_model)
+ARMCPU *cpu_arm_init(const char *cpu_model)
 {
     ARMCPU *cpu;
     CPUARMState *env;
@@ -92,7 +92,7 @@ CPUARMState *cpu_arm_init(const char *cpu_model)
                                  19, "arm-vfp.xml", 0);
     }
     qemu_init_vcpu(env);
-    return env;
+    return cpu;
 }
 
 typedef struct ARMCPUListState {
commit 9a14b298bb9651488fb9ef3f619233e3fabb7621
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 20 11:51:58 2012 +0200

    qemu-timer: Optimize data structures
    
    Remove all holes which were found by pahole on Linux x86_64
    (and replace "struct QEMUTimer" by "QEMUTimer").
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu-timer.c b/qemu-timer.c
index 1f7952d..8eadd16 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -47,22 +47,22 @@
 #define QEMU_CLOCK_HOST     2
 
 struct QEMUClock {
-    int type;
-    bool enabled;
-
     QEMUTimer *active_timers;
 
     NotifierList reset_notifiers;
     int64_t last;
+
+    int type;
+    bool enabled;
 };
 
 struct QEMUTimer {
-    QEMUClock *clock;
     int64_t expire_time;	/* in nanoseconds */
-    int scale;
+    QEMUClock *clock;
     QEMUTimerCB *cb;
     void *opaque;
-    struct QEMUTimer *next;
+    QEMUTimer *next;
+    int scale;
 };
 
 struct qemu_alarm_timer {
@@ -71,8 +71,8 @@ struct qemu_alarm_timer {
     void (*stop)(struct qemu_alarm_timer *t);
     void (*rearm)(struct qemu_alarm_timer *t, int64_t nearest_delta_ns);
 #if defined(__linux__)
-    int fd;
     timer_t timer;
+    int fd;
 #elif defined(_WIN32)
     HANDLE timer;
 #endif
commit 8205199d7b4e7d1a9e57a83f2a5774187f2a2495
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 20 11:27:24 2012 +0200

    qemu-timer: Remove function alarm_has_dynticks
    
    Some time ago, the last time which did not have dynticks was removed,
    so now all timers have dynticks.
    
    I also removed a misleading error message for the dynticks timer.
    If timer_create fails, there is already an error message, and
    QEMU will use the unix timer which also provides dynamic ticks,
    therefore dynamic ticks are not disabled.
    
    v2:
    Remove two if statements because they were always true
    (thanks to Paolo Bonzini for this correction).
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu-timer.c b/qemu-timer.c
index 08c45ab..1f7952d 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -87,11 +87,6 @@ static bool qemu_timer_expired_ns(QEMUTimer *timer_head, int64_t current_time)
     return timer_head && (timer_head->expire_time <= current_time);
 }
 
-static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
-{
-    return !!t->rearm;
-}
-
 static int64_t qemu_next_alarm_deadline(void)
 {
     int64_t delta = INT64_MAX;
@@ -122,7 +117,6 @@ static int64_t qemu_next_alarm_deadline(void)
 static void qemu_rearm_alarm_timer(struct qemu_alarm_timer *t)
 {
     int64_t nearest_delta_ns;
-    assert(alarm_has_dynticks(t));
     if (!rt_clock->active_timers &&
         !vm_clock->active_timers &&
         !host_clock->active_timers) {
@@ -481,12 +475,9 @@ static void host_alarm_handler(int host_signum)
     if (!t)
 	return;
 
-    if (alarm_has_dynticks(t) ||
-        qemu_next_alarm_deadline () <= 0) {
-        t->expired = alarm_has_dynticks(t);
-        t->pending = true;
-        qemu_notify_event();
-    }
+    t->expired = true;
+    t->pending = true;
+    qemu_notify_event();
 }
 
 #if defined(__linux__)
@@ -522,10 +513,6 @@ static int dynticks_start_timer(struct qemu_alarm_timer *t)
 
     if (timer_create(CLOCK_REALTIME, &ev, &host_timer)) {
         perror("timer_create");
-
-        /* disable dynticks */
-        fprintf(stderr, "Dynamic Ticks disabled\n");
-
         return -1;
     }
 
@@ -634,17 +621,14 @@ static void CALLBACK mm_alarm_handler(UINT uTimerID, UINT uMsg,
     if (!t) {
         return;
     }
-    if (alarm_has_dynticks(t) || qemu_next_alarm_deadline() <= 0) {
-        t->expired = alarm_has_dynticks(t);
-        t->pending = true;
-        qemu_notify_event();
-    }
+    t->expired = true;
+    t->pending = true;
+    qemu_notify_event();
 }
 
 static int mm_start_timer(struct qemu_alarm_timer *t)
 {
     TIMECAPS tc;
-    UINT flags;
 
     memset(&tc, 0, sizeof(tc));
     timeGetDevCaps(&tc, sizeof(tc));
@@ -652,18 +636,11 @@ static int mm_start_timer(struct qemu_alarm_timer *t)
     mm_period = tc.wPeriodMin;
     timeBeginPeriod(mm_period);
 
-    flags = TIME_CALLBACK_FUNCTION;
-    if (alarm_has_dynticks(t)) {
-        flags |= TIME_ONESHOT;
-    } else {
-        flags |= TIME_PERIODIC;
-    }
-
     mm_timer = timeSetEvent(1,                  /* interval (ms) */
                             mm_period,          /* resolution */
                             mm_alarm_handler,   /* function */
                             (DWORD_PTR)t,       /* parameter */
-                            flags);
+                            TIME_ONESHOT | TIME_CALLBACK_FUNCTION);
 
     if (!mm_timer) {
         fprintf(stderr, "Failed to initialize win32 alarm timer: %ld\n",
@@ -722,7 +699,7 @@ static int win32_start_timer(struct qemu_alarm_timer *t)
                           host_alarm_handler,
                           t,
                           1,
-                          alarm_has_dynticks(t) ? 3600000 : 1,
+                          3600000,
                           WT_EXECUTEINTIMERTHREAD);
 
     if (!success) {
commit 5e1ec7b267b214f3647d4248b4021ad0bafbb434
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 20 10:45:48 2012 +0200

    qemu-timer: Use bool, false, true for boolean values
    
    This avoids conversions between int and bool / char.
    
    It also makes the code more readable.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu-timer.c b/qemu-timer.c
index 6ca2578..08c45ab 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -48,7 +48,7 @@
 
 struct QEMUClock {
     int type;
-    int enabled;
+    bool enabled;
 
     QEMUTimer *active_timers;
 
@@ -76,8 +76,8 @@ struct qemu_alarm_timer {
 #elif defined(_WIN32)
     HANDLE timer;
 #endif
-    char expired;
-    char pending;
+    bool expired;
+    bool pending;
 };
 
 static struct qemu_alarm_timer *alarm_timer;
@@ -249,13 +249,13 @@ static QEMUClock *qemu_new_clock(int type)
 
     clock = g_malloc0(sizeof(QEMUClock));
     clock->type = type;
-    clock->enabled = 1;
+    clock->enabled = true;
     clock->last = INT64_MIN;
     notifier_list_init(&clock->reset_notifiers);
     return clock;
 }
 
-void qemu_clock_enable(QEMUClock *clock, int enabled)
+void qemu_clock_enable(QEMUClock *clock, bool enabled)
 {
     bool old = clock->enabled;
     clock->enabled = enabled;
@@ -368,17 +368,18 @@ void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time)
     qemu_mod_timer_ns(ts, expire_time * ts->scale);
 }
 
-int qemu_timer_pending(QEMUTimer *ts)
+bool qemu_timer_pending(QEMUTimer *ts)
 {
     QEMUTimer *t;
     for (t = ts->clock->active_timers; t != NULL; t = t->next) {
-        if (t == ts)
-            return 1;
+        if (t == ts) {
+            return true;
+        }
     }
-    return 0;
+    return false;
 }
 
-int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
+bool qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time)
 {
     return qemu_timer_expired_ns(timer_head, current_time * timer_head->scale);
 }
@@ -456,7 +457,7 @@ uint64_t qemu_timer_expire_time_ns(QEMUTimer *ts)
 
 void qemu_run_all_timers(void)
 {
-    alarm_timer->pending = 0;
+    alarm_timer->pending = false;
 
     /* vm time timers */
     qemu_run_timers(vm_clock);
@@ -465,7 +466,7 @@ void qemu_run_all_timers(void)
 
     /* rearm timer, if not periodic */
     if (alarm_timer->expired) {
-        alarm_timer->expired = 0;
+        alarm_timer->expired = false;
         qemu_rearm_alarm_timer(alarm_timer);
     }
 }
@@ -483,7 +484,7 @@ static void host_alarm_handler(int host_signum)
     if (alarm_has_dynticks(t) ||
         qemu_next_alarm_deadline () <= 0) {
         t->expired = alarm_has_dynticks(t);
-        t->pending = 1;
+        t->pending = true;
         qemu_notify_event();
     }
 }
@@ -635,7 +636,7 @@ static void CALLBACK mm_alarm_handler(UINT uTimerID, UINT uMsg,
     }
     if (alarm_has_dynticks(t) || qemu_next_alarm_deadline() <= 0) {
         t->expired = alarm_has_dynticks(t);
-        t->pending = 1;
+        t->pending = true;
         qemu_notify_event();
     }
 }
@@ -800,7 +801,7 @@ int init_timer_alarm(void)
 
     /* first event is at time 0 */
     atexit(quit_timers);
-    t->pending = 1;
+    t->pending = true;
     alarm_timer = t;
 
     return 0;
diff --git a/qemu-timer.h b/qemu-timer.h
index 623c793..5175419 100644
--- a/qemu-timer.h
+++ b/qemu-timer.h
@@ -36,7 +36,7 @@ int64_t qemu_get_clock_ns(QEMUClock *clock);
 int64_t qemu_clock_has_timers(QEMUClock *clock);
 int64_t qemu_clock_expired(QEMUClock *clock);
 int64_t qemu_clock_deadline(QEMUClock *clock);
-void qemu_clock_enable(QEMUClock *clock, int enabled);
+void qemu_clock_enable(QEMUClock *clock, bool enabled);
 void qemu_clock_warp(QEMUClock *clock);
 
 void qemu_register_clock_reset_notifier(QEMUClock *clock, Notifier *notifier);
@@ -49,8 +49,8 @@ void qemu_free_timer(QEMUTimer *ts);
 void qemu_del_timer(QEMUTimer *ts);
 void qemu_mod_timer_ns(QEMUTimer *ts, int64_t expire_time);
 void qemu_mod_timer(QEMUTimer *ts, int64_t expire_time);
-int qemu_timer_pending(QEMUTimer *ts);
-int qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time);
+bool qemu_timer_pending(QEMUTimer *ts);
+bool qemu_timer_expired(QEMUTimer *timer_head, int64_t current_time);
 uint64_t qemu_timer_expire_time_ns(QEMUTimer *ts);
 
 void qemu_run_timers(QEMUClock *clock);
commit c4879f2a6719f3ede428324dc763b74465d89d57
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 20 10:50:55 2012 +0200

    qemu-timer: Remove unused function qemu_alarm_pending
    
    The last user of this function was removed by commit
    12d4536f7d911b6d87a766ad7300482ea663cea2.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu-timer.c b/qemu-timer.c
index 25d5fdc..6ca2578 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -87,11 +87,6 @@ static bool qemu_timer_expired_ns(QEMUTimer *timer_head, int64_t current_time)
     return timer_head && (timer_head->expire_time <= current_time);
 }
 
-int qemu_alarm_pending(void)
-{
-    return alarm_timer->pending;
-}
-
 static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 {
     return !!t->rearm;
diff --git a/qemu-timer.h b/qemu-timer.h
index 5a31434..623c793 100644
--- a/qemu-timer.h
+++ b/qemu-timer.h
@@ -55,7 +55,6 @@ uint64_t qemu_timer_expire_time_ns(QEMUTimer *ts);
 
 void qemu_run_timers(QEMUClock *clock);
 void qemu_run_all_timers(void);
-int qemu_alarm_pending(void);
 void configure_alarms(char const *opt);
 void init_clocks(void);
 int init_timer_alarm(void);
commit bff9f8bfbe223a688a940da09f08b0b2aebc5718
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 20 10:27:06 2012 +0200

    qemu-timer: Remove redundant include statements
    
    qemu-timer.h includes qemu-common.h which already includes time.h,
    sys/time.h, windows.h, unistd.h, fcntl.h, errno.h and signal.h.
    
    Therefore those include statements are redundant and can be removed.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu-timer.c b/qemu-timer.c
index 0b28eda..25d5fdc 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -29,23 +29,16 @@
 
 #include "hw/hw.h"
 
-#include <unistd.h>
-#include <fcntl.h>
-#include <time.h>
-#include <errno.h>
-#include <sys/time.h>
-#include <signal.h>
+#include "qemu-timer.h"
+
 #ifdef __FreeBSD__
 #include <sys/param.h>
 #endif
 
 #ifdef _WIN32
-#include <windows.h>
 #include <mmsystem.h>
 #endif
 
-#include "qemu-timer.h"
-
 /***********************************************************/
 /* timers */
 
diff --git a/qemu-timer.h b/qemu-timer.h
index 094e730..5a31434 100644
--- a/qemu-timer.h
+++ b/qemu-timer.h
@@ -4,12 +4,6 @@
 #include "qemu-common.h"
 #include "main-loop.h"
 #include "notify.h"
-#include <time.h>
-#include <sys/time.h>
-
-#ifdef _WIN32
-#include <windows.h>
-#endif
 
 /* timers */
 
commit a75bfc5fdda8b87ff969d68e020ffdf1008751b1
Merge: f5eef2c... b3adf53...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:22:07 2012 -0500

    Merge remote-tracking branch 'bonzini/nbd-next' into staging
    
    * bonzini/nbd-next:
      nbd: Fix uninitialised use of s->sock

commit f5eef2cf66f3c343c0a529fa10ae0ba2b5da855d
Merge: b1bbf76... aba1f24...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:21:52 2012 -0500

    Merge remote-tracking branch 'kraxel/usb.49' into staging
    
    * kraxel/usb.49:
      usb-uhci: update irq line on reset
      usb: add serial number generator
      usb-redir: Not finding an async urb id is not an error
      usb-redir: Reset device address and speed on disconnect
      usb-redir: An interface count of 0 is a valid value
      usb-xhci: fix bit test
      usb-xhci: Use PCI DMA helper functions
      usb-host: fix zero-length packets
      usb-host: don't dereference invalid iovecs
      usb-storage: fix request canceling
      usb-ehci: Ensure frindex writes leave a valid frindex value
      usb-ehci: add missing usb_packet_init() call
      usb-ehci: remove hack

commit b1bbf76e7044872b4a2794032ee0abb4cef59dbe
Merge: 0677e27... c042493...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:21:01 2012 -0500

    Merge remote-tracking branch 'stefanha/tracing' into staging
    
    * stefanha/tracing:
      Beautify makefile commands for generation of files with tracetool
      Generic elimination of auto-generated files

commit 0677e2777e38dc967a0e879a508fb1e88fe6f98e
Merge: 1fa95c2... f121909...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:20:33 2012 -0500

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    * mst/tags/for_anthony:
      e1000: set E1000_ICR_INT_ASSERTED only for 8257x
      e1000: link auto-negotiation emulation
      e1000: introduce bit for debugging PHY emulation
      e1000: introduce helpers to manipulate link status
      e1000: PHY loopback mode support
      e1000: conditionally raise irq at the end of MDI cycle
      e1000: introduce bits of PHY control register
      eepro100: Fix multicast regression
      virtio: order index/descriptor reads
      virtio: add missing mb() on enable notification
      virtio: add missing mb() on notification
      e1000: move reset function earlier in file

commit 1fa95c23feba164f12fa52d4d8e486c10ccc5295
Merge: d6a6922... 89e4896...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:18:06 2012 -0500

    Merge remote-tracking branch 'afaerber/qom-cpu-x86-prop.v3' into staging
    
    * afaerber/qom-cpu-x86-prop.v3:
      target-i386: Introduce "tsc-frequency" property for X86CPU
      target-i386: Prepare "vendor" property for X86CPU
      target-i386: Introduce "xlevel" property for X86CPU
      target-i386: Introduce "level" property for X86CPU
      target-i386: Add property getter for CPU model-id
      target-i386: Add property getter for CPU stepping
      target-i386: Add property getter for CPU model
      target-i386: Add property getter for CPU family
      target-i386: Add "model-id" property to X86CPU
      target-i386: Add "stepping" property to X86CPU
      target-i386: Add "model" property to X86CPU
      target-i386: Add "family" property to X86CPU
      target-i386: Add range check for -cpu ,family=x
      target-i386: Pass X86CPU to cpu_x86_register()
      target-i386: Fix x86_cpuid_set_model_id()

commit d6a6922f3bebbf95e2d5194a9cb8a21e3d5ddfdd
Merge: be5ea8e... 4399722...
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Apr 26 15:16:24 2012 -0500

    Merge remote-tracking branch 'amit/master' into staging
    
    * amit/master:
      virtio-serial-bus: Unset guest_connected at reset and driver reset
      virtio-serial-bus: fix guest_connected init before driver init

commit be5ea8ed4481f0ffa4ea0f7ba13e465701536001
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Apr 25 14:19:05 2012 -0500

    Revert "configure: Virtfs doesn't require libcap."
    
    This reverts commit d10f9056bacf7991fd6a5f63ac2e0190e84ea3a7 due to a build
    breakage.
    
    See http://spunk.home.kraxel.org/bb/builders/ubuntu-default/builds/52
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/configure b/configure
index dd09f1a..15bbc73 100755
--- a/configure
+++ b/configure
@@ -2898,11 +2898,9 @@ tools=
 if test "$softmmu" = yes ; then
   tools="qemu-img\$(EXESUF) qemu-io\$(EXESUF) $tools"
   if test "$virtfs" != no ; then
-      if test "$linux" = yes && test "$attr" = yes ; then
+      if test "$cap" = yes && test "$linux" = yes && test "$attr" = yes ; then
 	  virtfs=yes
-	  if test "$cap" = yes ; then
-	      tools="$tools fsdev/virtfs-proxy-helper\$(EXESUF)"
-	  fi
+	  tools="$tools fsdev/virtfs-proxy-helper\$(EXESUF)"
       else
 	  if test "$virtfs" = yes; then
 	      feature_not_found "virtfs"
commit 15fdaee3c549afb24b121e060e9852ed29d11cab
Author: Nathan Whitehorn <nwhitehorn at freebsd.org>
Date:   Sat Apr 14 16:01:00 2012 +0200

    os-posix: Fix build on FreeBSD
    
    Add an include for a header required to build on recent FreeBSD.
    
    Signed-off-by: Nathan Whitehorn <nwhitehorn at freebsd.org>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/os-posix.c b/os-posix.c
index e3ed497..daf3d6f 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -44,6 +44,10 @@
 #include <sys/prctl.h>
 #endif
 
+#ifdef __FreeBSD__
+#include <sys/sysctl.h>
+#endif
+
 static struct passwd *user_pwd;
 static const char *chroot_dir;
 static int daemonize;
commit 7c7db75576bd5a31508208f153c5aada64b2c8df
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Fri Apr 13 19:35:04 2012 +0100

    main_loop_wait: block indefinitely
    
    - remove qemu_calculate_timeout;
    
    - explicitly size timeout to uint32_t;
    
    - introduce slirp_update_timeout;
    
    - pass NULL as timeout argument to select in case timeout is the maximum
    value;
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Acked-by: Paul Brook <paul at codesourcery.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/async.c b/async.c
index 332d511..ecdaf15 100644
--- a/async.c
+++ b/async.c
@@ -120,7 +120,7 @@ void qemu_bh_delete(QEMUBH *bh)
     bh->deleted = 1;
 }
 
-void qemu_bh_update_timeout(int *timeout)
+void qemu_bh_update_timeout(uint32_t *timeout)
 {
     QEMUBH *bh;
 
diff --git a/main-loop.c b/main-loop.c
index 4887c73..0457bf2 100644
--- a/main-loop.c
+++ b/main-loop.c
@@ -226,7 +226,7 @@ static int max_priority;
 
 #ifndef _WIN32
 static void glib_select_fill(int *max_fd, fd_set *rfds, fd_set *wfds,
-                             fd_set *xfds, int *cur_timeout)
+                             fd_set *xfds, uint32_t *cur_timeout)
 {
     GMainContext *context = g_main_context_default();
     int i;
@@ -288,20 +288,24 @@ static void glib_select_poll(fd_set *rfds, fd_set *wfds, fd_set *xfds,
     }
 }
 
-static int os_host_main_loop_wait(int timeout)
+static int os_host_main_loop_wait(uint32_t timeout)
 {
-    struct timeval tv;
+    struct timeval tv, *tvarg = NULL;
     int ret;
 
     glib_select_fill(&nfds, &rfds, &wfds, &xfds, &timeout);
 
+    if (timeout < UINT32_MAX) {
+        tvarg = &tv;
+        tv.tv_sec = timeout / 1000;
+        tv.tv_usec = (timeout % 1000) * 1000;
+    }
+
     if (timeout > 0) {
         qemu_mutex_unlock_iothread();
     }
 
-    tv.tv_sec = timeout / 1000;
-    tv.tv_usec = (timeout % 1000) * 1000;
-    ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv);
+    ret = select(nfds + 1, &rfds, &wfds, &xfds, tvarg);
 
     if (timeout > 0) {
         qemu_mutex_lock_iothread();
@@ -400,7 +404,7 @@ void qemu_fd_register(int fd)
                    FD_CONNECT | FD_WRITE | FD_OOB);
 }
 
-static int os_host_main_loop_wait(int timeout)
+static int os_host_main_loop_wait(uint32_t timeout)
 {
     GMainContext *context = g_main_context_default();
     int ret, i;
@@ -463,12 +467,12 @@ static int os_host_main_loop_wait(int timeout)
 
 int main_loop_wait(int nonblocking)
 {
-    int ret, timeout;
+    int ret;
+    uint32_t timeout = UINT32_MAX;
 
     if (nonblocking) {
         timeout = 0;
     } else {
-        timeout = qemu_calculate_timeout();
         qemu_bh_update_timeout(&timeout);
     }
 
@@ -480,6 +484,7 @@ int main_loop_wait(int nonblocking)
     FD_ZERO(&xfds);
 
 #ifdef CONFIG_SLIRP
+    slirp_update_timeout(&timeout);
     slirp_select_fill(&nfds, &rfds, &wfds, &xfds);
 #endif
     qemu_iohandler_fill(&nfds, &rfds, &wfds, &xfds);
diff --git a/main-loop.h b/main-loop.h
index e743aa0..c06b8bc 100644
--- a/main-loop.h
+++ b/main-loop.h
@@ -365,6 +365,6 @@ void qemu_iohandler_poll(fd_set *readfds, fd_set *writefds, fd_set *xfds, int rc
 
 void qemu_bh_schedule_idle(QEMUBH *bh);
 int qemu_bh_poll(void);
-void qemu_bh_update_timeout(int *timeout);
+void qemu_bh_update_timeout(uint32_t *timeout);
 
 #endif
diff --git a/qemu-timer.c b/qemu-timer.c
index 364a4cd..0b28eda 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -821,8 +821,3 @@ fail:
     return err;
 }
 
-int qemu_calculate_timeout(void)
-{
-    return 1000;
-}
-
diff --git a/qemu-timer.h b/qemu-timer.h
index 661bbe7..094e730 100644
--- a/qemu-timer.h
+++ b/qemu-timer.h
@@ -63,7 +63,6 @@ void qemu_run_timers(QEMUClock *clock);
 void qemu_run_all_timers(void);
 int qemu_alarm_pending(void);
 void configure_alarms(char const *opt);
-int qemu_calculate_timeout(void);
 void init_clocks(void);
 int init_timer_alarm(void);
 
diff --git a/qemu-tool.c b/qemu-tool.c
index 6579b00..07fc4f2 100644
--- a/qemu-tool.c
+++ b/qemu-tool.c
@@ -90,6 +90,10 @@ int qemu_init_main_loop(void)
     return main_loop_init();
 }
 
+void slirp_update_timeout(uint32_t *timeout)
+{
+}
+
 void slirp_select_fill(int *pnfds, fd_set *readfds,
                        fd_set *writefds, fd_set *xfds)
 {
diff --git a/slirp/libslirp.h b/slirp/libslirp.h
index 890fd86..77527ad 100644
--- a/slirp/libslirp.h
+++ b/slirp/libslirp.h
@@ -15,6 +15,7 @@ Slirp *slirp_init(int restricted, struct in_addr vnetwork,
                   struct in_addr vnameserver, void *opaque);
 void slirp_cleanup(Slirp *slirp);
 
+void slirp_update_timeout(uint32_t *timeout);
 void slirp_select_fill(int *pnfds,
                        fd_set *readfds, fd_set *writefds, fd_set *xfds);
 
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 1502830..90473eb 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -258,6 +258,13 @@ void slirp_cleanup(Slirp *slirp)
 #define CONN_CANFRCV(so) (((so)->so_state & (SS_FCANTRCVMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
 #define UPD_NFDS(x) if (nfds < (x)) nfds = (x)
 
+void slirp_update_timeout(uint32_t *timeout)
+{
+    if (!QTAILQ_EMPTY(&slirp_instances)) {
+        *timeout = MIN(1000, *timeout);
+    }
+}
+
 void slirp_select_fill(int *pnfds,
                        fd_set *readfds, fd_set *writefds, fd_set *xfds)
 {
commit 4ffd16fc2900219c8ec8bb288b6fa3dfcae295a7
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Fri Apr 13 19:35:03 2012 +0100

    qemu_next_alarm_deadline: check the expire time of a clock only if it is enabled
    
    Also delta in qemu_next_alarm_deadline is a 64 bit value so set the
    default to INT64_MAX instead of INT32_MAX.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-timer.c b/qemu-timer.c
index 3cdb012..364a4cd 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -106,23 +106,21 @@ static inline int alarm_has_dynticks(struct qemu_alarm_timer *t)
 
 static int64_t qemu_next_alarm_deadline(void)
 {
-    int64_t delta;
+    int64_t delta = INT64_MAX;
     int64_t rtdelta;
 
-    if (!use_icount && vm_clock->active_timers) {
+    if (!use_icount && vm_clock->enabled && vm_clock->active_timers) {
         delta = vm_clock->active_timers->expire_time -
                      qemu_get_clock_ns(vm_clock);
-    } else {
-        delta = INT32_MAX;
     }
-    if (host_clock->active_timers) {
+    if (host_clock->enabled && host_clock->active_timers) {
         int64_t hdelta = host_clock->active_timers->expire_time -
                  qemu_get_clock_ns(host_clock);
         if (hdelta < delta) {
             delta = hdelta;
         }
     }
-    if (rt_clock->active_timers) {
+    if (rt_clock->enabled && rt_clock->active_timers) {
         rtdelta = (rt_clock->active_timers->expire_time -
                  qemu_get_clock_ns(rt_clock));
         if (rtdelta < delta) {
commit 5bfb723f07fde2caafa90cb40c102a4e36dfea9e
Author: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
Date:   Fri Apr 13 19:35:02 2012 +0100

    timers: the rearm function should be able to handle delta = INT64_MAX
    
    Fix win32_rearm_timer and mm_rearm_timer: they should be able to handle
    INT64_MAX as a delta parameter without overflowing.
    Also, the next deadline in ms should be calculated rounding down rather
    than up (see unix_rearm_timer and dynticks_rearm_timer).
    
    Finally ChangeTimerQueueTimer takes an unsigned long and timeSetEvent
    takes an unsigned int as delta, so cast the ms delta to the appropriate
    unsigned integer.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-timer.c b/qemu-timer.c
index 17915df..3cdb012 100644
--- a/qemu-timer.c
+++ b/qemu-timer.c
@@ -696,13 +696,17 @@ static void mm_stop_timer(struct qemu_alarm_timer *t)
 
 static void mm_rearm_timer(struct qemu_alarm_timer *t, int64_t delta)
 {
-    int nearest_delta_ms = (delta + 999999) / 1000000;
+    int64_t nearest_delta_ms = delta / 1000000;
     if (nearest_delta_ms < 1) {
         nearest_delta_ms = 1;
     }
+    /* UINT_MAX can be 32 bit */
+    if (nearest_delta_ms > UINT_MAX) {
+        nearest_delta_ms = UINT_MAX;
+    }
 
     timeKillEvent(mm_timer);
-    mm_timer = timeSetEvent(nearest_delta_ms,
+    mm_timer = timeSetEvent((unsigned int) nearest_delta_ms,
                             mm_period,
                             mm_alarm_handler,
                             (DWORD_PTR)t,
@@ -757,16 +761,20 @@ static void win32_rearm_timer(struct qemu_alarm_timer *t,
                               int64_t nearest_delta_ns)
 {
     HANDLE hTimer = t->timer;
-    int nearest_delta_ms;
+    int64_t nearest_delta_ms;
     BOOLEAN success;
 
-    nearest_delta_ms = (nearest_delta_ns + 999999) / 1000000;
+    nearest_delta_ms = nearest_delta_ns / 1000000;
     if (nearest_delta_ms < 1) {
         nearest_delta_ms = 1;
     }
+    /* ULONG_MAX can be 32 bit */
+    if (nearest_delta_ms > ULONG_MAX) {
+        nearest_delta_ms = ULONG_MAX;
+    }
     success = ChangeTimerQueueTimer(NULL,
                                     hTimer,
-                                    nearest_delta_ms,
+                                    (unsigned long) nearest_delta_ms,
                                     3600000);
 
     if (!success) {
commit 4ed5f5ea4598fd4ceb44b205ba051173db08adf9
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 24 16:22:31 2012 +0200

    target-i386: Fix x86_cpuid_set_model_id()
    
    Don't assume zeroed cpuid_model[] fields.
    
    This didn't break anything yet but QOM properties should be able to set
    the value to something else without setting an intermediate zero string.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 3df53ca..e1517e6 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -627,6 +627,7 @@ static void x86_cpuid_set_model_id(CPUX86State *env, const char *model_id)
         model_id = "";
     }
     len = strlen(model_id);
+    memset(env->cpuid_model, 0, 48);
     for (i = 0; i < 48; i++) {
         if (i >= len) {
             c = '\0';
commit ea7697fcd6edda2e0e54a02653e045003970bfbe
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Apr 23 21:40:08 2012 +0200

    qtest: Fix more format errors with qtest_sendf
    
    After adding GCC_FMT_ATTR to qtest_sendf, more format errors are reported
    by the compiler. These are fixed here.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqtest.c b/tests/libqtest.c
index 1ce6fa1..295c6d4 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -26,6 +26,7 @@
 #include <unistd.h>
 #include <string.h>
 
+#include "compiler.h"
 #include "osdep.h"
 
 #define MAX_IRQ 256
@@ -130,7 +131,7 @@ void qtest_quit(QTestState *s)
     }
 }
 
-static void qtest_sendf(QTestState *s, const char *fmt, ...)
+static void GCC_FMT_ATTR(2, 3) qtest_sendf(QTestState *s, const char *fmt, ...)
 {
     va_list ap;
     gchar *str;
@@ -356,7 +357,7 @@ void qtest_memread(QTestState *s, uint64_t addr, void *data, size_t size)
     gchar **args;
     size_t i;
 
-    qtest_sendf(s, "read 0x%" PRIx64 " 0x%x\n", addr, size);
+    qtest_sendf(s, "read 0x%" PRIx64 " 0x%zx\n", addr, size);
     args = qtest_rsp(s, 2);
 
     for (i = 0; i < size; i++) {
@@ -378,7 +379,7 @@ void qtest_memwrite(QTestState *s, uint64_t addr, const void *data, size_t size)
     const uint8_t *ptr = data;
     size_t i;
 
-    qtest_sendf(s, "write 0x%" PRIx64 " 0x%x 0x", addr, size);
+    qtest_sendf(s, "write 0x%" PRIx64 " 0x%zx 0x", addr, size);
     for (i = 0; i < size; i++) {
         qtest_sendf(s, "%02x", ptr[i]);
     }
commit 94b262949416f37116ea6fe456f45405b583c8f7
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 13 22:24:42 2012 +0200

    sdl: Add QEMU mascot icon for use with SDL
    
    This is a bitmap file (32x32x4) derived from the official QEMU mascot
    (which was designed by Benoît Canet). I stripped the text from the SVG
    to get a nearly square image and converted the result to BMP without
    any manual optimization.
    
    The bitmap is currently used by QEMU's SDL interface and replaces the
    default X icon.
    
    v2: Add qemu-icon.bmp to Makefile.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/Makefile b/Makefile
index 4f43793..121cad4 100644
--- a/Makefile
+++ b/Makefile
@@ -257,6 +257,7 @@ vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
 ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
+qemu-icon.bmp \
 bamboo.dtb petalogix-s3adsp1800.dtb petalogix-ml605.dtb \
 mpc8544ds.dtb \
 multiboot.bin linuxboot.bin kvmvapic.bin \
diff --git a/pc-bios/qemu-icon.bmp b/pc-bios/qemu-icon.bmp
new file mode 100644
index 0000000..72d9a2f
Binary files /dev/null and b/pc-bios/qemu-icon.bmp differ
commit 5ade76748588627770b312ac592e3118f8541a53
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Apr 18 17:37:04 2012 -0500

    qom: quick and dirty QOM filesystem based on FUSE
    
    Here's an example session:
    
    anthony at titi:~/git/qemu/QMP$ QMP_SERVER=/tmp/server.sock ./qom-fuse tmp
    anthony at titi:~/git/qemu/QMP$ ls tmp
    machine  sysbus  type
    anthony at titi:~/git/qemu/QMP$ ls tmp/machine
    i440fx  peripheral  peripheral-anon  type  unattached
    anthony at titi:~/git/qemu/QMP$ ls tmp/machine/i440fx
    ioapic  parent_bus  pci.0  type
    anthony at titi:~/git/qemu/QMP$ ls tmp/machine/i440fx/pci.0
    child[0]  child[1]  child[2]  child[3]  child[4]  child[5]  type
    anthony at titi:~/git/qemu/QMP$ ls tmp/machine/i440fx/pci.0/child[4]
    addr                 legacy-addr                 multifunction  type
    command_serr_enable  legacy-command_serr_enable  parent_bus
    ide.0                legacy-multifunction        rombar
    ide.1                legacy-romfile              romfile
    anthony at titi:~/git/qemu/QMP$ cat tmp/machine/i440fx/pci.0/child[4]/type
    piix3-ide
    anthony at titi:~/git/qemu/QMP$ ls -al tmp/machine/i440fx/pci.0/child\[4\]/parent_bus
    lrwxr-xr-x 2 anthony anthony 4096 1969-12-31 18:00 tmp/machine/i440fx/pci.0/child[4]/parent_bus -> ../../../machine/i440fx/pci.0
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/QMP/qom-fuse b/QMP/qom-fuse
new file mode 100755
index 0000000..5c6754a
--- /dev/null
+++ b/QMP/qom-fuse
@@ -0,0 +1,138 @@
+#!/usr/bin/python
+##
+# QEMU Object Model test tools
+#
+# Copyright IBM, Corp. 2012
+#
+# Authors:
+#  Anthony Liguori   <aliguori at us.ibm.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or later.  See
+# the COPYING file in the top-level directory.
+##
+
+import fuse, stat
+from fuse import Fuse
+import os, posix
+from errno import *
+from qmp import QEMUMonitorProtocol
+
+fuse.fuse_python_api = (0, 2)
+
+class QOMFS(Fuse):
+    def __init__(self, qmp, *args, **kwds):
+        Fuse.__init__(self, *args, **kwds)
+        self.qmp = qmp
+        self.qmp.connect()
+        self.ino_map = {}
+        self.ino_count = 1
+
+    def get_ino(self, path):
+        if self.ino_map.has_key(path):
+            return self.ino_map[path]
+        self.ino_map[path] = self.ino_count
+        self.ino_count += 1
+        return self.ino_map[path]
+
+    def is_object(self, path):
+        try:
+            items = self.qmp.command('qom-list', path=path)
+            return True
+        except:
+            return False
+
+    def is_property(self, path):
+        try:
+            path, prop = path.rsplit('/', 1)
+            for item in self.qmp.command('qom-list', path=path):
+                if item['name'] == prop:
+                    return True
+            return False
+        except:
+            return False
+
+    def is_link(self, path):
+        try:
+            path, prop = path.rsplit('/', 1)
+            for item in self.qmp.command('qom-list', path=path):
+                if item['name'] == prop:
+                    if item['type'].startswith('link<'):
+                        return True
+                    return False
+            return False
+        except:
+            return False
+
+    def read(self, path, length, offset):
+        if not self.is_property(path):
+            return -ENOENT
+
+        path, prop = path.rsplit('/', 1)
+        try:
+            data = str(self.qmp.command('qom-get', path=path, property=prop))
+            data += '\n' # make values shell friendly
+        except:
+            return -EPERM
+
+        if offset > len(data):
+            return ''
+
+        return str(data[offset:][:length])
+
+    def readlink(self, path):
+        if not self.is_link(path):
+            return False
+        path, prop = path.rsplit('/', 1)
+        prefix = '/'.join(['..'] * (len(path.split('/')) - 1))
+        return prefix + str(self.qmp.command('qom-get', path=path,
+                                             property=prop))
+
+    def getattr(self, path):
+        if self.is_link(path):
+            value = posix.stat_result((0755 | stat.S_IFLNK,
+                                       self.get_ino(path),
+                                       0,
+                                       2,
+                                       1000,
+                                       1000,
+                                       4096,
+                                       0,
+                                       0,
+                                       0))
+        elif self.is_object(path):
+            value = posix.stat_result((0755 | stat.S_IFDIR,
+                                       self.get_ino(path),
+                                       0,
+                                       2,
+                                       1000,
+                                       1000,
+                                       4096,
+                                       0,
+                                       0,
+                                       0))
+        elif self.is_property(path):
+            value = posix.stat_result((0644 | stat.S_IFREG,
+                                       self.get_ino(path),
+                                       0,
+                                       1,
+                                       1000,
+                                       1000,
+                                       4096,
+                                       0,
+                                       0,
+                                       0))
+        else:
+            value = -ENOENT
+        return value
+
+    def readdir(self, path, offset):
+        yield fuse.Direntry('.')
+        yield fuse.Direntry('..')
+        for item in self.qmp.command('qom-list', path=path):
+            yield fuse.Direntry(str(item['name']))
+
+if __name__ == '__main__':
+    import sys, os
+
+    fs = QOMFS(QEMUMonitorProtocol(os.environ['QMP_SOCKET']))
+    fs.main(sys.argv)
commit 1d38574fdf1d0232e99240c7079537c6ed00e3a4
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Wed Apr 18 17:33:15 2012 -0500

    pc-sysfw: make sure to call qdev_init
    
    We're not actually calling qdev_init for the pc-sysfw device.  Since we create
    the canonical path during realize, this was causing an assert to trigger when
    attempting to read a link pointing to pc-sysfw.
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/pc_sysfw.c b/hw/pc_sysfw.c
index abf9004..fafdf9b 100644
--- a/hw/pc_sysfw.c
+++ b/hw/pc_sysfw.c
@@ -190,6 +190,8 @@ void pc_system_firmware_init(MemoryRegion *rom_memory)
 
     sysfw_dev = (PcSysFwDevice*) qdev_create(NULL, "pc-sysfw");
 
+    qdev_init_nofail(DEVICE(sysfw_dev));
+
     if (sysfw_dev->rom_only) {
         old_pc_system_rom_init(rom_memory);
         return;
@@ -230,11 +232,17 @@ static Property pcsysfw_properties[] = {
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static int pcsysfw_init(DeviceState *dev)
+{
+    return 0;
+}
+
 static void pcsysfw_class_init (ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS (klass);
 
     dc->desc = "PC System Firmware";
+    dc->init = pcsysfw_init;
     dc->props = pcsysfw_properties;
 }
 
commit b3adf53a3a10a1ca8347167907e4cf8bbd0204f1
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Thu Apr 26 13:45:30 2012 +0200

    nbd: Fix uninitialised use of s->sock
    
    s->sock is assigned only afterwards, so we're really registering an
    aio_fd_handler for file descriptor 0 here. Not exactly what we intended.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/nbd.c b/block/nbd.c
index 56dbf6e..1212614 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -284,7 +284,7 @@ static int nbd_establish_connection(BlockDriverState *bs)
     /* Now that we're connected, set the socket to be non-blocking and
      * kick the reply mechanism.  */
     socket_set_nonblock(sock);
-    qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
+    qemu_aio_set_fd_handler(sock, nbd_reply_ready, NULL,
                             nbd_have_request, s);
 
     s->sock = sock;
commit aba1f242834a4365ca3250cd4d14226d66e77ed5
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Fri Apr 20 15:13:24 2012 +0200

    usb-uhci: update irq line on reset
    
    uhci_reset() clears irq mask and irq status registers, but doesn't
    update the irq line.  Which may result in suspious IRQs after uhci
    reset.  Fix it.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 266d550..9e211a0 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -369,6 +369,7 @@ static void uhci_reset(void *opaque)
     }
 
     uhci_async_cancel_all(s);
+    uhci_update_irq(s);
 }
 
 static void uhci_pre_save(void *opaque)
commit 9d55d1adc848a3dc1d2431c4ec4e7e4ea37fa0ee
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Fri Apr 20 12:33:30 2012 +0200

    usb: add serial number generator
    
    This patch adds a function which creates unique serial numbers for usb
    devices and puts it into use.  Windows guests tend to become unhappy if
    they find two identical usb devices in the system.  Effects range from
    non-functional devices (with yellow exclamation mark in device manager)
    to BSODs.  Handing out unique serial numbers to devices fixes this.
    
    With this patch applied almost all emulated devices get a generated,
    unique serial number.  There are two exceptions:
    
     * usb-storage devices will prefer a user-specified serial number
       and will only get a generated number in case the serial property
       is unset.
     * usb-hid devices keep the fixed serial number "42" as it is used
       to signal "remote wakeup actually works".
       See commit 7b074a22dab4bdda9864b933f1bc811a3db42845
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/desc.c b/hw/usb/desc.c
index 3c77368..e8a3c6a 100644
--- a/hw/usb/desc.c
+++ b/hw/usb/desc.c
@@ -1,3 +1,5 @@
+#include <ctype.h>
+
 #include "hw/usb.h"
 #include "hw/usb/desc.h"
 #include "trace.h"
@@ -412,6 +414,36 @@ void usb_desc_set_string(USBDevice *dev, uint8_t index, const char *str)
     s->str = g_strdup(str);
 }
 
+/*
+ * This function creates a serial number for a usb device.
+ * The serial number should:
+ *   (a) Be unique within the virtual machine.
+ *   (b) Be constant, so you don't get a new one each
+ *       time the guest is started.
+ * So we are using the physical location to generate a serial number
+ * from it.  It has three pieces:  First a fixed, device-specific
+ * prefix.  Second the device path of the host controller (which is
+ * the pci address in most cases).  Third the physical port path.
+ * Results in serial numbers like this: "314159-0000:00:1d.7-3".
+ */
+void usb_desc_create_serial(USBDevice *dev)
+{
+    DeviceState *hcd = dev->qdev.parent_bus->parent;
+    const USBDesc *desc = usb_device_get_usb_desc(dev);
+    int index = desc->id.iSerialNumber;
+    char serial[64];
+    int dst;
+
+    assert(index != 0 && desc->str[index] != NULL);
+    dst = snprintf(serial, sizeof(serial), "%s", desc->str[index]);
+    if (hcd && hcd->parent_bus && hcd->parent_bus->info->get_dev_path) {
+        char *path = hcd->parent_bus->info->get_dev_path(hcd);
+        dst += snprintf(serial+dst, sizeof(serial)-dst, "-%s", path);
+    }
+    dst += snprintf(serial+dst, sizeof(serial)-dst, "-%s", dev->port->path);
+    usb_desc_set_string(dev, index, serial);
+}
+
 const char *usb_desc_get_string(USBDevice *dev, uint8_t index)
 {
     USBDescString *s;
diff --git a/hw/usb/desc.h b/hw/usb/desc.h
index d164e8f..7cf5442 100644
--- a/hw/usb/desc.h
+++ b/hw/usb/desc.h
@@ -171,6 +171,7 @@ int usb_desc_other(const USBDescOther *desc, uint8_t *dest, size_t len);
 void usb_desc_init(USBDevice *dev);
 void usb_desc_attach(USBDevice *dev);
 void usb_desc_set_string(USBDevice *dev, uint8_t index, const char *str);
+void usb_desc_create_serial(USBDevice *dev);
 const char *usb_desc_get_string(USBDevice *dev, uint8_t index);
 int usb_desc_string(USBDevice *dev, int index, uint8_t *dest, size_t len);
 int usb_desc_get_descriptor(USBDevice *dev, int value, uint8_t *dest, size_t len);
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 426b95c..79b75fb 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -648,6 +648,7 @@ static int usb_audio_initfn(USBDevice *dev)
 {
     USBAudioState *s = DO_UPCAST(USBAudioState, dev, dev);
 
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     s->dev.opaque = s;
     AUD_register_card("usb-audio", &s->card);
diff --git a/hw/usb/dev-bluetooth.c b/hw/usb/dev-bluetooth.c
index 195370c..6b74eff 100644
--- a/hw/usb/dev-bluetooth.c
+++ b/hw/usb/dev-bluetooth.c
@@ -494,6 +494,7 @@ static void usb_bt_handle_destroy(USBDevice *dev)
 
 static int usb_bt_initfn(USBDevice *dev)
 {
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     return 0;
 }
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index 9c91665..b5962da 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -520,6 +520,7 @@ static int usb_hub_initfn(USBDevice *dev)
     USBHubPort *port;
     int i;
 
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     s->intr = usb_ep_get(dev, USB_TOKEN_IN, 1);
     for (i = 0; i < NUM_PORTS; i++) {
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index cff55f2..b238a09 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1324,6 +1324,7 @@ static int usb_net_initfn(USBDevice *dev)
 {
     USBNetState *s = DO_UPCAST(USBNetState, dev, dev);
 
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
 
     s->rndis_state = RNDIS_UNINITIALIZED;
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 8dcac8b..56743ee 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -479,6 +479,7 @@ static int usb_serial_initfn(USBDevice *dev)
 {
     USBSerialState *s = DO_UPCAST(USBSerialState, dev, dev);
 
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
 
     if (!s->cs) {
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 8e66675..3b7604e 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1189,6 +1189,7 @@ static int ccid_initfn(USBDevice *dev)
 {
     USBCCIDState *s = DO_UPCAST(USBCCIDState, dev, dev);
 
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     qbus_create_inplace(&s->bus.qbus, &ccid_bus_info, &dev->qdev, NULL);
     s->intr = usb_ep_get(dev, USB_TOKEN_IN, CCID_INT_IN_EP);
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 3d2f244..ae22fb1 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -546,6 +546,8 @@ static int usb_msd_initfn(USBDevice *dev)
     }
     if (s->serial) {
         usb_desc_set_string(dev, STR_SERIALNUMBER, s->serial);
+    } else {
+        usb_desc_create_serial(dev);
     }
 
     usb_desc_init(dev);
diff --git a/hw/usb/dev-wacom.c b/hw/usb/dev-wacom.c
index c1cfd74..3b51d45 100644
--- a/hw/usb/dev-wacom.c
+++ b/hw/usb/dev-wacom.c
@@ -339,6 +339,7 @@ static void usb_wacom_handle_destroy(USBDevice *dev)
 static int usb_wacom_initfn(USBDevice *dev)
 {
     USBWacomState *s = DO_UPCAST(USBWacomState, dev, dev);
+    usb_desc_create_serial(dev);
     usb_desc_init(dev);
     s->changed = 1;
     return 0;
commit b15cf49b78edb74dc783a7cacbc8391cbc728edc
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Sat Mar 31 17:14:23 2012 +0200

    usb-redir: Not finding an async urb id is not an error
    
    We clear our pending async urb list on device disconnect and we may still
    receive "packet complete" packets from our peer after this, which will then
    refer to packet ids no longer in our list.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index b2576e8..51c27b4 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -277,7 +277,7 @@ static AsyncURB *async_find(USBRedirDevice *dev, uint32_t packet_id)
             return aurb;
         }
     }
-    ERROR("could not find async urb for packet_id %u\n", packet_id);
+    DPRINTF("could not find async urb for packet_id %u\n", packet_id);
     return NULL;
 }
 
commit a0625c56e0db19029cb69e28859af56b2ae19f3f
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Sat Mar 31 17:14:22 2012 +0200

    usb-redir: Reset device address and speed on disconnect
    
    Without this disconnected devices look like the last redirected device
    in the monitor in "info usb".
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 3e6e7e9..b2576e8 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -1136,6 +1136,8 @@ static void usbredir_device_disconnect(void *priv)
     }
     usb_ep_init(&dev->dev);
     dev->interface_info.interface_count = NO_INTERFACE_INFO;
+    dev->dev.addr = 0;
+    dev->dev.speed = 0;
 }
 
 static void usbredir_interface_info(void *priv,
commit 1510168e273a12a56e3bd4488b4b2904f5138e09
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Sat Mar 31 17:14:21 2012 +0200

    usb-redir: An interface count of 0 is a valid value
    
    An interface-count of 0 happens when a device is in unconfigured state when
    it gets redirected. So we should not use 0 to detect not having received
    interface info from our peer.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 94ab463..3e6e7e9 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -39,6 +39,7 @@
 #include "hw/usb.h"
 
 #define MAX_ENDPOINTS 32
+#define NO_INTERFACE_INFO 255 /* Valid interface_count always <= 32 */
 #define EP2I(ep_address) (((ep_address & 0x80) >> 3) | (ep_address & 0x0f))
 #define I2EP(i) (((i & 0x10) << 3) | (i & 0x0f))
 
@@ -970,7 +971,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
 
 static int usbredir_check_filter(USBRedirDevice *dev)
 {
-    if (dev->interface_info.interface_count == 0) {
+    if (dev->interface_info.interface_count == NO_INTERFACE_INFO) {
         ERROR("No interface info for device\n");
         goto error;
     }
@@ -1134,7 +1135,7 @@ static void usbredir_device_disconnect(void *priv)
         QTAILQ_INIT(&dev->endpoint[i].bufpq);
     }
     usb_ep_init(&dev->dev);
-    dev->interface_info.interface_count = 0;
+    dev->interface_info.interface_count = NO_INTERFACE_INFO;
 }
 
 static void usbredir_interface_info(void *priv,
commit 215bff17ed89733c23174494cbff63ab941368ca
Author: Lai Jiangshan <laijs at cn.fujitsu.com>
Date:   Mon Apr 2 14:35:30 2012 +0800

    usb-xhci: fix bit test
    
    use & instead of the wrong &&
    
    Signed-off-by: Lai Jiangshan <laijs at cn.fujitsu.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index fd13bba..5cf1a64 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -501,7 +501,7 @@ static void xhci_irq_update(XHCIState *xhci)
     int level = 0;
 
     if (xhci->iman & IMAN_IP && xhci->iman & IMAN_IE &&
-        xhci->usbcmd && USBCMD_INTE) {
+        xhci->usbcmd & USBCMD_INTE) {
         level = 1;
     }
 
commit 59a70ccd3be29d2c5034cf7f22de0cf4e9156432
Author: David Gibson <david at gibson.dropbear.id.au>
Date:   Wed Apr 4 10:15:58 2012 +1000

    usb-xhci: Use PCI DMA helper functions
    
    Shortly before 1.0, we added helper functions / wrappers for doing PCI DMA
    from individual devices.  This makes what's going on clearer and means that
    when we add IOMMU support somewhere in the future, only the general PCI
    code will have to change, not every device that uses PCI DMA.
    
    However, usb-xhci is not using these wrappers, despite being a PCI only
    device.  This patch remedies the situation, using the pci dma functions
    instead of direct calls to cpu_physical_memory_{read,write}().  Likewise
    address parameters for DMA are changed to dma_addr_t instead of
    target_phys_addr_t.
    
    [ kraxel: removed #ifdefs ]
    
    Signed-off-by: David Gibson <david at gibson.dropbear.id.au>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 73b0c7f..fd13bba 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -22,7 +22,6 @@
 #include "qemu-timer.h"
 #include "hw/usb.h"
 #include "hw/pci.h"
-#include "hw/qdev-addr.h"
 #include "hw/msi.h"
 
 //#define DEBUG_XHCI
@@ -140,7 +139,7 @@ typedef struct XHCITRB {
     uint64_t parameter;
     uint32_t status;
     uint32_t control;
-    target_phys_addr_t addr;
+    dma_addr_t addr;
     bool ccs;
 } XHCITRB;
 
@@ -291,8 +290,8 @@ typedef enum EPType {
 } EPType;
 
 typedef struct XHCIRing {
-    target_phys_addr_t base;
-    target_phys_addr_t dequeue;
+    dma_addr_t base;
+    dma_addr_t dequeue;
     bool ccs;
 } XHCIRing;
 
@@ -345,7 +344,7 @@ typedef struct XHCIEPContext {
     unsigned int next_bg;
     XHCITransfer bg_transfers[BG_XFERS];
     EPType type;
-    target_phys_addr_t pctx;
+    dma_addr_t pctx;
     unsigned int max_psize;
     bool has_bg;
     uint32_t state;
@@ -353,7 +352,7 @@ typedef struct XHCIEPContext {
 
 typedef struct XHCISlot {
     bool enabled;
-    target_phys_addr_t ctx;
+    dma_addr_t ctx;
     unsigned int port;
     unsigned int devaddr;
     XHCIEPContext * eps[31];
@@ -402,7 +401,7 @@ struct XHCIState {
     uint32_t erdp_low;
     uint32_t erdp_high;
 
-    target_phys_addr_t er_start;
+    dma_addr_t er_start;
     uint32_t er_size;
     bool er_pcs;
     unsigned int er_ep_idx;
@@ -479,22 +478,22 @@ static const char *trb_name(XHCITRB *trb)
 static void xhci_kick_ep(XHCIState *xhci, unsigned int slotid,
                          unsigned int epid);
 
-static inline target_phys_addr_t xhci_addr64(uint32_t low, uint32_t high)
+static inline dma_addr_t xhci_addr64(uint32_t low, uint32_t high)
 {
-#if TARGET_PHYS_ADDR_BITS > 32
-    return low | ((target_phys_addr_t)high << 32);
-#else
-    return low;
-#endif
+    if (sizeof(dma_addr_t) == 4) {
+        return low;
+    } else {
+        return low | (((dma_addr_t)high << 16) << 16);
+    }
 }
 
-static inline target_phys_addr_t xhci_mask64(uint64_t addr)
+static inline dma_addr_t xhci_mask64(uint64_t addr)
 {
-#if TARGET_PHYS_ADDR_BITS > 32
-    return addr;
-#else
-    return addr & 0xffffffff;
-#endif
+    if (sizeof(dma_addr_t) == 4) {
+        return addr & 0xffffffff;
+    } else {
+        return addr;
+    }
 }
 
 static void xhci_irq_update(XHCIState *xhci)
@@ -532,7 +531,7 @@ static void xhci_die(XHCIState *xhci)
 static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
 {
     XHCITRB ev_trb;
-    target_phys_addr_t addr;
+    dma_addr_t addr;
 
     ev_trb.parameter = cpu_to_le64(event->ptr);
     ev_trb.status = cpu_to_le32(event->length | (event->ccode << 24));
@@ -548,7 +547,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
             trb_name(&ev_trb));
 
     addr = xhci->er_start + TRB_SIZE*xhci->er_ep_idx;
-    cpu_physical_memory_write(addr, (uint8_t *) &ev_trb, TRB_SIZE);
+    pci_dma_write(&xhci->pci_dev, addr, &ev_trb, TRB_SIZE);
 
     xhci->er_ep_idx++;
     if (xhci->er_ep_idx >= xhci->er_size) {
@@ -559,7 +558,7 @@ static void xhci_write_event(XHCIState *xhci, XHCIEvent *event)
 
 static void xhci_events_update(XHCIState *xhci)
 {
-    target_phys_addr_t erdp;
+    dma_addr_t erdp;
     unsigned int dp_idx;
     bool do_irq = 0;
 
@@ -570,8 +569,8 @@ static void xhci_events_update(XHCIState *xhci)
     erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high);
     if (erdp < xhci->er_start ||
         erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) {
-        fprintf(stderr, "xhci: ERDP out of bounds: "TARGET_FMT_plx"\n", erdp);
-        fprintf(stderr, "xhci: ER at "TARGET_FMT_plx" len %d\n",
+        fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+        fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n",
                 xhci->er_start, xhci->er_size);
         xhci_die(xhci);
         return;
@@ -630,7 +629,7 @@ static void xhci_events_update(XHCIState *xhci)
 
 static void xhci_event(XHCIState *xhci, XHCIEvent *event)
 {
-    target_phys_addr_t erdp;
+    dma_addr_t erdp;
     unsigned int dp_idx;
 
     if (xhci->er_full) {
@@ -649,8 +648,8 @@ static void xhci_event(XHCIState *xhci, XHCIEvent *event)
     erdp = xhci_addr64(xhci->erdp_low, xhci->erdp_high);
     if (erdp < xhci->er_start ||
         erdp >= (xhci->er_start + TRB_SIZE*xhci->er_size)) {
-        fprintf(stderr, "xhci: ERDP out of bounds: "TARGET_FMT_plx"\n", erdp);
-        fprintf(stderr, "xhci: ER at "TARGET_FMT_plx" len %d\n",
+        fprintf(stderr, "xhci: ERDP out of bounds: "DMA_ADDR_FMT"\n", erdp);
+        fprintf(stderr, "xhci: ER at "DMA_ADDR_FMT" len %d\n",
                 xhci->er_start, xhci->er_size);
         xhci_die(xhci);
         return;
@@ -686,7 +685,7 @@ static void xhci_event(XHCIState *xhci, XHCIEvent *event)
 }
 
 static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
-                           target_phys_addr_t base)
+                           dma_addr_t base)
 {
     ring->base = base;
     ring->dequeue = base;
@@ -694,18 +693,18 @@ static void xhci_ring_init(XHCIState *xhci, XHCIRing *ring,
 }
 
 static TRBType xhci_ring_fetch(XHCIState *xhci, XHCIRing *ring, XHCITRB *trb,
-                               target_phys_addr_t *addr)
+                               dma_addr_t *addr)
 {
     while (1) {
         TRBType type;
-        cpu_physical_memory_read(ring->dequeue, (uint8_t *) trb, TRB_SIZE);
+        pci_dma_read(&xhci->pci_dev, ring->dequeue, trb, TRB_SIZE);
         trb->addr = ring->dequeue;
         trb->ccs = ring->ccs;
         le64_to_cpus(&trb->parameter);
         le32_to_cpus(&trb->status);
         le32_to_cpus(&trb->control);
 
-        DPRINTF("xhci: TRB fetched [" TARGET_FMT_plx "]: "
+        DPRINTF("xhci: TRB fetched [" DMA_ADDR_FMT "]: "
                 "%016" PRIx64 " %08x %08x %s\n",
                 ring->dequeue, trb->parameter, trb->status, trb->control,
                 trb_name(trb));
@@ -735,19 +734,19 @@ static int xhci_ring_chain_length(XHCIState *xhci, const XHCIRing *ring)
 {
     XHCITRB trb;
     int length = 0;
-    target_phys_addr_t dequeue = ring->dequeue;
+    dma_addr_t dequeue = ring->dequeue;
     bool ccs = ring->ccs;
     /* hack to bundle together the two/three TDs that make a setup transfer */
     bool control_td_set = 0;
 
     while (1) {
         TRBType type;
-        cpu_physical_memory_read(dequeue, (uint8_t *) &trb, TRB_SIZE);
+        pci_dma_read(&xhci->pci_dev, dequeue, &trb, TRB_SIZE);
         le64_to_cpus(&trb.parameter);
         le32_to_cpus(&trb.status);
         le32_to_cpus(&trb.control);
 
-        DPRINTF("xhci: TRB peeked [" TARGET_FMT_plx "]: "
+        DPRINTF("xhci: TRB peeked [" DMA_ADDR_FMT "]: "
                 "%016" PRIx64 " %08x %08x\n",
                 dequeue, trb.parameter, trb.status, trb.control);
 
@@ -790,8 +789,8 @@ static void xhci_er_reset(XHCIState *xhci)
         xhci_die(xhci);
         return;
     }
-    target_phys_addr_t erstba = xhci_addr64(xhci->erstba_low, xhci->erstba_high);
-    cpu_physical_memory_read(erstba, (uint8_t *) &seg, sizeof(seg));
+    dma_addr_t erstba = xhci_addr64(xhci->erstba_low, xhci->erstba_high);
+    pci_dma_read(&xhci->pci_dev, erstba, &seg, sizeof(seg));
     le32_to_cpus(&seg.addr_low);
     le32_to_cpus(&seg.addr_high);
     le32_to_cpus(&seg.size);
@@ -807,7 +806,7 @@ static void xhci_er_reset(XHCIState *xhci)
     xhci->er_pcs = 1;
     xhci->er_full = 0;
 
-    DPRINTF("xhci: event ring:" TARGET_FMT_plx " [%d]\n",
+    DPRINTF("xhci: event ring:" DMA_ADDR_FMT " [%d]\n",
             xhci->er_start, xhci->er_size);
 }
 
@@ -833,24 +832,24 @@ static void xhci_set_ep_state(XHCIState *xhci, XHCIEPContext *epctx,
         return;
     }
 
-    cpu_physical_memory_read(epctx->pctx, (uint8_t *) ctx, sizeof(ctx));
+    pci_dma_read(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx));
     ctx[0] &= ~EP_STATE_MASK;
     ctx[0] |= state;
     ctx[2] = epctx->ring.dequeue | epctx->ring.ccs;
     ctx[3] = (epctx->ring.dequeue >> 16) >> 16;
-    DPRINTF("xhci: set epctx: " TARGET_FMT_plx " state=%d dequeue=%08x%08x\n",
+    DPRINTF("xhci: set epctx: " DMA_ADDR_FMT " state=%d dequeue=%08x%08x\n",
             epctx->pctx, state, ctx[3], ctx[2]);
-    cpu_physical_memory_write(epctx->pctx, (uint8_t *) ctx, sizeof(ctx));
+    pci_dma_write(&xhci->pci_dev, epctx->pctx, ctx, sizeof(ctx));
     epctx->state = state;
 }
 
 static TRBCCode xhci_enable_ep(XHCIState *xhci, unsigned int slotid,
-                               unsigned int epid, target_phys_addr_t pctx,
+                               unsigned int epid, dma_addr_t pctx,
                                uint32_t *ctx)
 {
     XHCISlot *slot;
     XHCIEPContext *epctx;
-    target_phys_addr_t dequeue;
+    dma_addr_t dequeue;
     int i;
 
     assert(slotid >= 1 && slotid <= MAXSLOTS);
@@ -1087,7 +1086,7 @@ static TRBCCode xhci_set_ep_dequeue(XHCIState *xhci, unsigned int slotid,
 {
     XHCISlot *slot;
     XHCIEPContext *epctx;
-    target_phys_addr_t dequeue;
+    dma_addr_t dequeue;
 
     assert(slotid >= 1 && slotid <= MAXSLOTS);
 
@@ -1142,7 +1141,7 @@ static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
 
     for (i = 0; i < xfer->trb_count; i++) {
         XHCITRB *trb = &xfer->trbs[i];
-        target_phys_addr_t addr;
+        dma_addr_t addr;
         unsigned int chunk = 0;
 
         switch (TRB_TYPE(*trb)) {
@@ -1173,11 +1172,11 @@ static int xhci_xfer_data(XHCITransfer *xfer, uint8_t *data,
                     memcpy(data, &idata, chunk);
                 } else {
                     DPRINTF("xhci_xfer_data: r/w(%d) %d bytes at "
-                            TARGET_FMT_plx "\n", in_xfer, chunk, addr);
+                            DMA_ADDR_FMT "\n", in_xfer, chunk, addr);
                     if (in_xfer) {
-                        cpu_physical_memory_write(addr, data, chunk);
+                        pci_dma_write(&xhci->pci_dev, addr, data, chunk);
                     } else {
-                        cpu_physical_memory_read(addr, data, chunk);
+                        pci_dma_read(&xhci->pci_dev, addr, data, chunk);
                     }
 #ifdef DEBUG_DATA
                     unsigned int count = chunk;
@@ -1240,7 +1239,7 @@ static void xhci_stall_ep(XHCITransfer *xfer)
     epctx->ring.ccs = xfer->trbs[0].ccs;
     xhci_set_ep_state(xhci, epctx, EP_HALTED);
     DPRINTF("xhci: stalled slot %d ep %d\n", xfer->slotid, xfer->epid);
-    DPRINTF("xhci: will continue at "TARGET_FMT_plx"\n", epctx->ring.dequeue);
+    DPRINTF("xhci: will continue at "DMA_ADDR_FMT"\n", epctx->ring.dequeue);
 }
 
 static int xhci_submit(XHCIState *xhci, XHCITransfer *xfer,
@@ -1802,7 +1801,7 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
 {
     XHCISlot *slot;
     USBDevice *dev;
-    target_phys_addr_t ictx, octx, dcbaap;
+    dma_addr_t ictx, octx, dcbaap;
     uint64_t poctx;
     uint32_t ictl_ctx[2];
     uint32_t slot_ctx[4];
@@ -1815,15 +1814,14 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
     DPRINTF("xhci_address_slot(%d)\n", slotid);
 
     dcbaap = xhci_addr64(xhci->dcbaap_low, xhci->dcbaap_high);
-    cpu_physical_memory_read(dcbaap + 8*slotid,
-                             (uint8_t *) &poctx, sizeof(poctx));
+    pci_dma_read(&xhci->pci_dev, dcbaap + 8*slotid, &poctx, sizeof(poctx));
     ictx = xhci_mask64(pictx);
     octx = xhci_mask64(le64_to_cpu(poctx));
 
-    DPRINTF("xhci: input context at "TARGET_FMT_plx"\n", ictx);
-    DPRINTF("xhci: output context at "TARGET_FMT_plx"\n", octx);
+    DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
+    DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
 
-    cpu_physical_memory_read(ictx, (uint8_t *) ictl_ctx, sizeof(ictl_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if (ictl_ctx[0] != 0x0 || ictl_ctx[1] != 0x3) {
         fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
@@ -1831,8 +1829,8 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
         return CC_TRB_ERROR;
     }
 
-    cpu_physical_memory_read(ictx+32, (uint8_t *) slot_ctx, sizeof(slot_ctx));
-    cpu_physical_memory_read(ictx+64, (uint8_t *) ep0_ctx, sizeof(ep0_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx+32, slot_ctx, sizeof(slot_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx+64, ep0_ctx, sizeof(ep0_ctx));
 
     DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
             slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
@@ -1881,8 +1879,8 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
     DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
             ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
 
-    cpu_physical_memory_write(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
-    cpu_physical_memory_write(octx+32, (uint8_t *) ep0_ctx, sizeof(ep0_ctx));
+    pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
+    pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
 
     return res;
 }
@@ -1891,7 +1889,7 @@ static TRBCCode xhci_address_slot(XHCIState *xhci, unsigned int slotid,
 static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
                                   uint64_t pictx, bool dc)
 {
-    target_phys_addr_t ictx, octx;
+    dma_addr_t ictx, octx;
     uint32_t ictl_ctx[2];
     uint32_t slot_ctx[4];
     uint32_t islot_ctx[4];
@@ -1905,8 +1903,8 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
     ictx = xhci_mask64(pictx);
     octx = xhci->slots[slotid-1].ctx;
 
-    DPRINTF("xhci: input context at "TARGET_FMT_plx"\n", ictx);
-    DPRINTF("xhci: output context at "TARGET_FMT_plx"\n", octx);
+    DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
+    DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
 
     if (dc) {
         for (i = 2; i <= 31; i++) {
@@ -1915,17 +1913,17 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
             }
         }
 
-        cpu_physical_memory_read(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+        pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
         slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
         slot_ctx[3] |= SLOT_ADDRESSED << SLOT_STATE_SHIFT;
         DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
                 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
-        cpu_physical_memory_write(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+        pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
 
         return CC_SUCCESS;
     }
 
-    cpu_physical_memory_read(ictx, (uint8_t *) ictl_ctx, sizeof(ictl_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if ((ictl_ctx[0] & 0x3) != 0x0 || (ictl_ctx[1] & 0x3) != 0x1) {
         fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
@@ -1933,8 +1931,8 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
         return CC_TRB_ERROR;
     }
 
-    cpu_physical_memory_read(ictx+32, (uint8_t *) islot_ctx, sizeof(islot_ctx));
-    cpu_physical_memory_read(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx));
+    pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
 
     if (SLOT_STATE(slot_ctx[3]) < SLOT_ADDRESSED) {
         fprintf(stderr, "xhci: invalid slot state %08x\n", slot_ctx[3]);
@@ -1946,8 +1944,8 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
             xhci_disable_ep(xhci, slotid, i);
         }
         if (ictl_ctx[1] & (1<<i)) {
-            cpu_physical_memory_read(ictx+32+(32*i),
-                                     (uint8_t *) ep_ctx, sizeof(ep_ctx));
+            pci_dma_read(&xhci->pci_dev, ictx+32+(32*i), ep_ctx,
+                         sizeof(ep_ctx));
             DPRINTF("xhci: input ep%d.%d context: %08x %08x %08x %08x %08x\n",
                     i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
                     ep_ctx[3], ep_ctx[4]);
@@ -1959,8 +1957,7 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
             DPRINTF("xhci: output ep%d.%d context: %08x %08x %08x %08x %08x\n",
                     i/2, i%2, ep_ctx[0], ep_ctx[1], ep_ctx[2],
                     ep_ctx[3], ep_ctx[4]);
-            cpu_physical_memory_write(octx+(32*i),
-                                      (uint8_t *) ep_ctx, sizeof(ep_ctx));
+            pci_dma_write(&xhci->pci_dev, octx+(32*i), ep_ctx, sizeof(ep_ctx));
         }
     }
 
@@ -1972,7 +1969,7 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
     DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
             slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
 
-    cpu_physical_memory_write(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+    pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
 
     return CC_SUCCESS;
 }
@@ -1981,7 +1978,7 @@ static TRBCCode xhci_configure_slot(XHCIState *xhci, unsigned int slotid,
 static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
                                    uint64_t pictx)
 {
-    target_phys_addr_t ictx, octx;
+    dma_addr_t ictx, octx;
     uint32_t ictl_ctx[2];
     uint32_t iep0_ctx[5];
     uint32_t ep0_ctx[5];
@@ -1994,10 +1991,10 @@ static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
     ictx = xhci_mask64(pictx);
     octx = xhci->slots[slotid-1].ctx;
 
-    DPRINTF("xhci: input context at "TARGET_FMT_plx"\n", ictx);
-    DPRINTF("xhci: output context at "TARGET_FMT_plx"\n", octx);
+    DPRINTF("xhci: input context at "DMA_ADDR_FMT"\n", ictx);
+    DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
 
-    cpu_physical_memory_read(ictx, (uint8_t *) ictl_ctx, sizeof(ictl_ctx));
+    pci_dma_read(&xhci->pci_dev, ictx, ictl_ctx, sizeof(ictl_ctx));
 
     if (ictl_ctx[0] != 0x0 || ictl_ctx[1] & ~0x3) {
         fprintf(stderr, "xhci: invalid input context control %08x %08x\n",
@@ -2006,13 +2003,12 @@ static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
     }
 
     if (ictl_ctx[1] & 0x1) {
-        cpu_physical_memory_read(ictx+32,
-                                 (uint8_t *) islot_ctx, sizeof(islot_ctx));
+        pci_dma_read(&xhci->pci_dev, ictx+32, islot_ctx, sizeof(islot_ctx));
 
         DPRINTF("xhci: input slot context: %08x %08x %08x %08x\n",
                 islot_ctx[0], islot_ctx[1], islot_ctx[2], islot_ctx[3]);
 
-        cpu_physical_memory_read(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+        pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
 
         slot_ctx[1] &= ~0xFFFF; /* max exit latency */
         slot_ctx[1] |= islot_ctx[1] & 0xFFFF;
@@ -2022,18 +2018,17 @@ static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
         DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
                 slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
 
-        cpu_physical_memory_write(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+        pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
     }
 
     if (ictl_ctx[1] & 0x2) {
-        cpu_physical_memory_read(ictx+64,
-                                 (uint8_t *) iep0_ctx, sizeof(iep0_ctx));
+        pci_dma_read(&xhci->pci_dev, ictx+64, iep0_ctx, sizeof(iep0_ctx));
 
         DPRINTF("xhci: input ep0 context: %08x %08x %08x %08x %08x\n",
                 iep0_ctx[0], iep0_ctx[1], iep0_ctx[2],
                 iep0_ctx[3], iep0_ctx[4]);
 
-        cpu_physical_memory_read(octx+32, (uint8_t *) ep0_ctx, sizeof(ep0_ctx));
+        pci_dma_read(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
 
         ep0_ctx[1] &= ~0xFFFF0000; /* max packet size*/
         ep0_ctx[1] |= iep0_ctx[1] & 0xFFFF0000;
@@ -2041,8 +2036,7 @@ static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
         DPRINTF("xhci: output ep0 context: %08x %08x %08x %08x %08x\n",
                 ep0_ctx[0], ep0_ctx[1], ep0_ctx[2], ep0_ctx[3], ep0_ctx[4]);
 
-        cpu_physical_memory_write(octx+32,
-                                  (uint8_t *) ep0_ctx, sizeof(ep0_ctx));
+        pci_dma_write(&xhci->pci_dev, octx+32, ep0_ctx, sizeof(ep0_ctx));
     }
 
     return CC_SUCCESS;
@@ -2051,7 +2045,7 @@ static TRBCCode xhci_evaluate_slot(XHCIState *xhci, unsigned int slotid,
 static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
 {
     uint32_t slot_ctx[4];
-    target_phys_addr_t octx;
+    dma_addr_t octx;
     int i;
 
     assert(slotid >= 1 && slotid <= MAXSLOTS);
@@ -2059,7 +2053,7 @@ static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
 
     octx = xhci->slots[slotid-1].ctx;
 
-    DPRINTF("xhci: output context at "TARGET_FMT_plx"\n", octx);
+    DPRINTF("xhci: output context at "DMA_ADDR_FMT"\n", octx);
 
     for (i = 2; i <= 31; i++) {
         if (xhci->slots[slotid-1].eps[i-1]) {
@@ -2067,12 +2061,12 @@ static TRBCCode xhci_reset_slot(XHCIState *xhci, unsigned int slotid)
         }
     }
 
-    cpu_physical_memory_read(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+    pci_dma_read(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
     slot_ctx[3] &= ~(SLOT_STATE_MASK << SLOT_STATE_SHIFT);
     slot_ctx[3] |= SLOT_DEFAULT << SLOT_STATE_SHIFT;
     DPRINTF("xhci: output slot context: %08x %08x %08x %08x\n",
             slot_ctx[0], slot_ctx[1], slot_ctx[2], slot_ctx[3]);
-    cpu_physical_memory_write(octx, (uint8_t *) slot_ctx, sizeof(slot_ctx));
+    pci_dma_write(&xhci->pci_dev, octx, slot_ctx, sizeof(slot_ctx));
 
     return CC_SUCCESS;
 }
@@ -2095,19 +2089,19 @@ static unsigned int xhci_get_slot(XHCIState *xhci, XHCIEvent *event, XHCITRB *tr
 
 static TRBCCode xhci_get_port_bandwidth(XHCIState *xhci, uint64_t pctx)
 {
-    target_phys_addr_t ctx;
+    dma_addr_t ctx;
     uint8_t bw_ctx[MAXPORTS+1];
 
     DPRINTF("xhci_get_port_bandwidth()\n");
 
     ctx = xhci_mask64(pctx);
 
-    DPRINTF("xhci: bandwidth context at "TARGET_FMT_plx"\n", ctx);
+    DPRINTF("xhci: bandwidth context at "DMA_ADDR_FMT"\n", ctx);
 
     /* TODO: actually implement real values here */
     bw_ctx[0] = 0;
     memset(&bw_ctx[1], 80, MAXPORTS); /* 80% */
-    cpu_physical_memory_write(ctx, bw_ctx, sizeof(bw_ctx));
+    pci_dma_write(&xhci->pci_dev, ctx, bw_ctx, sizeof(bw_ctx));
 
     return CC_SUCCESS;
 }
@@ -2128,13 +2122,13 @@ static uint32_t xhci_nec_challenge(uint32_t hi, uint32_t lo)
     return ~val;
 }
 
-static void xhci_via_challenge(uint64_t addr)
+static void xhci_via_challenge(XHCIState *xhci, uint64_t addr)
 {
     uint32_t buf[8];
     uint32_t obuf[8];
-    target_phys_addr_t paddr = xhci_mask64(addr);
+    dma_addr_t paddr = xhci_mask64(addr);
 
-    cpu_physical_memory_read(paddr, (uint8_t *) &buf, 32);
+    pci_dma_read(&xhci->pci_dev, paddr, &buf, 32);
 
     memcpy(obuf, buf, sizeof(obuf));
 
@@ -2150,7 +2144,7 @@ static void xhci_via_challenge(uint64_t addr)
         obuf[7] = obuf[2] ^ obuf[3] ^ 0x65866593;
     }
 
-    cpu_physical_memory_write(paddr, (uint8_t *) &obuf, 32);
+    pci_dma_write(&xhci->pci_dev, paddr, &obuf, 32);
 }
 
 static void xhci_process_commands(XHCIState *xhci)
@@ -2158,7 +2152,7 @@ static void xhci_process_commands(XHCIState *xhci)
     XHCITRB trb;
     TRBType type;
     XHCIEvent event = {ER_COMMAND_COMPLETE, CC_SUCCESS};
-    target_phys_addr_t addr;
+    dma_addr_t addr;
     unsigned int i, slotid = 0;
 
     DPRINTF("xhci_process_commands()\n");
@@ -2247,7 +2241,7 @@ static void xhci_process_commands(XHCIState *xhci)
             event.ccode = xhci_get_port_bandwidth(xhci, trb.parameter);
             break;
         case CR_VENDOR_VIA_CHALLENGE_RESPONSE:
-            xhci_via_challenge(trb.parameter);
+            xhci_via_challenge(xhci, trb.parameter);
             break;
         case CR_VENDOR_NEC_FIRMWARE_REVISION:
             event.type = 48; /* NEC reply */
@@ -2537,7 +2531,7 @@ static void xhci_oper_write(XHCIState *xhci, uint32_t reg, uint32_t val)
             xhci_event(xhci, &event);
             DPRINTF("xhci: command ring stopped (CRCR=%08x)\n", xhci->crcr_low);
         } else {
-            target_phys_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
+            dma_addr_t base = xhci_addr64(xhci->crcr_low & ~0x3f, val);
             xhci_ring_init(xhci, &xhci->cmd_ring, base);
         }
         xhci->crcr_low &= ~(CRCR_CA | CRCR_CS);
commit 0b377169b18d702d980d526578d8515900ca6eb1
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 19 13:36:40 2012 +0200

    usb-host: fix zero-length packets
    
    usb-host optimizes away zero-length packets by not entering the
    processing loop at all.  Which isn't correct, we should submit a
    zero-length urb to the host devicein that case.  This patch makes
    sure we run the processing loop at least once.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index c3684c8..048f8ff 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -887,8 +887,8 @@ static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
     prem = 0;
     pbuf = NULL;
     rem = p->iov.size;
-    while (rem) {
-        if (prem == 0) {
+    do {
+        if (prem == 0 && rem > 0) {
             assert(v < p->iov.niov);
             prem = p->iov.iov[v].iov_len;
             pbuf = p->iov.iov[v].iov_base;
@@ -938,7 +938,7 @@ static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
                 return USB_RET_STALL;
             }
         }
-    }
+    } while (rem > 0);
 
     return USB_RET_ASYNC;
 }
commit 818d59dc179b2861e49f3c6472787a23935aac0d
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 19 13:35:07 2012 +0200

    usb-host: don't dereference invalid iovecs
    
    usb-host assumes the first iovec element is always valid.
    In case of a zero-length packet this isn't true though.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/host-linux.c b/hw/usb/host-linux.c
index 061a1b7..c3684c8 100644
--- a/hw/usb/host-linux.c
+++ b/hw/usb/host-linux.c
@@ -884,16 +884,16 @@ static int usb_host_handle_data(USBDevice *dev, USBPacket *p)
     }
 
     v = 0;
-    prem = p->iov.iov[v].iov_len;
-    pbuf = p->iov.iov[v].iov_base;
+    prem = 0;
+    pbuf = NULL;
     rem = p->iov.size;
     while (rem) {
         if (prem == 0) {
-            v++;
             assert(v < p->iov.niov);
             prem = p->iov.iov[v].iov_len;
             pbuf = p->iov.iov[v].iov_base;
             assert(prem <= rem);
+            v++;
         }
         aurb = async_alloc(s);
         aurb->packet = p;
commit 6d7aeeeb8985634a2015e804045a1ca52573ccc5
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Wed Apr 18 12:08:29 2012 +0200

    usb-storage: fix request canceling
    
    Little fix for usb packet handling on i/o cancelation.  The
    usb packet pointer (s->packet) is cleared at the wrong place:
    The scsi request cancel handler does it.  When a usb packet
    is canceled the usb-storage emulation canceles the scsi request
    if present.  In most cases there is one, so usually s->packet
    is cleared as needed even with the code sitting at the wrong
    place.
    
    If there is no scsi request in flight s->packet is not cleared
    though.  The usb-storage emulation will then try to complete an
    usb packet which is not in flight any more and thereby trigger
    an assert() in the usb core.
    
    Fix this by clearing s->packet at the correct place, which is
    the usb packet cancel header.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index d865a5e..3d2f244 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -268,7 +268,6 @@ static void usb_msd_request_cancelled(SCSIRequest *req)
     if (req == s->req) {
         scsi_req_unref(s->req);
         s->req = NULL;
-        s->packet = NULL;
         s->scsi_len = 0;
     }
 }
@@ -330,6 +329,9 @@ static void usb_msd_cancel_io(USBDevice *dev, USBPacket *p)
 {
     MSDState *s = DO_UPCAST(MSDState, dev, dev);
 
+    assert(s->packet == p);
+    s->packet = NULL;
+
     if (s->req) {
         scsi_req_cancel(s->req);
     }
commit 8a771f77e2abfb81f1f33a986810c16ecae54ca7
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Tue Apr 3 14:21:47 2012 +0200

    usb-ehci: Ensure frindex writes leave a valid frindex value
    
    frindex is a 14 bits counter, so bits 31-14 should always be 0, and
    after the commit titled "usb-ehci: frindex always is a 14 bits counter"
    we rely on frindex always being a multiple of 8. I've not seen this in
    practice, but theoretically a guest can write a value >= 0x4000 or a value
    which is not a multiple of 8 value to frindex, this patch ensures that
    things will still work when that happens.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index c6f21ac..4ff4d40 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -1101,6 +1101,10 @@ static void ehci_mem_writel(void *ptr, target_phys_addr_t addr, uint32_t val)
         val &= USBINTR_MASK;
         break;
 
+    case FRINDEX:
+        val &= 0x00003ff8; /* frindex is 14bits and always a multiple of 8 */
+        break;
+
     case CONFIGFLAG:
         val &= 0x1;
         if (val) {
commit 0cc6a0f19e3de830eaa898ad31c0bc607470b8cb
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 19 13:07:54 2012 +0200

    usb-ehci: add missing usb_packet_init() call
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/core.c b/hw/usb/core.c
index 9a14a53..0e02da7 100644
--- a/hw/usb/core.c
+++ b/hw/usb/core.c
@@ -501,6 +501,7 @@ void usb_packet_set_state(USBPacket *p, USBPacketState state)
 void usb_packet_setup(USBPacket *p, int pid, USBEndpoint *ep)
 {
     assert(!usb_packet_is_inflight(p));
+    assert(p->iov.iov != NULL);
     p->pid = pid;
     p->ep = ep;
     p->result = 0;
diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 10a5b15..c6f21ac 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -664,6 +664,7 @@ static EHCIQueue *ehci_alloc_queue(EHCIState *ehci, int async)
 
     q = g_malloc0(sizeof(*q));
     q->ehci = ehci;
+    usb_packet_init(&q->packet);
     QTAILQ_INSERT_HEAD(head, q, next);
     trace_usb_ehci_queue_action(q, "alloc");
     return q;
commit e59a8cf1eb2196cdaded214ccd1b819c8faad238
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Tue Apr 17 12:33:58 2012 +0200

    usb-ehci: remove hack
    
    To answer the question in the comment removed by this patch:  I think
    this was needed because several places in the ehci emulation did not
    check the T bit of link entries correctly and thus might have followed
    invalid references.  See commit 2a5ff735dc1074171a0cbb1dc228d6d6e907f571
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c
index 23631a4..10a5b15 100644
--- a/hw/usb/hcd-ehci.c
+++ b/hw/usb/hcd-ehci.c
@@ -133,7 +133,6 @@
 #define NB_MAXINTRATE    8        // Max rate at which controller issues ints
 #define NB_PORTS         6        // Number of downstream ports
 #define BUFF_SIZE        5*4096   // Max bytes to transfer per transaction
-#define MAX_ITERATIONS   20       // Max number of QH before we break the loop
 #define MAX_QH           100      // Max allowable queue heads in a chain
 
 /*  Internal periodic / asynchronous schedule state machine states
@@ -1931,24 +1930,8 @@ static void ehci_advance_state(EHCIState *ehci,
 {
     EHCIQueue *q = NULL;
     int again;
-    int iter = 0;
 
     do {
-        if (ehci_get_state(ehci, async) == EST_FETCHQH) {
-            iter++;
-            /* if we are roaming a lot of QH without executing a qTD
-             * something is wrong with the linked list. TO-DO: why is
-             * this hack needed?
-             */
-            assert(iter < MAX_ITERATIONS);
-#if 0
-            if (iter > MAX_ITERATIONS) {
-                DPRINTF("\n*** advance_state: bailing on MAX ITERATIONS***\n");
-                ehci_set_state(ehci, async, EST_ACTIVE);
-                break;
-            }
-#endif
-        }
         switch(ehci_get_state(ehci, async)) {
         case EST_WAITLISTHEAD:
             again = ehci_state_waitlisthead(ehci, async);
@@ -1984,7 +1967,6 @@ static void ehci_advance_state(EHCIState *ehci,
             break;
 
         case EST_EXECUTE:
-            iter = 0;
             again = ehci_state_execute(q, async);
             break;
 
commit ec4a804792ea20f716371a0a661efc9ec15c7ff0
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 26 09:15:04 2012 +0200

    hda: fix codec ids
    
    Our hda codecs exist in two variants:  With CONFIG_MIXEMU=y they expose
    amplifiers for volume control to the guest, with CONFIG_MIXEMU=n they
    don't.
    
    This patch changes the codec ids, they are different now for these two
    cases.  This makes sure windows guests will notice the difference.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: malc <av1474 at comtv.ru>

diff --git a/hw/hda-audio.c b/hw/hda-audio.c
index 4e69c3c..36761dd 100644
--- a/hw/hda-audio.c
+++ b/hw/hda-audio.c
@@ -113,23 +113,25 @@ static void hda_codec_parse_fmt(uint32_t format, struct audsettings *as)
 /* some defines */
 
 #define QEMU_HDA_ID_VENDOR  0x1af4
-#define QEMU_HDA_ID_OUTPUT  ((QEMU_HDA_ID_VENDOR << 16) | 0x10)
-#define QEMU_HDA_ID_DUPLEX  ((QEMU_HDA_ID_VENDOR << 16) | 0x20)
-#define QEMU_HDA_ID_MICRO   ((QEMU_HDA_ID_VENDOR << 16) | 0x30)
-
 #define QEMU_HDA_PCM_FORMATS (AC_SUPPCM_BITS_16 |       \
                               0x1fc /* 16 -> 96 kHz */)
 #define QEMU_HDA_AMP_NONE    (0)
 #define QEMU_HDA_AMP_STEPS   0x4a
 
 #ifdef CONFIG_MIXEMU
-#define QEMU_HDA_AMP_CAPS                                               \
+# define QEMU_HDA_ID_OUTPUT  ((QEMU_HDA_ID_VENDOR << 16) | 0x12)
+# define QEMU_HDA_ID_DUPLEX  ((QEMU_HDA_ID_VENDOR << 16) | 0x22)
+# define QEMU_HDA_ID_MICRO   ((QEMU_HDA_ID_VENDOR << 16) | 0x32)
+# define QEMU_HDA_AMP_CAPS                                              \
     (AC_AMPCAP_MUTE |                                                   \
      (QEMU_HDA_AMP_STEPS << AC_AMPCAP_OFFSET_SHIFT)    |                \
      (QEMU_HDA_AMP_STEPS << AC_AMPCAP_NUM_STEPS_SHIFT) |                \
      (3                  << AC_AMPCAP_STEP_SIZE_SHIFT))
 #else
-#define QEMU_HDA_AMP_CAPS    QEMU_HDA_AMP_NONE
+# define QEMU_HDA_ID_OUTPUT  ((QEMU_HDA_ID_VENDOR << 16) | 0x11)
+# define QEMU_HDA_ID_DUPLEX  ((QEMU_HDA_ID_VENDOR << 16) | 0x21)
+# define QEMU_HDA_ID_MICRO   ((QEMU_HDA_ID_VENDOR << 16) | 0x31)
+# define QEMU_HDA_AMP_CAPS   QEMU_HDA_AMP_NONE
 #endif
 
 /* common: audio output widget */
commit 201100656986735250ed4cd47be6b8a31c771763
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 26 09:15:03 2012 +0200

    hda: add hda-micro codec
    
    It's identical to the hda-duplex codec, except that it advertises the
    input as microphone instead of line-in and the output as speaker instead
    of line-out.  Some guest apps (microsoft netmeeting being one) are picky
    when it comes to selecting the recording source and don't accept
    line-in, so give them what they expect.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: malc <av1474 at comtv.ru>

diff --git a/hw/hda-audio.c b/hw/hda-audio.c
index 411be08..4e69c3c 100644
--- a/hw/hda-audio.c
+++ b/hw/hda-audio.c
@@ -115,6 +115,7 @@ static void hda_codec_parse_fmt(uint32_t format, struct audsettings *as)
 #define QEMU_HDA_ID_VENDOR  0x1af4
 #define QEMU_HDA_ID_OUTPUT  ((QEMU_HDA_ID_VENDOR << 16) | 0x10)
 #define QEMU_HDA_ID_DUPLEX  ((QEMU_HDA_ID_VENDOR << 16) | 0x20)
+#define QEMU_HDA_ID_MICRO   ((QEMU_HDA_ID_VENDOR << 16) | 0x30)
 
 #define QEMU_HDA_PCM_FORMATS (AC_SUPPCM_BITS_16 |       \
                               0x1fc /* 16 -> 96 kHz */)
@@ -427,6 +428,117 @@ static const desc_codec duplex = {
     .nnodes = ARRAY_SIZE(duplex_nodes),
 };
 
+/* micro: root node */
+static const desc_param micro_params_root[] = {
+    {
+        .id  = AC_PAR_VENDOR_ID,
+        .val = QEMU_HDA_ID_MICRO,
+    },{
+        .id  = AC_PAR_SUBSYSTEM_ID,
+        .val = QEMU_HDA_ID_MICRO,
+    },{
+        .id  = AC_PAR_REV_ID,
+        .val = 0x00100101,
+    },{
+        .id  = AC_PAR_NODE_COUNT,
+        .val = 0x00010001,
+    },
+};
+
+/* micro: audio function */
+static const desc_param micro_params_audio_func[] = {
+    {
+        .id  = AC_PAR_FUNCTION_TYPE,
+        .val = AC_GRP_AUDIO_FUNCTION,
+    },{
+        .id  = AC_PAR_SUBSYSTEM_ID,
+        .val = QEMU_HDA_ID_MICRO,
+    },{
+        .id  = AC_PAR_NODE_COUNT,
+        .val = 0x00020004,
+    },{
+        .id  = AC_PAR_PCM,
+        .val = QEMU_HDA_PCM_FORMATS,
+    },{
+        .id  = AC_PAR_STREAM,
+        .val = AC_SUPFMT_PCM,
+    },{
+        .id  = AC_PAR_AMP_IN_CAP,
+        .val = QEMU_HDA_AMP_NONE,
+    },{
+        .id  = AC_PAR_AMP_OUT_CAP,
+        .val = QEMU_HDA_AMP_NONE,
+    },{
+        .id  = AC_PAR_GPIO_CAP,
+        .val = 0,
+    },{
+        .id  = AC_PAR_AUDIO_FG_CAP,
+        .val = 0x00000808,
+    },{
+        .id  = AC_PAR_POWER_STATE,
+        .val = 0,
+    },
+};
+
+/* micro: nodes */
+static const desc_node micro_nodes[] = {
+    {
+        .nid     = AC_NODE_ROOT,
+        .name    = "root",
+        .params  = micro_params_root,
+        .nparams = ARRAY_SIZE(micro_params_root),
+    },{
+        .nid     = 1,
+        .name    = "func",
+        .params  = micro_params_audio_func,
+        .nparams = ARRAY_SIZE(micro_params_audio_func),
+    },{
+        .nid     = 2,
+        .name    = "dac",
+        .params  = common_params_audio_dac,
+        .nparams = ARRAY_SIZE(common_params_audio_dac),
+        .stindex = 0,
+    },{
+        .nid     = 3,
+        .name    = "out",
+        .params  = common_params_audio_lineout,
+        .nparams = ARRAY_SIZE(common_params_audio_lineout),
+        .config  = ((AC_JACK_PORT_COMPLEX << AC_DEFCFG_PORT_CONN_SHIFT) |
+                    (AC_JACK_SPEAKER      << AC_DEFCFG_DEVICE_SHIFT)    |
+                    (AC_JACK_CONN_UNKNOWN << AC_DEFCFG_CONN_TYPE_SHIFT) |
+                    (AC_JACK_COLOR_GREEN  << AC_DEFCFG_COLOR_SHIFT)     |
+                    0x10),
+        .pinctl  = AC_PINCTL_OUT_EN,
+        .conn    = (uint32_t[]) { 2 },
+    },{
+        .nid     = 4,
+        .name    = "adc",
+        .params  = common_params_audio_adc,
+        .nparams = ARRAY_SIZE(common_params_audio_adc),
+        .stindex = 1,
+        .conn    = (uint32_t[]) { 5 },
+    },{
+        .nid     = 5,
+        .name    = "in",
+        .params  = common_params_audio_linein,
+        .nparams = ARRAY_SIZE(common_params_audio_linein),
+        .config  = ((AC_JACK_PORT_COMPLEX << AC_DEFCFG_PORT_CONN_SHIFT) |
+                    (AC_JACK_MIC_IN       << AC_DEFCFG_DEVICE_SHIFT)    |
+                    (AC_JACK_CONN_UNKNOWN << AC_DEFCFG_CONN_TYPE_SHIFT) |
+                    (AC_JACK_COLOR_RED    << AC_DEFCFG_COLOR_SHIFT)     |
+                    0x20),
+        .pinctl  = AC_PINCTL_IN_EN,
+    }
+};
+
+/* micro: codec */
+static const desc_codec micro = {
+    .name   = "micro",
+    .iid    = QEMU_HDA_ID_MICRO,
+    .nodes  = micro_nodes,
+    .nnodes = ARRAY_SIZE(micro_nodes),
+};
+
 /* -------------------------------------------------------------------------- */
 
 static const char *fmt2name[] = {
@@ -906,6 +1018,11 @@ static int hda_audio_init_duplex(HDACodecDevice *hda)
     return hda_audio_init(hda, &duplex);
 }
 
+static int hda_audio_init_micro(HDACodecDevice *hda)
+{
+    return hda_audio_init(hda, &micro);
+}
+
 static void hda_audio_output_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -915,7 +1032,7 @@ static void hda_audio_output_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
-    dc->desc = "HDA Audio Codec, output-only";
+    dc->desc = "HDA Audio Codec, output-only (line-out)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
 }
@@ -936,7 +1053,7 @@ static void hda_audio_duplex_class_init(ObjectClass *klass, void *data)
     k->exit = hda_audio_exit;
     k->command = hda_audio_command;
     k->stream = hda_audio_stream;
-    dc->desc = "HDA Audio Codec, duplex";
+    dc->desc = "HDA Audio Codec, duplex (line-out, line-in)";
     dc->vmsd = &vmstate_hda_audio;
     dc->props = hda_audio_properties;
 }
@@ -948,10 +1065,32 @@ static TypeInfo hda_audio_duplex_info = {
     .class_init    = hda_audio_duplex_class_init,
 };
 
+static void hda_audio_micro_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    HDACodecDeviceClass *k = HDA_CODEC_DEVICE_CLASS(klass);
+
+    k->init = hda_audio_init_micro;
+    k->exit = hda_audio_exit;
+    k->command = hda_audio_command;
+    k->stream = hda_audio_stream;
+    dc->desc = "HDA Audio Codec, duplex (speaker, microphone)";
+    dc->vmsd = &vmstate_hda_audio;
+    dc->props = hda_audio_properties;
+}
+
+static TypeInfo hda_audio_micro_info = {
+    .name          = "hda-micro",
+    .parent        = TYPE_HDA_CODEC_DEVICE,
+    .instance_size = sizeof(HDAAudioState),
+    .class_init    = hda_audio_micro_class_init,
+};
+
 static void hda_audio_register_types(void)
 {
     type_register_static(&hda_audio_output_info);
     type_register_static(&hda_audio_duplex_info);
+    type_register_static(&hda_audio_micro_info);
 }
 
 type_init(hda_audio_register_types)
commit d0c2bbb9f04925eeda9948586aa382ccf68e26e7
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Apr 26 09:15:02 2012 +0200

    hda: move input widgets from duplex to common
    
    Preparing for a new user of the input widget definitions.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: malc <av1474 at comtv.ru>

diff --git a/hw/hda-audio.c b/hw/hda-audio.c
index 8995519..411be08 100644
--- a/hw/hda-audio.c
+++ b/hw/hda-audio.c
@@ -155,6 +155,34 @@ static const desc_param common_params_audio_dac[] = {
     },
 };
 
+/* common: audio input widget */
+static const desc_param common_params_audio_adc[] = {
+    {
+        .id  = AC_PAR_AUDIO_WIDGET_CAP,
+        .val = ((AC_WID_AUD_IN << AC_WCAP_TYPE_SHIFT) |
+                AC_WCAP_CONN_LIST |
+                AC_WCAP_FORMAT_OVRD |
+                AC_WCAP_AMP_OVRD |
+                AC_WCAP_IN_AMP |
+                AC_WCAP_STEREO),
+    },{
+        .id  = AC_PAR_CONNLIST_LEN,
+        .val = 1,
+    },{
+        .id  = AC_PAR_PCM,
+        .val = QEMU_HDA_PCM_FORMATS,
+    },{
+        .id  = AC_PAR_STREAM,
+        .val = AC_SUPFMT_PCM,
+    },{
+        .id  = AC_PAR_AMP_IN_CAP,
+        .val = QEMU_HDA_AMP_CAPS,
+    },{
+        .id  = AC_PAR_AMP_OUT_CAP,
+        .val = QEMU_HDA_AMP_NONE,
+    },
+};
+
 /* common: pin widget (line-out) */
 static const desc_param common_params_audio_lineout[] = {
     {
@@ -177,6 +205,24 @@ static const desc_param common_params_audio_lineout[] = {
     },
 };
 
+/* common: pin widget (line-in) */
+static const desc_param common_params_audio_linein[] = {
+    {
+        .id  = AC_PAR_AUDIO_WIDGET_CAP,
+        .val = ((AC_WID_PIN << AC_WCAP_TYPE_SHIFT) |
+                AC_WCAP_STEREO),
+    },{
+        .id  = AC_PAR_PIN_CAP,
+        .val = AC_PINCAP_IN,
+    },{
+        .id  = AC_PAR_AMP_IN_CAP,
+        .val = QEMU_HDA_AMP_NONE,
+    },{
+        .id  = AC_PAR_AMP_OUT_CAP,
+        .val = QEMU_HDA_AMP_NONE,
+    },
+};
+
 /* output: root node */
 static const desc_param output_params_root[] = {
     {
@@ -287,52 +333,6 @@ static const desc_param duplex_params_root[] = {
     },
 };
 
-/* duplex: audio input widget */
-static const desc_param duplex_params_audio_adc[] = {
-    {
-        .id  = AC_PAR_AUDIO_WIDGET_CAP,
-        .val = ((AC_WID_AUD_IN << AC_WCAP_TYPE_SHIFT) |
-                AC_WCAP_CONN_LIST |
-                AC_WCAP_FORMAT_OVRD |
-                AC_WCAP_AMP_OVRD |
-                AC_WCAP_IN_AMP |
-                AC_WCAP_STEREO),
-    },{
-        .id  = AC_PAR_CONNLIST_LEN,
-        .val = 1,
-    },{
-        .id  = AC_PAR_PCM,
-        .val = QEMU_HDA_PCM_FORMATS,
-    },{
-        .id  = AC_PAR_STREAM,
-        .val = AC_SUPFMT_PCM,
-    },{
-        .id  = AC_PAR_AMP_IN_CAP,
-        .val = QEMU_HDA_AMP_CAPS,
-    },{
-        .id  = AC_PAR_AMP_OUT_CAP,
-        .val = QEMU_HDA_AMP_NONE,
-    },
-};
-
-/* duplex: pin widget (line-in) */
-static const desc_param duplex_params_audio_linein[] = {
-    {
-        .id  = AC_PAR_AUDIO_WIDGET_CAP,
-        .val = ((AC_WID_PIN << AC_WCAP_TYPE_SHIFT) |
-                AC_WCAP_STEREO),
-    },{
-        .id  = AC_PAR_PIN_CAP,
-        .val = AC_PINCAP_IN,
-    },{
-        .id  = AC_PAR_AMP_IN_CAP,
-        .val = QEMU_HDA_AMP_NONE,
-    },{
-        .id  = AC_PAR_AMP_OUT_CAP,
-        .val = QEMU_HDA_AMP_NONE,
-    },
-};
-
 /* duplex: audio function */
 static const desc_param duplex_params_audio_func[] = {
     {
@@ -401,15 +401,15 @@ static const desc_node duplex_nodes[] = {
     },{
         .nid     = 4,
         .name    = "adc",
-        .params  = duplex_params_audio_adc,
-        .nparams = ARRAY_SIZE(duplex_params_audio_adc),
+        .params  = common_params_audio_adc,
+        .nparams = ARRAY_SIZE(common_params_audio_adc),
         .stindex = 1,
         .conn    = (uint32_t[]) { 5 },
     },{
         .nid     = 5,
         .name    = "in",
-        .params  = duplex_params_audio_linein,
-        .nparams = ARRAY_SIZE(duplex_params_audio_linein),
+        .params  = common_params_audio_linein,
+        .nparams = ARRAY_SIZE(common_params_audio_linein),
         .config  = ((AC_JACK_PORT_COMPLEX << AC_DEFCFG_PORT_CONN_SHIFT) |
                     (AC_JACK_LINE_IN      << AC_DEFCFG_DEVICE_SHIFT)    |
                     (AC_JACK_CONN_UNKNOWN << AC_DEFCFG_CONN_TYPE_SHIFT) |
commit aa09c9518ca6ce24e7b659503443e5f907fbd41e
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 17:52:27 2012 +0200

    MAINTAINERS: Document all stable trees
    
    We currently host stable trees for 0.10, 0.14, 0.15 and 1.0.
    Sort in descending order. It is expected that further non-stable
    sections will be added above these so this order avoids scrolling
    through an ever-growing list of stable trees.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 9d58828..90fe022 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -638,3 +638,25 @@ TCI target
 M: Stefan Weil <sw at weilnetz.de>
 S: Maintained
 F: tcg/tci/
+
+Stable branches
+---------------
+Stable 1.0
+L: qemu-stable at nongnu.org
+T: git git://git.qemu.org/qemu-stable-1.0.git
+S: Orphan
+
+Stable 0.15
+L: qemu-stable at nongnu.org
+T: git git://git.qemu.org/qemu-stable-0.15.git
+S: Orphan
+
+Stable 0.14
+L: qemu-stable at nongnu.org
+T: git git://git.qemu.org/qemu-stable-0.14.git
+S: Orphan
+
+Stable 0.10
+L: qemu-stable at nongnu.org
+T: git git://git.qemu.org/qemu-stable-0.10.git
+S: Orphan
commit 3f3309cb269c3965d6972a1a0d5f6d0c5ecdf7f3
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 18:23:55 2012 +0200

    MAINTAINERS: Fix SCM tree for virtio-9p
    
    Instead of a Web link, T: is supposed to indicate type of SCM and
    pullable URL, so switch to the git:// URL.
    Also harmonize the spacing between sections while at it.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Aneesh Kumar K.V <aneesh.kumar at linux.vnet.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 305dbf9..9d58828 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -464,8 +464,7 @@ M: Aneesh Kumar K.V <aneesh.kumar at linux.vnet.ibm.com>
 S: Supported
 F: hw/9pfs/
 F: fsdev/
-T: https://github.com/kvaneesh/QEMU
-
+T: git git://github.com/kvaneesh/QEMU.git
 
 virtio-blk
 M: Kevin Wolf <kwolf at redhat.com>
commit 1ab09a403d8c7985178abe06bfe823fc0075037f
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 18:03:42 2012 +0200

    MAINTAINERS: Indicate type of SCM
    
    T: lines are supposed to indicate whether it's git.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 7781023..305dbf9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -437,7 +437,7 @@ M: Paolo Bonzini <pbonzini at redhat.com>
 S: Supported
 F: hw/virtio-scsi.*
 F: hw/scsi*
-T: git://github.com/bonzini/qemu.git scsi-next
+T: git git://github.com/bonzini/qemu.git scsi-next
 
 LSI53C895A
 M: Paul Brook <paul at codesourcery.com>
@@ -543,13 +543,13 @@ S: Odd Fixes
 F: block/nbd.c
 F: nbd.*
 F: qemu-nbd.c
-T: git://github.com/bonzini/qemu.git nbd-next
+T: git git://github.com/bonzini/qemu.git nbd-next
 
 SLIRP
 M: Jan Kiszka <jan.kiszka at siemens.com>
 S: Maintained
 F: slirp/
-T: git://git.kiszka.org/qemu.git queues/slirp
+T: git git://git.kiszka.org/qemu.git queues/slirp
 
 Tracing
 M: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>
@@ -558,7 +558,7 @@ F: trace/
 F: scripts/tracetool.py
 F: scripts/tracetool/
 F: docs/tracing.txt
-T: git://github.com/stefanha/qemu.git tracing
+T: git git://github.com/stefanha/qemu.git tracing
 
 Checkpatch
 M: Blue Swirl <blauwirbel at gmail.com>
commit 8ef9cd55ad6a15eaf31c58f0b1a6f9c0e8e7c4a9
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 17:22:03 2012 +0200

    MAINTAINERS: Fix TCI file pattern
    
    tcg/tci is a directory, so for recursive semantics add a trailing slash.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Stefan Weil <sw at weilnetz.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index ea32786..7781023 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -638,4 +638,4 @@ F: tcg/sparc/
 TCI target
 M: Stefan Weil <sw at weilnetz.de>
 S: Maintained
-F: tcg/tci
+F: tcg/tci/
commit aebeca25024742f311457f72d19e8f5809c159fa
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 17:19:12 2012 +0200

    MAINTAINERS: Fix virtio-9p file pattern
    
    Only one pattern is allowed per F: line, split in two.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Aneesh Kumar K.V <aneesh.kumar at linux.vnet.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 83d3568..ea32786 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -462,7 +462,8 @@ F: hw/virtio*
 virtio-9p
 M: Aneesh Kumar K.V <aneesh.kumar at linux.vnet.ibm.com>
 S: Supported
-F: hw/9pfs/ fsdev/
+F: hw/9pfs/
+F: fsdev/
 T: https://github.com/kvaneesh/QEMU
 
 
commit 2df6dabb14801eecc1ed66a56a0540bd0b3be850
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Apr 13 17:18:13 2012 +0200

    MAINTAINERS: Fix PC file pattern
    
    Only one pattern is allowed per F: line, split it in two.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index cce37e7..83d3568 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -399,7 +399,8 @@ X86 Machines
 PC
 M: Anthony Liguori <aliguori at us.ibm.com>
 S: Supported
-F: hw/pc.[ch] hw/pc_piix.c
+F: hw/pc.[ch]
+F: hw/pc_piix.c
 
 Xtensa Machines
 ---------------
commit c0424934fae64785adc3d3818f2e6ad1bcb50ca9
Author: Lluís Vilanova <vilanova at ac.upc.edu>
Date:   Wed Apr 18 20:15:45 2012 +0200

    Beautify makefile commands for generation of files with tracetool
    
    Signed-off-by: Lluís Vilanova <vilanova at ac.upc.edu>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>

diff --git a/Makefile.objs b/Makefile.objs
index 6d6f24d..70c5c79 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -373,17 +373,22 @@ libdis-$(CONFIG_LM32_DIS) += lm32-dis.o
 # trace
 
 ifeq ($(TRACE_BACKEND),dtrace)
-trace.h: trace.h-timestamp trace-dtrace.h
-else
-trace.h: trace.h-timestamp
+TRACE_H_EXTRA_DEPS=trace-dtrace.h
 endif
+trace.h: trace.h-timestamp $(TRACE_H_EXTRA_DEPS)
 trace.h-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/tracetool.py --format=h --backend=$(TRACE_BACKEND) < $< > $@,"  GEN   trace.h")
+	$(call quiet-command,$(TRACETOOL) \
+		--format=h \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.h")
 	@cmp -s $@ trace.h || cp $@ trace.h
 
 trace.c: trace.c-timestamp
 trace.c-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/tracetool.py --format=c --backend=$(TRACE_BACKEND) < $< > $@,"  GEN   trace.c")
+	$(call quiet-command,$(TRACETOOL) \
+		--format=c \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace.c")
 	@cmp -s $@ trace.c || cp $@ trace.c
 
 trace.o: trace.c $(GENERATED_HEADERS)
@@ -396,11 +401,14 @@ trace-dtrace.h: trace-dtrace.dtrace
 # rule file. So we use '.dtrace' instead
 trace-dtrace.dtrace: trace-dtrace.dtrace-timestamp
 trace-dtrace.dtrace-timestamp: $(SRC_PATH)/trace-events $(BUILD_DIR)/config-host.mak
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/tracetool.py --format=d --backend=$(TRACE_BACKEND) < $< > $@,"  GEN   trace-dtrace.dtrace")
+	$(call quiet-command,$(TRACETOOL) \
+		--format=d \
+		--backend=$(TRACE_BACKEND) \
+		< $< > $@,"  GEN   trace-dtrace.dtrace")
 	@cmp -s $@ trace-dtrace.dtrace || cp $@ trace-dtrace.dtrace
 
 trace-dtrace.o: trace-dtrace.dtrace $(GENERATED_HEADERS)
-	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN trace-dtrace.o")
+	$(call quiet-command,dtrace -o $@ -G -s $<, "  GEN   trace-dtrace.o")
 
 ifeq ($(LIBTOOL),)
 trace-dtrace.lo: trace-dtrace.dtrace
diff --git a/Makefile.target b/Makefile.target
index 4fbbabf..1cf6943 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -59,13 +59,13 @@ TARGET_TYPE=system
 endif
 
 $(QEMU_PROG).stp: $(SRC_PATH)/trace-events
-	$(call quiet-command,$(PYTHON) $(SRC_PATH)/scripts/tracetool.py \
+	$(call quiet-command,$(TRACETOOL) \
 		--format=stap \
 		--backend=$(TRACE_BACKEND) \
 		--binary=$(bindir)/$(QEMU_PROG) \
 		--target-arch=$(TARGET_ARCH) \
 		--target-type=$(TARGET_TYPE) \
-		< $(SRC_PATH)/trace-events > $(QEMU_PROG).stp,"  GEN   $(QEMU_PROG).stp")
+		< $< > $@,"  GEN   $(QEMU_PROG).stp")
 else
 stap:
 endif
diff --git a/rules.mak b/rules.mak
index c30093c..efef6f2 100644
--- a/rules.mak
+++ b/rules.mak
@@ -59,6 +59,9 @@ find-in-path = $(if $(find-string /, $1), \
         $(wildcard $1), \
         $(wildcard $(patsubst %, %/$1, $(subst :, ,$(PATH)))))
 
+# Generate files with tracetool
+TRACETOOL=$(PYTHON) $(SRC_PATH)/scripts/tracetool.py
+
 # Generate timestamp files for .h include files
 
 %.h: %.h-timestamp
commit 19ac36b5e2bdbcb8eb4165c2d028efeac91c99aa
Author: Lluís Vilanova <vilanova at ac.upc.edu>
Date:   Wed Apr 18 20:15:39 2012 +0200

    Generic elimination of auto-generated files
    
    Signed-off-by: Lluís Vilanova <vilanova at ac.upc.edu>
    Signed-off-by: Stefan Hajnoczi <stefanha at linux.vnet.ibm.com>

diff --git a/Makefile b/Makefile
index 4f43793..72f7ab2 100644
--- a/Makefile
+++ b/Makefile
@@ -23,7 +23,7 @@ ifeq ($(TRACE_BACKEND),dtrace)
 GENERATED_HEADERS += trace-dtrace.h
 endif
 GENERATED_HEADERS += qmp-commands.h qapi-types.h qapi-visit.h
-GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c
+GENERATED_SOURCES += qmp-marshal.c qapi-types.c qapi-visit.c trace.c
 
 # Don't try to regenerate Makefile or configure
 # We don't generate any of them
@@ -220,11 +220,11 @@ clean:
 	rm -f qom/*.o qom/*.d
 	rm -f qemu-img-cmds.h
 	rm -f trace/*.o trace/*.d
-	rm -f trace.c trace.h trace.c-timestamp trace.h-timestamp
 	rm -f trace-dtrace.dtrace trace-dtrace.dtrace-timestamp
+	@# May not be present in GENERATED_HEADERS
 	rm -f trace-dtrace.h trace-dtrace.h-timestamp
-	rm -f $(GENERATED_HEADERS)
-	rm -f $(GENERATED_SOURCES)
+	rm -f $(foreach f,$(GENERATED_HEADERS),$(f) $(f)-timestamp)
+	rm -f $(foreach f,$(GENERATED_SOURCES),$(f) $(f)-timestamp)
 	rm -rf $(qapi-dir)
 	$(MAKE) -C tests/tcg clean
 	for d in $(ALL_SUBDIRS) $(QEMULIBS) libcacard; do \
commit 439972253a15870be6777c9f4cdb3985797a9b7c
Author: Amit Shah <amit.shah at redhat.com>
Date:   Tue Apr 24 19:33:59 2012 +0530

    virtio-serial-bus: Unset guest_connected at reset and driver reset
    
    When a guest driver resets the virtio status to not ready, or when qemu
    is reset, reset all ports' guest_connected bit and let port users know
    of this event if they have the guest_close() callback registered.
    
    Reviewed-by: Alon Levy <alevy at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index 796224b..ffbdfc2 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -528,6 +528,22 @@ static void set_config(VirtIODevice *vdev, const uint8_t *config_data)
     memcpy(&config, config_data, sizeof(config));
 }
 
+static void guest_reset(VirtIOSerial *vser)
+{
+    VirtIOSerialPort *port;
+    VirtIOSerialPortClass *vsc;
+
+    QTAILQ_FOREACH(port, &vser->ports, next) {
+        vsc = VIRTIO_SERIAL_PORT_GET_CLASS(port);
+        if (port->guest_connected) {
+            port->guest_connected = false;
+
+            if (vsc->guest_close)
+                vsc->guest_close(port);
+        }
+    }
+}
+
 static void set_status(VirtIODevice *vdev, uint8_t status)
 {
     VirtIOSerial *vser;
@@ -546,6 +562,17 @@ static void set_status(VirtIODevice *vdev, uint8_t status)
          */
         port->guest_connected = true;
     }
+    if (!(status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+        guest_reset(vser);
+    }
+}
+
+static void vser_reset(VirtIODevice *vdev)
+{
+    VirtIOSerial *vser;
+
+    vser = DO_UPCAST(VirtIOSerial, vdev, vdev);
+    guest_reset(vser);
 }
 
 static void virtio_serial_save(QEMUFile *f, void *opaque)
@@ -918,6 +945,7 @@ VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf)
     vser->vdev.get_config = get_config;
     vser->vdev.set_config = set_config;
     vser->vdev.set_status = set_status;
+    vser->vdev.reset = vser_reset;
 
     vser->qdev = dev;
 
commit 62a9fbf7fd022103c6b271abd7b7834b84ba7071
Author: Alon Levy <alevy at redhat.com>
Date:   Mon Apr 23 18:23:10 2012 +0300

    virtio-serial-bus: fix guest_connected init before driver init
    
    guest_connected should be false before guest driver initialization, and
    true after, both for multiport aware and non multiport aware drivers.
    
    Don't set it before the guest_features are available; instead use
    set_status which is called by io to VIRTIO_PCI_STATUS with
    VIRTIO_CONFIG_S_DRIVER_OK by even older non multiport drivers.
    
    [Amit: Add comment, tweak summary, only set guest_connected and not
           reset it as a side-effect.]
    
    Signed-off-by: Alon Levy <alevy at redhat.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Amit Shah <amit.shah at redhat.com>

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index e22940e..796224b 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -528,6 +528,26 @@ static void set_config(VirtIODevice *vdev, const uint8_t *config_data)
     memcpy(&config, config_data, sizeof(config));
 }
 
+static void set_status(VirtIODevice *vdev, uint8_t status)
+{
+    VirtIOSerial *vser;
+    VirtIOSerialPort *port;
+
+    vser = DO_UPCAST(VirtIOSerial, vdev, vdev);
+    port = find_port_by_id(vser, 0);
+
+    if (port && !use_multiport(port->vser)
+        && (status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+        /*
+         * Non-multiport guests won't be able to tell us guest
+         * open/close status.  Such guests can only have a port at id
+         * 0, so set guest_connected for such ports as soon as guest
+         * is up.
+         */
+        port->guest_connected = true;
+    }
+}
+
 static void virtio_serial_save(QEMUFile *f, void *opaque)
 {
     VirtIOSerial *s = opaque;
@@ -798,14 +818,6 @@ static int virtser_port_qdev_init(DeviceState *qdev)
         return ret;
     }
 
-    if (!use_multiport(port->vser)) {
-        /*
-         * Allow writes to guest in this case; we have no way of
-         * knowing if a guest port is connected.
-         */
-        port->guest_connected = true;
-    }
-
     port->elem.out_num = 0;
 
     QTAILQ_INSERT_TAIL(&port->vser->ports, port, next);
@@ -905,6 +917,7 @@ VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf)
     vser->vdev.get_features = get_features;
     vser->vdev.get_config = get_config;
     vser->vdev.set_config = set_config;
+    vser->vdev.set_status = set_status;
 
     vser->qdev = dev;
 
commit 89e48965609f96900189aeb373e7e23693eb6eb5
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Apr 18 00:12:23 2012 +0200

    target-i386: Introduce "tsc-frequency" property for X86CPU
    
    Use Hz as unit.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 0ff79a5..65d9af6 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -855,6 +855,37 @@ static void x86_cpuid_set_model_id(Object *obj, const char *model_id,
     }
 }
 
+static void x86_cpuid_get_tsc_freq(Object *obj, Visitor *v, void *opaque,
+                                   const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    int64_t value;
+
+    value = cpu->env.tsc_khz * 1000;
+    visit_type_int(v, &value, name, errp);
+}
+
+static void x86_cpuid_set_tsc_freq(Object *obj, Visitor *v, void *opaque,
+                                   const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    const int64_t min = 0;
+    const int64_t max = INT_MAX;
+    int64_t value;
+
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
+    cpu->env.tsc_khz = value / 1000;
+}
+
 static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)
 {
     unsigned int i;
@@ -1155,7 +1186,8 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     env->cpuid_svm_features = def->svm_features;
     env->cpuid_ext4_features = def->ext4_features;
     env->cpuid_xlevel2 = def->xlevel2;
-    env->tsc_khz = def->tsc_khz;
+    object_property_set_int(OBJECT(cpu), (int64_t)def->tsc_khz * 1000,
+                            "tsc-frequency", &error);
     if (!kvm_enabled()) {
         env->cpuid_features &= TCG_FEATURES;
         env->cpuid_ext_features &= TCG_EXT_FEATURES;
@@ -1718,6 +1750,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add_str(obj, "model-id",
                             x86_cpuid_get_model_id,
                             x86_cpuid_set_model_id, NULL);
+    object_property_add(obj, "tsc-frequency", "int",
+                        x86_cpuid_get_tsc_freq,
+                        x86_cpuid_set_tsc_freq, NULL, NULL, NULL);
 
     env->cpuid_apic_id = env->cpu_index;
     mce_init(cpu);
commit d480e1aff2f3df3d02900905bcc8e0c4e4c108c4
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 19:22:58 2012 +0200

    target-i386: Prepare "vendor" property for X86CPU
    
    Using it now would incur converting the three x86_def_t vendor words
    into a string for object_property_set_str(), then back to three words
    in the "vendor" setter.
    The built-in CPU definitions use numeric preprocessor defines to
    initialize the three words in a charset-safe way, so do not change the
    fields to char[12] just to use the setter.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index deac4a7..0ff79a5 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -777,6 +777,47 @@ static void x86_cpuid_set_xlevel(Object *obj, Visitor *v, void *opaque,
     cpu->env.cpuid_xlevel = value;
 }
 
+static char *x86_cpuid_get_vendor(Object *obj, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    char *value;
+    int i;
+
+    value = (char *)g_malloc(12 + 1);
+    for (i = 0; i < 4; i++) {
+        value[i    ] = env->cpuid_vendor1 >> (8 * i);
+        value[i + 4] = env->cpuid_vendor2 >> (8 * i);
+        value[i + 8] = env->cpuid_vendor3 >> (8 * i);
+    }
+    value[12] = '\0';
+    return value;
+}
+
+static void x86_cpuid_set_vendor(Object *obj, const char *value,
+                                 Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    int i;
+
+    if (strlen(value) != 12) {
+        error_set(errp, QERR_PROPERTY_VALUE_BAD, "",
+                  "vendor", value);
+        return;
+    }
+
+    env->cpuid_vendor1 = 0;
+    env->cpuid_vendor2 = 0;
+    env->cpuid_vendor3 = 0;
+    for (i = 0; i < 4; i++) {
+        env->cpuid_vendor1 |= ((uint8_t)value[i    ]) << (8 * i);
+        env->cpuid_vendor2 |= ((uint8_t)value[i + 4]) << (8 * i);
+        env->cpuid_vendor3 |= ((uint8_t)value[i + 8]) << (8 * i);
+    }
+    env->cpuid_vendor_override = 1;
+}
+
 static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
 {
     X86CPU *cpu = X86_CPU(obj);
@@ -1671,6 +1712,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "xlevel", "int",
                         x86_cpuid_get_xlevel,
                         x86_cpuid_set_xlevel, NULL, NULL, NULL);
+    object_property_add_str(obj, "vendor",
+                            x86_cpuid_get_vendor,
+                            x86_cpuid_set_vendor, NULL);
     object_property_add_str(obj, "model-id",
                             x86_cpuid_get_model_id,
                             x86_cpuid_set_model_id, NULL);
commit 16b93aa89df07524a695855545a88522ef47fa36
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 18:44:07 2012 +0200

    target-i386: Introduce "xlevel" property for X86CPU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 5b03c47..deac4a7 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -744,6 +744,39 @@ static void x86_cpuid_set_level(Object *obj, Visitor *v, void *opaque,
     cpu->env.cpuid_level = value;
 }
 
+static void x86_cpuid_get_xlevel(Object *obj, Visitor *v, void *opaque,
+                                 const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    int64_t value;
+
+    value = cpu->env.cpuid_xlevel;
+    /* TODO Use visit_type_uint32() once available */
+    visit_type_int(v, &value, name, errp);
+}
+
+static void x86_cpuid_set_xlevel(Object *obj, Visitor *v, void *opaque,
+                                 const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    const int64_t min = 0;
+    const int64_t max = UINT32_MAX;
+    int64_t value;
+
+    /* TODO Use visit_type_uint32() once available */
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
+    cpu->env.cpuid_xlevel = value;
+}
+
 static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
 {
     X86CPU *cpu = X86_CPU(obj);
@@ -1076,7 +1109,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     env->cpuid_ext_features = def->ext_features;
     env->cpuid_ext2_features = def->ext2_features;
     env->cpuid_ext3_features = def->ext3_features;
-    env->cpuid_xlevel = def->xlevel;
+    object_property_set_int(OBJECT(cpu), def->xlevel, "xlevel", &error);
     env->cpuid_kvm_features = def->kvm_features;
     env->cpuid_svm_features = def->svm_features;
     env->cpuid_ext4_features = def->ext4_features;
@@ -1635,6 +1668,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "level", "int",
                         x86_cpuid_get_level,
                         x86_cpuid_set_level, NULL, NULL, NULL);
+    object_property_add(obj, "xlevel", "int",
+                        x86_cpuid_get_xlevel,
+                        x86_cpuid_set_xlevel, NULL, NULL, NULL);
     object_property_add_str(obj, "model-id",
                             x86_cpuid_get_model_id,
                             x86_cpuid_set_model_id, NULL);
commit 8e1898bf948ed03a22fb0dcb5a74ce3323692822
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 18:41:40 2012 +0200

    target-i386: Introduce "level" property for X86CPU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 8b5c47d..5b03c47 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -711,6 +711,39 @@ static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
     env->cpuid_version |= value & 0xf;
 }
 
+static void x86_cpuid_get_level(Object *obj, Visitor *v, void *opaque,
+                                const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    int64_t value;
+
+    value = cpu->env.cpuid_level;
+    /* TODO Use visit_type_uint32() once available */
+    visit_type_int(v, &value, name, errp);
+}
+
+static void x86_cpuid_set_level(Object *obj, Visitor *v, void *opaque,
+                                const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    const int64_t min = 0;
+    const int64_t max = UINT32_MAX;
+    int64_t value;
+
+    /* TODO Use visit_type_uint32() once available */
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
+    cpu->env.cpuid_level = value;
+}
+
 static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
 {
     X86CPU *cpu = X86_CPU(obj);
@@ -1035,7 +1068,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
         env->cpuid_vendor3 = CPUID_VENDOR_INTEL_3;
     }
     env->cpuid_vendor_override = def->vendor_override;
-    env->cpuid_level = def->level;
+    object_property_set_int(OBJECT(cpu), def->level, "level", &error);
     object_property_set_int(OBJECT(cpu), def->family, "family", &error);
     object_property_set_int(OBJECT(cpu), def->model, "model", &error);
     object_property_set_int(OBJECT(cpu), def->stepping, "stepping", &error);
@@ -1599,6 +1632,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "stepping", "int",
                         x86_cpuid_version_get_stepping,
                         x86_cpuid_version_set_stepping, NULL, NULL, NULL);
+    object_property_add(obj, "level", "int",
+                        x86_cpuid_get_level,
+                        x86_cpuid_set_level, NULL, NULL, NULL);
     object_property_add_str(obj, "model-id",
                             x86_cpuid_get_model_id,
                             x86_cpuid_set_model_id, NULL);
commit 63e886ebef04c3c8b40735a1467a11caf3efda4a
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 23:02:26 2012 +0200

    target-i386: Add property getter for CPU model-id
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 2ff5142..8b5c47d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -711,6 +711,21 @@ static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
     env->cpuid_version |= value & 0xf;
 }
 
+static char *x86_cpuid_get_model_id(Object *obj, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    char *value;
+    int i;
+
+    value = g_malloc(48 + 1);
+    for (i = 0; i < 48; i++) {
+        value[i] = env->cpuid_model[i >> 2] >> (8 * (i & 3));
+    }
+    value[48] = '\0';
+    return value;
+}
+
 static void x86_cpuid_set_model_id(Object *obj, const char *model_id,
                                    Error **errp)
 {
@@ -1585,7 +1600,7 @@ static void x86_cpu_initfn(Object *obj)
                         x86_cpuid_version_get_stepping,
                         x86_cpuid_version_set_stepping, NULL, NULL, NULL);
     object_property_add_str(obj, "model-id",
-                            NULL,
+                            x86_cpuid_get_model_id,
                             x86_cpuid_set_model_id, NULL);
 
     env->cpuid_apic_id = env->cpu_index;
commit 35112e415a771507fd94cca3b1a4ba4f99dd18d1
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 14:50:53 2012 +0200

    target-i386: Add property getter for CPU stepping
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 7f63afd..2ff5142 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -675,6 +675,18 @@ static void x86_cpuid_version_set_model(Object *obj, Visitor *v, void *opaque,
     env->cpuid_version |= ((value & 0xf) << 4) | ((value >> 4) << 16);
 }
 
+static void x86_cpuid_version_get_stepping(Object *obj, Visitor *v,
+                                           void *opaque, const char *name,
+                                           Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    int64_t value;
+
+    value = env->cpuid_version & 0xf;
+    visit_type_int(v, &value, name, errp);
+}
+
 static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
                                            void *opaque, const char *name,
                                            Error **errp)
@@ -1570,7 +1582,7 @@ static void x86_cpu_initfn(Object *obj)
                         x86_cpuid_version_get_model,
                         x86_cpuid_version_set_model, NULL, NULL, NULL);
     object_property_add(obj, "stepping", "int",
-                        NULL,
+                        x86_cpuid_version_get_stepping,
                         x86_cpuid_version_set_stepping, NULL, NULL, NULL);
     object_property_add_str(obj, "model-id",
                             NULL,
commit 67e30c83497df23bb821d40648aec774910c3ecf
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 14:48:14 2012 +0200

    target-i386: Add property getter for CPU model
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 90c1373..7f63afd 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -640,6 +640,18 @@ static void x86_cpuid_version_set_family(Object *obj, Visitor *v, void *opaque,
     }
 }
 
+static void x86_cpuid_version_get_model(Object *obj, Visitor *v, void *opaque,
+                                        const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    int64_t value;
+
+    value = (env->cpuid_version >> 4) & 0xf;
+    value |= ((env->cpuid_version >> 16) & 0xf) << 4;
+    visit_type_int(v, &value, name, errp);
+}
+
 static void x86_cpuid_version_set_model(Object *obj, Visitor *v, void *opaque,
                                         const char *name, Error **errp)
 {
@@ -1555,7 +1567,7 @@ static void x86_cpu_initfn(Object *obj)
                         x86_cpuid_version_get_family,
                         x86_cpuid_version_set_family, NULL, NULL, NULL);
     object_property_add(obj, "model", "int",
-                        NULL,
+                        x86_cpuid_version_get_model,
                         x86_cpuid_version_set_model, NULL, NULL, NULL);
     object_property_add(obj, "stepping", "int",
                         NULL,
commit 95b8519d163e4154f468288103d62937bce7598d
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 14:42:22 2012 +0200

    target-i386: Add property getter for CPU family
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index bb57345..90c1373 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -599,6 +599,20 @@ static int check_features_against_host(x86_def_t *guest_def)
     return rv;
 }
 
+static void x86_cpuid_version_get_family(Object *obj, Visitor *v, void *opaque,
+                                         const char *name, Error **errp)
+{
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    int64_t value;
+
+    value = (env->cpuid_version >> 8) & 0xf;
+    if (value == 0xf) {
+        value += (env->cpuid_version >> 20) & 0xff;
+    }
+    visit_type_int(v, &value, name, errp);
+}
+
 static void x86_cpuid_version_set_family(Object *obj, Visitor *v, void *opaque,
                                          const char *name, Error **errp)
 {
@@ -1538,7 +1552,7 @@ static void x86_cpu_initfn(Object *obj)
     cpu_exec_init(env);
 
     object_property_add(obj, "family", "int",
-                        NULL,
+                        x86_cpuid_version_get_family,
                         x86_cpuid_version_set_family, NULL, NULL, NULL);
     object_property_add(obj, "model", "int",
                         NULL,
commit 938d4c2521149a13fc4dc77e68e31953d2ec5e66
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 15:17:27 2012 +0200

    target-i386: Add "model-id" property to X86CPU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 82194dd..bb57345 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -673,8 +673,11 @@ static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
     env->cpuid_version |= value & 0xf;
 }
 
-static void x86_cpuid_set_model_id(CPUX86State *env, const char *model_id)
+static void x86_cpuid_set_model_id(Object *obj, const char *model_id,
+                                   Error **errp)
 {
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
     int c, len, i;
 
     if (model_id == NULL) {
@@ -1004,7 +1007,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
         env->cpuid_ext3_features &= TCG_EXT3_FEATURES;
         env->cpuid_svm_features &= TCG_SVM_FEATURES;
     }
-    x86_cpuid_set_model_id(env, def->model_id);
+    object_property_set_str(OBJECT(cpu), def->model_id, "model-id", &error);
     if (error_is_set(&error)) {
         error_free(error);
         return -1;
@@ -1543,6 +1546,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "stepping", "int",
                         NULL,
                         x86_cpuid_version_set_stepping, NULL, NULL, NULL);
+    object_property_add_str(obj, "model-id",
+                            NULL,
+                            x86_cpuid_set_model_id, NULL);
 
     env->cpuid_apic_id = env->cpu_index;
     mce_init(cpu);
commit 036e2222ca70f80515c6b780a30068cd0be8b7b4
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 14:14:18 2012 +0200

    target-i386: Add "stepping" property to X86CPU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index ebee991..82194dd 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -649,10 +649,28 @@ static void x86_cpuid_version_set_model(Object *obj, Visitor *v, void *opaque,
     env->cpuid_version |= ((value & 0xf) << 4) | ((value >> 4) << 16);
 }
 
-static void x86_cpuid_version_set_stepping(CPUX86State *env, int stepping)
+static void x86_cpuid_version_set_stepping(Object *obj, Visitor *v,
+                                           void *opaque, const char *name,
+                                           Error **errp)
 {
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    const int64_t min = 0;
+    const int64_t max = 0xf;
+    int64_t value;
+
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
     env->cpuid_version &= ~0xf;
-    env->cpuid_version |= stepping & 0xf;
+    env->cpuid_version |= value & 0xf;
 }
 
 static void x86_cpuid_set_model_id(CPUX86State *env, const char *model_id)
@@ -964,7 +982,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     env->cpuid_level = def->level;
     object_property_set_int(OBJECT(cpu), def->family, "family", &error);
     object_property_set_int(OBJECT(cpu), def->model, "model", &error);
-    x86_cpuid_version_set_stepping(env, def->stepping);
+    object_property_set_int(OBJECT(cpu), def->stepping, "stepping", &error);
     env->cpuid_features = def->features;
     env->cpuid_ext_features = def->ext_features;
     env->cpuid_ext2_features = def->ext2_features;
@@ -1522,6 +1540,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "model", "int",
                         NULL,
                         x86_cpuid_version_set_model, NULL, NULL, NULL);
+    object_property_add(obj, "stepping", "int",
+                        NULL,
+                        x86_cpuid_version_set_stepping, NULL, NULL, NULL);
 
     env->cpuid_apic_id = env->cpu_index;
     mce_init(cpu);
commit c5291a4f2d87310c5650064ab870251600b68c14
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 12:16:39 2012 +0200

    target-i386: Add "model" property to X86CPU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 9eb5738..ebee991 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -626,10 +626,27 @@ static void x86_cpuid_version_set_family(Object *obj, Visitor *v, void *opaque,
     }
 }
 
-static void x86_cpuid_version_set_model(CPUX86State *env, int model)
+static void x86_cpuid_version_set_model(Object *obj, Visitor *v, void *opaque,
+                                        const char *name, Error **errp)
 {
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    const int64_t min = 0;
+    const int64_t max = 0xff;
+    int64_t value;
+
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
     env->cpuid_version &= ~0xf00f0;
-    env->cpuid_version |= ((model & 0xf) << 4) | ((model >> 4) << 16);
+    env->cpuid_version |= ((value & 0xf) << 4) | ((value >> 4) << 16);
 }
 
 static void x86_cpuid_version_set_stepping(CPUX86State *env, int stepping)
@@ -946,7 +963,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     env->cpuid_vendor_override = def->vendor_override;
     env->cpuid_level = def->level;
     object_property_set_int(OBJECT(cpu), def->family, "family", &error);
-    x86_cpuid_version_set_model(env, def->model);
+    object_property_set_int(OBJECT(cpu), def->model, "model", &error);
     x86_cpuid_version_set_stepping(env, def->stepping);
     env->cpuid_features = def->features;
     env->cpuid_ext_features = def->ext_features;
@@ -1502,6 +1519,9 @@ static void x86_cpu_initfn(Object *obj)
     object_property_add(obj, "family", "int",
                         NULL,
                         x86_cpuid_version_set_family, NULL, NULL, NULL);
+    object_property_add(obj, "model", "int",
+                        NULL,
+                        x86_cpuid_version_set_model, NULL, NULL, NULL);
 
     env->cpuid_apic_id = env->cpu_index;
     mce_init(cpu);
commit 71ad61d37e612119cca6967484f5feb165a169a4
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 12:10:29 2012 +0200

    target-i386: Add "family" property to X86CPU
    
    Add the property early in the initfn so that it can be used in helpers
    such as mce_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    [AF: Add an error_free(), spotted by Michael Roth]
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 5cebb3d..9eb5738 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -27,6 +27,8 @@
 #include "qemu-option.h"
 #include "qemu-config.h"
 
+#include "qapi/qapi-visit-core.h"
+
 #include "hyperv.h"
 
 /* feature flags taken from "Intel Processor Identification and the CPUID
@@ -597,13 +599,30 @@ static int check_features_against_host(x86_def_t *guest_def)
     return rv;
 }
 
-static void x86_cpuid_version_set_family(CPUX86State *env, int family)
+static void x86_cpuid_version_set_family(Object *obj, Visitor *v, void *opaque,
+                                         const char *name, Error **errp)
 {
+    X86CPU *cpu = X86_CPU(obj);
+    CPUX86State *env = &cpu->env;
+    const int64_t min = 0;
+    const int64_t max = 0xff + 0xf;
+    int64_t value;
+
+    visit_type_int(v, &value, name, errp);
+    if (error_is_set(errp)) {
+        return;
+    }
+    if (value < min || value > max) {
+        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE, "",
+                  name ? name : "null", value, min, max);
+        return;
+    }
+
     env->cpuid_version &= ~0xff00f00;
-    if (family > 0x0f) {
-        env->cpuid_version |= 0xf00 | ((family - 0x0f) << 20);
+    if (value > 0x0f) {
+        env->cpuid_version |= 0xf00 | ((value - 0x0f) << 20);
     } else {
-        env->cpuid_version |= family << 8;
+        env->cpuid_version |= value << 8;
     }
 }
 
@@ -909,6 +928,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
 {
     CPUX86State *env = &cpu->env;
     x86_def_t def1, *def = &def1;
+    Error *error = NULL;
 
     memset(def, 0, sizeof(*def));
 
@@ -925,7 +945,7 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     }
     env->cpuid_vendor_override = def->vendor_override;
     env->cpuid_level = def->level;
-    x86_cpuid_version_set_family(env, def->family);
+    object_property_set_int(OBJECT(cpu), def->family, "family", &error);
     x86_cpuid_version_set_model(env, def->model);
     x86_cpuid_version_set_stepping(env, def->stepping);
     env->cpuid_features = def->features;
@@ -950,6 +970,10 @@ int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
         env->cpuid_svm_features &= TCG_SVM_FEATURES;
     }
     x86_cpuid_set_model_id(env, def->model_id);
+    if (error_is_set(&error)) {
+        error_free(error);
+        return -1;
+    }
     return 0;
 }
 
@@ -1474,6 +1498,11 @@ static void x86_cpu_initfn(Object *obj)
     CPUX86State *env = &cpu->env;
 
     cpu_exec_init(env);
+
+    object_property_add(obj, "family", "int",
+                        NULL,
+                        x86_cpuid_version_set_family, NULL, NULL, NULL);
+
     env->cpuid_apic_id = env->cpu_index;
     mce_init(cpu);
 }
commit a88a677f54e855c0453f06e0347904e4144e1c2b
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 16:15:15 2012 +0200

    target-i386: Add range check for -cpu ,family=x
    
    A family field value of 0xf and extended family field value of 0xff is
    the maximum representable unsigned family number.
    All other CPUID property values are bounds-checked, so add a check here
    for symmetry before we adopt it in a property setter.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 3dc0f80..5cebb3d 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -691,7 +691,7 @@ static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model)
             if (!strcmp(featurestr, "family")) {
                 char *err;
                 numvalue = strtoul(val, &err, 0);
-                if (!*val || *err) {
+                if (!*val || *err || numvalue > 0xff + 0xf) {
                     fprintf(stderr, "bad numerical value %s\n", val);
                     goto error;
                 }
commit 61dcd775785b07a5e0c3858b67aa356b87543710
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 12:00:51 2012 +0200

    target-i386: Pass X86CPU to cpu_x86_register()
    
    Avoids an x86_env_get_cpu() call there, to work with QOM properties.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index e1517e6..3dc0f80 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -905,8 +905,9 @@ void x86_cpu_list(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
     }
 }
 
-int cpu_x86_register (CPUX86State *env, const char *cpu_model)
+int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
 {
+    CPUX86State *env = &cpu->env;
     x86_def_t def1, *def = &def1;
 
     memset(def, 0, sizeof(*def));
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 4bb4592..b5b9a50 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -901,7 +901,7 @@ int cpu_x86_signal_handler(int host_signum, void *pinfo,
 void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                    uint32_t *eax, uint32_t *ebx,
                    uint32_t *ecx, uint32_t *edx);
-int cpu_x86_register (CPUX86State *env, const char *cpu_model);
+int cpu_x86_register(X86CPU *cpu, const char *cpu_model);
 void cpu_clear_apic_feature(CPUX86State *env);
 void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 87954f0..0b22582 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1176,7 +1176,7 @@ CPUX86State *cpu_x86_init(const char *cpu_model)
             cpu_set_debug_excp_handler(breakpoint_handler);
 #endif
     }
-    if (cpu_x86_register(env, cpu_model) < 0) {
+    if (cpu_x86_register(cpu, cpu_model) < 0) {
         object_delete(OBJECT(cpu));
         return NULL;
     }
commit d0a6acf456a2497ce9f70f8366a5b405745ba279
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Apr 17 18:21:52 2012 +0200

    target-i386: Fix x86_cpuid_set_model_id()
    
    Don't assume zeroed cpuid_model[] fields.
    
    This didn't break anything yet but QOM properties should be able to set
    the value to something else without setting an intermediate zero string.
    
    Reviewed-by: Eduardo Habhost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    [AF: Use memset() instead of for loop, suggested by Igor]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 3df53ca..e1517e6 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -627,6 +627,7 @@ static void x86_cpuid_set_model_id(CPUX86State *env, const char *model_id)
         model_id = "";
     }
     len = strlen(model_id);
+    memset(env->cpuid_model, 0, 48);
     for (i = 0; i < 48; i++) {
         if (i >= len) {
             c = '\0';
commit f1219091edd20e3b92544025c2b6dd5e4d98b61b
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:02:34 2012 +0800

    e1000: set E1000_ICR_INT_ASSERTED only for 8257x
    
    E1000_ICR_INT_ASSERTED were introduced only for 8257x, so we need to
    check the E1000_DEVID before setting this bit in ICS.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index b5c26e0..4573f13 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -223,8 +223,10 @@ static const uint32_t mac_reg_init[] = {
 static void
 set_interrupt_cause(E1000State *s, int index, uint32_t val)
 {
-    if (val)
+    if (val && (E1000_DEVID >= E1000_DEV_ID_82547EI_MOBILE)) {
+        /* Only for 8257x */
         val |= E1000_ICR_INT_ASSERTED;
+    }
     s->mac_reg[ICR] = val;
     s->mac_reg[ICS] = val;
     qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
commit b9d03e352cb6b31a66545763f6a1e20c9abf0c2c
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:02:24 2012 +0800

    e1000: link auto-negotiation emulation
    
    Indeed, there's nothing else except for the time spent on the
    negotiation needs to be emulated. This is needed for resuming windows
    guest from hibernation, as without a proper delay, qemu would send the
    packet too early ( guest even does not have a proper intr handler),
    which could lead windows guest hang.
    
    This patch first introduces an array of function pointers to make it
    possible to emulate per-register write behavior. Then traps the
    PHY_CTRL register write and when guest want to restart the link auto
    negotiation, we would down the link and mark the auto negotiation in
    progress in PHY_STATUS register. After time, a timer with 500 ms (
    which is the minimum timeout of auto-negotation specified in 802.3
    spec). The link would be up when timer expired.
    
    Test with resuming windows guest plus flood ping and linux ethtool
    linkstatus test.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index 5f0c2f6..b5c26e0 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -125,6 +125,8 @@ typedef struct E1000State_st {
         uint16_t reading;
         uint32_t old_eecd;
     } eecd_state;
+
+    QEMUTimer *autoneg_timer;
 } E1000State;
 
 #define	defreg(x)	x = (E1000_##x>>2)
@@ -156,6 +158,34 @@ e1000_link_up(E1000State *s)
     s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;
 }
 
+static void
+set_phy_ctrl(E1000State *s, int index, uint16_t val)
+{
+    if ((val & MII_CR_AUTO_NEG_EN) && (val & MII_CR_RESTART_AUTO_NEG)) {
+        s->nic->nc.link_down = true;
+        e1000_link_down(s);
+        s->phy_reg[PHY_STATUS] &= ~MII_SR_AUTONEG_COMPLETE;
+        DBGOUT(PHY, "Start link auto negotiation\n");
+        qemu_mod_timer(s->autoneg_timer, qemu_get_clock_ms(vm_clock) + 500);
+    }
+}
+
+static void
+e1000_autoneg_timer(void *opaque)
+{
+    E1000State *s = opaque;
+    s->nic->nc.link_down = false;
+    e1000_link_up(s);
+    s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;
+    DBGOUT(PHY, "Auto negotiation is completed\n");
+}
+
+static void (*phyreg_writeops[])(E1000State *, int, uint16_t) = {
+    [PHY_CTRL] = set_phy_ctrl,
+};
+
+enum { NPHYWRITEOPS = ARRAY_SIZE(phyreg_writeops) };
+
 enum { PHY_R = 1, PHY_W = 2, PHY_RW = PHY_R | PHY_W };
 static const char phy_regcap[0x20] = {
     [PHY_STATUS] = PHY_R,	[M88E1000_EXT_PHY_SPEC_CTRL] = PHY_RW,
@@ -167,7 +197,8 @@ static const char phy_regcap[0x20] = {
 };
 
 static const uint16_t phy_reg_init[] = {
-    [PHY_CTRL] = 0x1140,			[PHY_STATUS] = 0x796d, // link initially up
+    [PHY_CTRL] = 0x1140,
+    [PHY_STATUS] = 0x794d, /* link initially up with not completed autoneg */
     [PHY_ID1] = 0x141,				[PHY_ID2] = PHY_ID2_INIT,
     [PHY_1000T_CTRL] = 0x0e00,			[M88E1000_PHY_SPEC_CTRL] = 0x360,
     [M88E1000_EXT_PHY_SPEC_CTRL] = 0x0d60,	[PHY_AUTONEG_ADV] = 0xde1,
@@ -234,6 +265,7 @@ static void e1000_reset(void *opaque)
 {
     E1000State *d = opaque;
 
+    qemu_del_timer(d->autoneg_timer);
     memset(d->phy_reg, 0, sizeof d->phy_reg);
     memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
     memset(d->mac_reg, 0, sizeof d->mac_reg);
@@ -283,8 +315,12 @@ set_mdic(E1000State *s, int index, uint32_t val)
         if (!(phy_regcap[addr] & PHY_W)) {
             DBGOUT(MDIC, "MDIC write reg %x unhandled\n", addr);
             val |= E1000_MDIC_ERROR;
-        } else
+        } else {
+            if (addr < NPHYWRITEOPS && phyreg_writeops[addr]) {
+                phyreg_writeops[addr](s, index, data);
+            }
             s->phy_reg[addr] = data;
+        }
     }
     s->mac_reg[MDIC] = val | E1000_MDIC_READY;
 
@@ -965,6 +1001,7 @@ static void (*macreg_writeops[])(E1000State *, int, uint32_t) = {
     [MTA ... MTA+127] = &mac_writereg,
     [VFTA ... VFTA+127] = &mac_writereg,
 };
+
 enum { NWRITEOPS = ARRAY_SIZE(macreg_writeops) };
 
 static void
@@ -1158,6 +1195,8 @@ pci_e1000_uninit(PCIDevice *dev)
 {
     E1000State *d = DO_UPCAST(E1000State, dev, dev);
 
+    qemu_del_timer(d->autoneg_timer);
+    qemu_free_timer(d->autoneg_timer);
     memory_region_destroy(&d->mmio);
     memory_region_destroy(&d->io);
     qemu_del_vlan_client(&d->nic->nc);
@@ -1212,6 +1251,8 @@ static int pci_e1000_init(PCIDevice *pci_dev)
 
     add_boot_device_path(d->conf.bootindex, &pci_dev->qdev, "/ethernet-phy at 0");
 
+    d->autoneg_timer = qemu_new_timer_ms(vm_clock, e1000_autoneg_timer, d);
+
     return 0;
 }
 
commit f9c1cdf4928e6c036a6373e683d1774129a10311
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:02:16 2012 +0800

    e1000: introduce bit for debugging PHY emulation
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index 6abec60..5f0c2f6 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -42,7 +42,7 @@ enum {
     DEBUG_GENERAL,	DEBUG_IO,	DEBUG_MMIO,	DEBUG_INTERRUPT,
     DEBUG_RX,		DEBUG_TX,	DEBUG_MDIC,	DEBUG_EEPROM,
     DEBUG_UNKNOWN,	DEBUG_TXSUM,	DEBUG_TXERR,	DEBUG_RXERR,
-    DEBUG_RXFILTER,	DEBUG_NOTYET,
+    DEBUG_RXFILTER,     DEBUG_PHY,      DEBUG_NOTYET,
 };
 #define DBGBIT(x)	(1<<DEBUG_##x)
 static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL);
commit 71aadd3cd2b2f8bd3113a08a12d4a06d48b6c39c
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:02:07 2012 +0800

    e1000: introduce helpers to manipulate link status
    
    This patch introduces helpers to change link status bit for phy/mac
    register. This would help to reduce code duplication and would be used
    by following patches.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index 4a09e39..6abec60 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -142,6 +142,20 @@ enum {
     defreg(VET),
 };
 
+static void
+e1000_link_down(E1000State *s)
+{
+    s->mac_reg[STATUS] &= ~E1000_STATUS_LU;
+    s->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
+}
+
+static void
+e1000_link_up(E1000State *s)
+{
+    s->mac_reg[STATUS] |= E1000_STATUS_LU;
+    s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;
+}
+
 enum { PHY_R = 1, PHY_W = 2, PHY_RW = PHY_R | PHY_W };
 static const char phy_regcap[0x20] = {
     [PHY_STATUS] = PHY_R,	[M88E1000_EXT_PHY_SPEC_CTRL] = PHY_RW,
@@ -228,8 +242,7 @@ static void e1000_reset(void *opaque)
     memset(&d->tx, 0, sizeof d->tx);
 
     if (d->nic->nc.link_down) {
-        d->mac_reg[STATUS] &= ~E1000_STATUS_LU;
-        d->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
+        e1000_link_down(d);
     }
 }
 
@@ -675,11 +688,9 @@ e1000_set_link_status(VLANClientState *nc)
     uint32_t old_status = s->mac_reg[STATUS];
 
     if (nc->link_down) {
-        s->mac_reg[STATUS] &= ~E1000_STATUS_LU;
-        s->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
+        e1000_link_down(s);
     } else {
-        s->mac_reg[STATUS] |= E1000_STATUS_LU;
-        s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;
+        e1000_link_up(s);
     }
 
     if (s->mac_reg[STATUS] != old_status)
commit 93e37d769074bebfd04c6704b7a7ae92736876e3
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:01:59 2012 +0800

    e1000: PHY loopback mode support
    
    The missing of loopback mode prevent the running of self diagnosis
    program in guest. This patch adds this support.
    
    After this patch, loopback test of ethtool were passed in guest.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index 4e787bc..4a09e39 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -392,6 +392,16 @@ fcs_len(E1000State *s)
 }
 
 static void
+e1000_send_packet(E1000State *s, const uint8_t *buf, int size)
+{
+    if (s->phy_reg[PHY_CTRL] & MII_CR_LOOPBACK) {
+        s->nic->nc.info->receive(&s->nic->nc, buf, size);
+    } else {
+        qemu_send_packet(&s->nic->nc, buf, size);
+    }
+}
+
+static void
 xmit_seg(E1000State *s)
 {
     uint16_t len, *sp;
@@ -440,9 +450,9 @@ xmit_seg(E1000State *s)
         memmove(tp->vlan, tp->data, 4);
         memmove(tp->data, tp->data + 4, 8);
         memcpy(tp->data + 8, tp->vlan_header, 4);
-        qemu_send_packet(&s->nic->nc, tp->vlan, tp->size + 4);
+        e1000_send_packet(s, tp->vlan, tp->size + 4);
     } else
-        qemu_send_packet(&s->nic->nc, tp->data, tp->size);
+        e1000_send_packet(s, tp->data, tp->size);
     s->mac_reg[TPT]++;
     s->mac_reg[GPTC]++;
     n = s->mac_reg[TOTL];
commit 17fbbb0b3d0b09f07d288991248c81f441bf6941
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:01:50 2012 +0800

    e1000: conditionally raise irq at the end of MDI cycle
    
    According to the spec:
    
    "When set to 1b by software, it causes an Interrupt to be
    asserted to indicate the end of an MDI cycle."
    
    We need check the Interrupt Enable bit and raise irq only when it is
    set.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index dd06768..4e787bc 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -274,7 +274,10 @@ set_mdic(E1000State *s, int index, uint32_t val)
             s->phy_reg[addr] = data;
     }
     s->mac_reg[MDIC] = val | E1000_MDIC_READY;
-    set_ics(s, 0, E1000_ICR_MDAC);
+
+    if (val & E1000_MDIC_INT_EN) {
+        set_ics(s, 0, E1000_ICR_MDAC);
+    }
 }
 
 static uint32_t
commit 2e54cc21ad60219229df569a857a453285795565
Author: Jason Wang <jasowang at redhat.com>
Date:   Thu Mar 22 18:01:42 2012 +0800

    e1000: introduce bits of PHY control register
    
    This would be used be following patches.
    
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000_hw.h b/hw/e1000_hw.h
index 9e29af8..c9cb79e 100644
--- a/hw/e1000_hw.h
+++ b/hw/e1000_hw.h
@@ -349,6 +349,18 @@
 #define M88E1000_PHY_VCO_REG_BIT8  0x100 /* Bits 8 & 11 are adjusted for */
 #define M88E1000_PHY_VCO_REG_BIT11 0x800    /* improved BER performance */
 
+/* PHY Control Register */
+#define MII_CR_SPEED_SELECT_MSB 0x0040 /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_COLL_TEST_ENABLE 0x0080 /* Collision test enable */
+#define MII_CR_FULL_DUPLEX      0x0100 /* FDX =1, half duplex =0 */
+#define MII_CR_RESTART_AUTO_NEG 0x0200 /* Restart auto negotiation */
+#define MII_CR_ISOLATE          0x0400 /* Isolate PHY from MII */
+#define MII_CR_POWER_DOWN       0x0800 /* Power down */
+#define MII_CR_AUTO_NEG_EN      0x1000 /* Auto Neg Enable */
+#define MII_CR_SPEED_SELECT_LSB 0x2000 /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_LOOPBACK         0x4000 /* 0 = normal, 1 = loopback */
+#define MII_CR_RESET            0x8000 /* 0 = normal, 1 = PHY reset */
+
 /* PHY Status Register */
 #define MII_SR_EXTENDED_CAPS     0x0001	/* Extended register capabilities */
 #define MII_SR_JABBER_DETECT     0x0002	/* Jabber Detected */
commit 69f3ce78cc0b6941fc76dcbe2118269a16ddf043
Author: Stefan Weil <sw at weilnetz.de>
Date:   Tue Apr 10 20:48:54 2012 +0200

    eepro100: Fix multicast regression
    
    Commit 7fc8d918b9674c3e9233d6d25da2457345d414a0 removed code from
    eepro100.c and replaced it by different code: the code in net.c
    returns bits 31...26, but eepro100 needs bits 7...2.
    
    This patch partially reverts 7fc8d918b9674c3e9233d6d25da2457345d414a0.
    To avoid future problems, I renamed the function and changed the comment.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/eepro100.c b/hw/eepro100.c
index 02e6f7e..6279ae3 100644
--- a/hw/eepro100.c
+++ b/hw/eepro100.c
@@ -322,8 +322,32 @@ static const uint16_t eepro100_mdi_mask[] = {
     0xffff, 0xffff, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 };
 
+#define POLYNOMIAL 0x04c11db6
+
 static E100PCIDeviceInfo *eepro100_get_class(EEPRO100State *s);
 
+/* From FreeBSD (locally modified). */
+static unsigned e100_compute_mcast_idx(const uint8_t *ep)
+{
+    uint32_t crc;
+    int carry, i, j;
+    uint8_t b;
+
+    crc = 0xffffffff;
+    for (i = 0; i < 6; i++) {
+        b = *ep++;
+        for (j = 0; j < 8; j++) {
+            carry = ((crc & 0x80000000L) ? 1 : 0) ^ (b & 0x01);
+            crc <<= 1;
+            b >>= 1;
+            if (carry) {
+                crc = ((crc ^ POLYNOMIAL) | carry);
+            }
+        }
+    }
+    return (crc & BITS(7, 2)) >> 2;
+}
+
 /* Read a 16 bit control/status (CSR) register. */
 static uint16_t e100_read_reg2(EEPRO100State *s, E100RegisterOffset addr)
 {
@@ -823,7 +847,7 @@ static void set_multicast_list(EEPRO100State *s)
         uint8_t multicast_addr[6];
         pci_dma_read(&s->dev, s->cb_address + 10 + i, multicast_addr, 6);
         TRACE(OTHER, logout("multicast entry %s\n", nic_dump(multicast_addr, 6)));
-        unsigned mcast_idx = compute_mcast_idx(multicast_addr);
+        unsigned mcast_idx = e100_compute_mcast_idx(multicast_addr);
         assert(mcast_idx < 64);
         s->mult[mcast_idx >> 3] |= (1 << (mcast_idx & 7));
     }
@@ -1650,7 +1674,7 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
         if (s->configuration[21] & BIT(3)) {
           /* Multicast all bit is set, receive all multicast frames. */
         } else {
-          unsigned mcast_idx = compute_mcast_idx(buf);
+          unsigned mcast_idx = e100_compute_mcast_idx(buf);
           assert(mcast_idx < 64);
           if (s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))) {
             /* Multicast frame is allowed in hash table. */
commit a821ce59338c79bb72dc844dd44ea53701965b2b
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Apr 23 15:46:22 2012 +0300

    virtio: order index/descriptor reads
    
    virtio has the equivalent of:
    
    	if (vq->last_avail_index != vring_avail_idx(vq)) {
    		read descriptor head at vq->last_avail_index;
    	}
    
    In theory, processor can reorder descriptor head
    read to happen speculatively before the index read.
    this would trigger the following race:
    
    	host descriptor head read <- reads invalid head from ring
    		guest writes valid descriptor head
    		guest writes avail index
    	host avail index read <- observes valid index
    
    as a result host will use an invalid head value.
    This was not observed in the field by me but after
    the experience with the previous two races
    I think it is prudent to address this theoretical race condition.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/virtio.c b/hw/virtio.c
index 5615b59..168abe4 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -287,6 +287,11 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx)
                      idx, vring_avail_idx(vq));
         exit(1);
     }
+    /* On success, callers read a descriptor at vq->last_avail_idx.
+     * Make sure descriptor read does not bypass avail index read. */
+    if (num_heads) {
+        smp_rmb();
+    }
 
     return num_heads;
 }
diff --git a/qemu-barrier.h b/qemu-barrier.h
index f0b842e..7e11197 100644
--- a/qemu-barrier.h
+++ b/qemu-barrier.h
@@ -7,12 +7,13 @@
 #if defined(__i386__)
 
 /*
- * Because of the strongly ordered x86 storage model, wmb() is a nop
+ * Because of the strongly ordered x86 storage model, wmb() and rmb() are nops
  * on x86(well, a compiler barrier only).  Well, at least as long as
  * qemu doesn't do accesses to write-combining memory or non-temporal
  * load/stores from C code.
  */
 #define smp_wmb()   barrier()
+#define smp_rmb()   barrier()
 /*
  * We use GCC builtin if it's available, as that can use
  * mfence on 32 bit as well, e.g. if built with -march=pentium-m.
@@ -27,6 +28,7 @@
 #elif defined(__x86_64__)
 
 #define smp_wmb()   barrier()
+#define smp_rmb()   barrier()
 #define smp_mb() asm volatile("mfence" ::: "memory")
 
 #elif defined(_ARCH_PPC)
@@ -37,6 +39,13 @@
  * each other
  */
 #define smp_wmb()   asm volatile("eieio" ::: "memory")
+
+#if defined(__powerpc64__)
+#define smp_rmb()   asm volatile("lwsync" ::: "memory")
+#else
+#define smp_rmb()   asm volatile("sync" ::: "memory")
+#endif
+
 #define smp_mb()   asm volatile("sync" ::: "memory")
 
 #else
@@ -45,10 +54,11 @@
  * For (host) platforms we don't have explicit barrier definitions
  * for, we use the gcc __sync_synchronize() primitive to generate a
  * full barrier.  This should be safe on all platforms, though it may
- * be overkill for wmb().
+ * be overkill for wmb() and rmb().
  */
 #define smp_wmb()   __sync_synchronize()
 #define smp_mb()   __sync_synchronize()
+#define smp_rmb()   __sync_synchronize()
 
 #endif
 
commit 92045d80badc43c9f95897aad675dc7ef17a3b3f
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Apr 23 14:11:14 2012 +0300

    virtio: add missing mb() on enable notification
    
    This fixes an issue dual to the one fixed by
    patch 'virtio: add missing mb() on notification'
    and applies on top.
    
    In this case, to enable vq kick to exit to host,
    qemu writes out used flag then reads the
    avail index. if these are reordered we get a race:
    
        host avail index read: ring is empty
        		guest avail index write
        		guest flag read: exit disabled
        host used flag write: enable exit
    
    which results in a lost exit: host will never be notified about the
    avail index update.  Again, happens in the field but only seems to
    trigger on some specific hardware.
    
    Insert an smp_mb barrier operation to ensure the correct ordering.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/virtio.c b/hw/virtio.c
index bb994c9..5615b59 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -209,6 +209,10 @@ void virtio_queue_set_notification(VirtQueue *vq, int enable)
     } else {
         vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY);
     }
+    if (enable) {
+        /* Expose avail event/used flags before caller checks the avail idx. */
+        smp_mb();
+    }
 }
 
 int virtio_queue_ready(VirtQueue *vq)
commit a281ebc11a6917fbc27e1a93bb5772cd14e241fc
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Apr 22 16:45:53 2012 +0300

    virtio: add missing mb() on notification
    
    During normal operation, virtio first writes a used index
    and then checks whether it should interrupt the guest
    by reading guest avail index/flag values.
    
    Guest does the reverse: writes the index/flag,
    then checks the used ring.
    
    The ordering is important: if host avail flag read bypasses the used
    index write, we could in effect get this timing:
    
    host avail flag read
    		guest enable interrupts: avail flag write
    		guest check used ring: ring is empty
    host used index write
    
    which results in a lost interrupt: guest will never be notified
    about the used ring update.
    
    This actually can happen when using kvm with an io thread,
    such that the guest vcpu and qemu run on different host cpus,
    and this has actually been observed in the field
    (but only seems to trigger on very specific processor types)
    with userspace virtio: vhost has the necessary smp_mb()
    in place to prevent the regordering, so the same workload stalls
    forever waiting for an interrupt with vhost=off but works
    fine with vhost=on.
    
    Insert an smp_mb barrier operation in userspace virtio to
    ensure the correct ordering.
    Applying this patch fixed the race condition we have observed.
    Tested on x86_64. I checked the code generated by the new macro
    for i386 and ppc but didn't run virtio.
    
    Note: mb could in theory be implemented by __sync_synchronize, but this
    would make us hit old GCC bugs. Besides old GCC
    not implementing __sync_synchronize at all, there were bugs
    http://gcc.gnu.org/bugzilla/show_bug.cgi?id=36793
    in this functionality as recently as in 4.3.
    
    As we need asm for rmb,wmb anyway, it's just as well to
    use it for mb.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/virtio.c b/hw/virtio.c
index 314abf8..bb994c9 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -700,6 +700,8 @@ static bool vring_notify(VirtIODevice *vdev, VirtQueue *vq)
 {
     uint16_t old, new;
     bool v;
+    /* We need to expose used array entries before checking used event. */
+    smp_mb();
     /* Always notify when queue is empty (when feature acknowledge) */
     if (((vdev->guest_features & (1 << VIRTIO_F_NOTIFY_ON_EMPTY)) &&
          !vq->inuse && vring_avail_idx(vq) == vq->last_avail_idx)) {
diff --git a/qemu-barrier.h b/qemu-barrier.h
index c11bb2b..f0b842e 100644
--- a/qemu-barrier.h
+++ b/qemu-barrier.h
@@ -4,7 +4,7 @@
 /* Compiler barrier */
 #define barrier()   asm volatile("" ::: "memory")
 
-#if defined(__i386__) || defined(__x86_64__)
+#if defined(__i386__)
 
 /*
  * Because of the strongly ordered x86 storage model, wmb() is a nop
@@ -13,15 +13,31 @@
  * load/stores from C code.
  */
 #define smp_wmb()   barrier()
+/*
+ * We use GCC builtin if it's available, as that can use
+ * mfence on 32 bit as well, e.g. if built with -march=pentium-m.
+ * However, on i386, there seem to be known bugs as recently as 4.3.
+ * */
+#if defined(__GNUC__) && __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
+#define smp_mb() __sync_synchronize()
+#else
+#define smp_mb() asm volatile("lock; addl $0,0(%%esp) " ::: "memory")
+#endif
+
+#elif defined(__x86_64__)
+
+#define smp_wmb()   barrier()
+#define smp_mb() asm volatile("mfence" ::: "memory")
 
 #elif defined(_ARCH_PPC)
 
 /*
- * We use an eieio() for a wmb() on powerpc.  This assumes we don't
+ * We use an eieio() for wmb() on powerpc.  This assumes we don't
  * need to order cacheable and non-cacheable stores with respect to
  * each other
  */
 #define smp_wmb()   asm volatile("eieio" ::: "memory")
+#define smp_mb()   asm volatile("sync" ::: "memory")
 
 #else
 
@@ -29,9 +45,10 @@
  * For (host) platforms we don't have explicit barrier definitions
  * for, we use the gcc __sync_synchronize() primitive to generate a
  * full barrier.  This should be safe on all platforms, though it may
- * be overkill.
+ * be overkill for wmb().
  */
 #define smp_wmb()   __sync_synchronize()
+#define smp_mb()   __sync_synchronize()
 
 #endif
 
commit 814cd3ac37be8e71c8ef76234d0da0bbfb2f2fb2
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Feb 12 15:11:53 2012 +0200

    e1000: move reset function earlier in file
    
    Make it easier to reuse this function.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/e1000.c b/hw/e1000.c
index 9c76462..dd06768 100644
--- a/hw/e1000.c
+++ b/hw/e1000.c
@@ -152,6 +152,29 @@ static const char phy_regcap[0x20] = {
     [PHY_ID2] = PHY_R,		[M88E1000_PHY_SPEC_STATUS] = PHY_R
 };
 
+static const uint16_t phy_reg_init[] = {
+    [PHY_CTRL] = 0x1140,			[PHY_STATUS] = 0x796d, // link initially up
+    [PHY_ID1] = 0x141,				[PHY_ID2] = PHY_ID2_INIT,
+    [PHY_1000T_CTRL] = 0x0e00,			[M88E1000_PHY_SPEC_CTRL] = 0x360,
+    [M88E1000_EXT_PHY_SPEC_CTRL] = 0x0d60,	[PHY_AUTONEG_ADV] = 0xde1,
+    [PHY_LP_ABILITY] = 0x1e0,			[PHY_1000T_STATUS] = 0x3c00,
+    [M88E1000_PHY_SPEC_STATUS] = 0xac00,
+};
+
+static const uint32_t mac_reg_init[] = {
+    [PBA] =     0x00100030,
+    [LEDCTL] =  0x602,
+    [CTRL] =    E1000_CTRL_SWDPIN2 | E1000_CTRL_SWDPIN0 |
+                E1000_CTRL_SPD_1000 | E1000_CTRL_SLU,
+    [STATUS] =  0x80000000 | E1000_STATUS_GIO_MASTER_ENABLE |
+                E1000_STATUS_ASDV | E1000_STATUS_MTXCKOK |
+                E1000_STATUS_SPEED_1000 | E1000_STATUS_FD |
+                E1000_STATUS_LU,
+    [MANC] =    E1000_MANC_EN_MNG2HOST | E1000_MANC_RCV_TCO_EN |
+                E1000_MANC_ARP_EN | E1000_MANC_0298_EN |
+                E1000_MANC_RMCP_EN,
+};
+
 static void
 set_interrupt_cause(E1000State *s, int index, uint32_t val)
 {
@@ -193,6 +216,23 @@ rxbufsize(uint32_t v)
     return 2048;
 }
 
+static void e1000_reset(void *opaque)
+{
+    E1000State *d = opaque;
+
+    memset(d->phy_reg, 0, sizeof d->phy_reg);
+    memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
+    memset(d->mac_reg, 0, sizeof d->mac_reg);
+    memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
+    d->rxbuf_min_shift = 1;
+    memset(&d->tx, 0, sizeof d->tx);
+
+    if (d->nic->nc.link_down) {
+        d->mac_reg[STATUS] &= ~E1000_STATUS_LU;
+        d->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
+    }
+}
+
 static void
 set_ctrl(E1000State *s, int index, uint32_t val)
 {
@@ -1061,29 +1101,6 @@ static const uint16_t e1000_eeprom_template[64] = {
     0xffff, 0xffff, 0xffff, 0xffff,      0xffff, 0xffff,      0xffff, 0x0000,
 };
 
-static const uint16_t phy_reg_init[] = {
-    [PHY_CTRL] = 0x1140,			[PHY_STATUS] = 0x796d, // link initially up
-    [PHY_ID1] = 0x141,				[PHY_ID2] = PHY_ID2_INIT,
-    [PHY_1000T_CTRL] = 0x0e00,			[M88E1000_PHY_SPEC_CTRL] = 0x360,
-    [M88E1000_EXT_PHY_SPEC_CTRL] = 0x0d60,	[PHY_AUTONEG_ADV] = 0xde1,
-    [PHY_LP_ABILITY] = 0x1e0,			[PHY_1000T_STATUS] = 0x3c00,
-    [M88E1000_PHY_SPEC_STATUS] = 0xac00,
-};
-
-static const uint32_t mac_reg_init[] = {
-    [PBA] =     0x00100030,
-    [LEDCTL] =  0x602,
-    [CTRL] =    E1000_CTRL_SWDPIN2 | E1000_CTRL_SWDPIN0 |
-                E1000_CTRL_SPD_1000 | E1000_CTRL_SLU,
-    [STATUS] =  0x80000000 | E1000_STATUS_GIO_MASTER_ENABLE |
-                E1000_STATUS_ASDV | E1000_STATUS_MTXCKOK |
-                E1000_STATUS_SPEED_1000 | E1000_STATUS_FD |
-                E1000_STATUS_LU,
-    [MANC] =    E1000_MANC_EN_MNG2HOST | E1000_MANC_RCV_TCO_EN |
-                E1000_MANC_ARP_EN | E1000_MANC_0298_EN |
-                E1000_MANC_RMCP_EN,
-};
-
 /* PCI interface */
 
 static void
@@ -1123,23 +1140,6 @@ pci_e1000_uninit(PCIDevice *dev)
     return 0;
 }
 
-static void e1000_reset(void *opaque)
-{
-    E1000State *d = opaque;
-
-    memset(d->phy_reg, 0, sizeof d->phy_reg);
-    memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
-    memset(d->mac_reg, 0, sizeof d->mac_reg);
-    memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
-    d->rxbuf_min_shift = 1;
-    memset(&d->tx, 0, sizeof d->tx);
-
-    if (d->nic->nc.link_down) {
-        d->mac_reg[STATUS] &= ~E1000_STATUS_LU;
-        d->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
-    }
-}
-
 static NetClientInfo net_e1000_info = {
     .type = NET_CLIENT_TYPE_NIC,
     .size = sizeof(NICState),


More information about the Spice-commits mailing list