[Spice-commits] 122 commits - Makefile.objs Makefile.target VERSION block-migration.c block/curl.c block/gluster.c block/raw-posix.c bsd-user/main.c configure cpu-exec.c cpus.c cputlb.c dump.c exec.c gdbstub.c hmp.c hw/9pfs hw/an5206.c hw/apic_common.c hw/apic_internal.h hw/cadence_uart.c hw/isa-bus.c hw/kvm hw/kvmvapic.c hw/m25p80.c hw/mcf.h hw/mcf5206.c hw/mcf5208.c hw/mcf_intc.c hw/pc.c hw/pci hw/petalogix_ml605_mmu.c hw/ppc hw/ppc.c hw/ppc.h hw/ppc405_uc.c hw/ppce500_spin.c hw/qdev.c hw/qxl.c hw/s390x hw/spapr_hcall.c hw/vfio_pci.c hw/vhost_net.c hw/xilinx.h include/exec include/migration include/qemu include/qom include/sysemu kvm-all.c linux-user/main.c linux-user/syscall.c memory.c migration.c monitor.c net/net.c pc-bios/README pc-bios/openbios-ppc pc-bios/openbios-sparc32 pc-bios/openbios-sparc64 qapi-schema.json qemu-char.c qemu-log.c qemu-options.hx qom/cpu.c qtest.c roms/openbios savevm.c target-alpha/cpu-qom.h target-alpha/cpu.c target-arm/cpu-qom.h target-arm/cpu.c targ et-arm/cpu.h target-arm/helper.c target-cris/cpu-qom.h target-cris/cpu.c target-cris/cpu.h target-cris/translate.c target-cris/translate_v10.c target-i386/cpu-qom.h target-i386/cpu.c target-i386/cpu.h target-i386/helper.c target-i386/kvm.c target-i386/topology.h target-i386/translate.c target-lm32/cpu-qom.h target-lm32/cpu.c target-lm32/cpu.h target-lm32/helper.c target-m68k/cpu-qom.h target-m68k/cpu.c target-m68k/cpu.h target-m68k/helper.c target-microblaze/cpu-qom.h target-microblaze/cpu.c target-microblaze/cpu.h target-microblaze/translate.c target-mips/cpu-qom.h target-mips/cpu.c target-mips/cpu.h target-mips/translate.c target-openrisc/cpu.c target-openrisc/cpu.h target-ppc/cpu-qom.h target-ppc/translate_init.c target-s390x/cpu-qom.h target-s390x/cpu.c target-s390x/cpu.h target-s390x/helper.c target-s390x/ioinst.h target-sh4/cpu-qom.h target-sh4/cpu.c target-sh4/cpu.h target-sh4/translate.c target-sparc/cpu-qom.h target-sparc/cpu.c target-sparc/ldst_helper.c target-unic ore32/cpu-qom.h target-unicore32/cpu.c target-unicore32/helper.c target-xtensa/cpu-qom.h target-xtensa/cpu.c target-xtensa/cpu.h target-xtensa/helper.c tcg/ppc tcg/tcg.c tcg/tcg.h tcg/tci tests/Makefile tests/libi2c-omap.c tests/libqtest.c tests/libqtest.h tests/m48t59-test.c tests/test-mul64.c tests/test-string-input-visitor.c trace/simple.c translate-all.c translate-all.h ui/console.c ui/input.c ui/vnc-tls.c util/bitops.c util/hbitmap.c util/host-utils.c util/qemu-config.c util/qemu-option.c util/qemu-sockets.c vl.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Feb 19 00:52:32 PST 2013


 Makefile.objs                     |    1 
 Makefile.target                   |    1 
 VERSION                           |    2 
 block-migration.c                 |   23 -
 block/curl.c                      |    4 
 block/gluster.c                   |    2 
 block/raw-posix.c                 |   49 ++
 bsd-user/main.c                   |   12 
 configure                         |   20 +
 cpu-exec.c                        |   39 +
 cpus.c                            |   21 -
 cputlb.c                          |    6 
 dump.c                            |    8 
 exec.c                            |    6 
 gdbstub.c                         |   14 
 hmp.c                             |    2 
 hw/9pfs/virtio-9p-proxy.c         |    2 
 hw/an5206.c                       |   11 
 hw/apic_common.c                  |    2 
 hw/apic_internal.h                |    2 
 hw/cadence_uart.c                 |    1 
 hw/isa-bus.c                      |   12 
 hw/kvm/pci-assign.c               |   12 
 hw/kvmvapic.c                     |   13 
 hw/m25p80.c                       |   15 
 hw/mcf.h                          |    4 
 hw/mcf5206.c                      |    8 
 hw/mcf5208.c                      |   11 
 hw/mcf_intc.c                     |    8 
 hw/pc.c                           |    1 
 hw/pci/pci.c                      |    2 
 hw/petalogix_ml605_mmu.c          |   10 
 hw/ppc.c                          |   14 
 hw/ppc.h                          |    6 
 hw/ppc/e500.c                     |   11 
 hw/ppc405_uc.c                    |   16 
 hw/ppce500_spin.c                 |   15 
 hw/qdev.c                         |    4 
 hw/qxl.c                          |    2 
 hw/s390x/css.c                    |    4 
 hw/s390x/sclpconsole.c            |    5 
 hw/spapr_hcall.c                  |   16 
 hw/vfio_pci.c                     |  114 ++---
 hw/vhost_net.c                    |    4 
 hw/xilinx.h                       |   18 
 include/exec/cpu-defs.h           |    5 
 include/exec/exec-all.h           |   31 +
 include/exec/gdbstub.h            |    5 
 include/migration/qemu-file.h     |    1 
 include/qemu/bitops.h             |   75 ---
 include/qemu/hbitmap.h            |    3 
 include/qemu/host-utils.h         |  136 +++++-
 include/qemu/log.h                |   27 -
 include/qom/cpu.h                 |   11 
 include/sysemu/cpus.h             |    2 
 kvm-all.c                         |    6 
 linux-user/main.c                 |   57 +-
 linux-user/syscall.c              |    4 
 memory.c                          |    4 
 migration.c                       |   10 
 monitor.c                         |   10 
 net/net.c                         |    4 
 pc-bios/README                    |    2 
 pc-bios/openbios-ppc              |binary
 pc-bios/openbios-sparc32          |binary
 pc-bios/openbios-sparc64          |binary
 qapi-schema.json                  |   20 -
 qemu-char.c                       |   84 ++--
 qemu-log.c                        |   25 -
 qemu-options.hx                   |  756 +++++++++++++++++++-------------------
 qom/cpu.c                         |    7 
 qtest.c                           |   89 ++++
 roms/openbios                     |    2 
 savevm.c                          |   43 +-
 target-alpha/cpu-qom.h            |    2 
 target-alpha/cpu.c                |   18 
 target-arm/cpu-qom.h              |    3 
 target-arm/cpu.c                  |   29 +
 target-arm/cpu.h                  |    1 
 target-arm/helper.c               |   18 
 target-cris/cpu-qom.h             |    5 
 target-cris/cpu.c                 |  180 ++++++++-
 target-cris/cpu.h                 |    3 
 target-cris/translate.c           |   60 ---
 target-cris/translate_v10.c       |    5 
 target-i386/cpu-qom.h             |    5 
 target-i386/cpu.c                 |  100 +++--
 target-i386/cpu.h                 |    1 
 target-i386/helper.c              |   24 -
 target-i386/kvm.c                 |    4 
 target-i386/topology.h            |    6 
 target-i386/translate.c           |    2 
 target-lm32/cpu-qom.h             |    2 
 target-lm32/cpu.c                 |   24 +
 target-lm32/cpu.h                 |    1 
 target-lm32/helper.c              |    8 
 target-m68k/cpu-qom.h             |    2 
 target-m68k/cpu.c                 |   24 +
 target-m68k/cpu.h                 |   15 
 target-m68k/helper.c              |   27 -
 target-microblaze/cpu-qom.h       |    2 
 target-microblaze/cpu.c           |   22 +
 target-microblaze/cpu.h           |    1 
 target-microblaze/translate.c     |   16 
 target-mips/cpu-qom.h             |    2 
 target-mips/cpu.c                 |   21 +
 target-mips/cpu.h                 |    1 
 target-mips/translate.c           |    8 
 target-openrisc/cpu.c             |   15 
 target-openrisc/cpu.h             |    4 
 target-ppc/cpu-qom.h              |    2 
 target-ppc/translate_init.c       |   25 -
 target-s390x/cpu-qom.h            |    2 
 target-s390x/cpu.c                |   22 +
 target-s390x/cpu.h                |    3 
 target-s390x/helper.c             |   54 +-
 target-s390x/ioinst.h             |    3 
 target-sh4/cpu-qom.h              |    2 
 target-sh4/cpu.c                  |   20 +
 target-sh4/cpu.h                  |    1 
 target-sh4/translate.c            |    8 
 target-sparc/cpu-qom.h            |    2 
 target-sparc/cpu.c                |   27 +
 target-sparc/ldst_helper.c        |    2 
 target-unicore32/cpu-qom.h        |    3 
 target-unicore32/cpu.c            |   22 +
 target-unicore32/helper.c         |    7 
 target-xtensa/cpu-qom.h           |    2 
 target-xtensa/cpu.c               |   22 +
 target-xtensa/cpu.h               |    1 
 target-xtensa/helper.c            |   16 
 tcg/ppc/tcg-target.h              |    2 
 tcg/tcg.c                         |    2 
 tcg/tcg.h                         |   16 
 tcg/tci/tcg-target.c              |    2 
 tests/Makefile                    |    6 
 tests/libi2c-omap.c               |   53 +-
 tests/libqtest.c                  |   76 +++
 tests/libqtest.h                  |  370 +++++++++++++++---
 tests/m48t59-test.c               |    7 
 tests/test-mul64.c                |   70 +++
 tests/test-string-input-visitor.c |   12 
 trace/simple.c                    |   24 +
 translate-all.c                   |  209 +++++-----
 translate-all.h                   |    2 
 ui/console.c                      |    2 
 ui/input.c                        |    2 
 ui/vnc-tls.c                      |    6 
 util/bitops.c                     |    6 
 util/hbitmap.c                    |    3 
 util/host-utils.c                 |   96 ++--
 util/qemu-config.c                |    6 
 util/qemu-option.c                |    4 
 util/qemu-sockets.c               |    6 
 vl.c                              |   31 +
 155 files changed, 2485 insertions(+), 1407 deletions(-)

New commits:
commit 7d2a929feba319c18603e324b1750830d6c8b7a1
Author: Andre Przywara <andre.przywara at amd.com>
Date:   Thu Oct 18 11:16:58 2012 +0200

    vnc-tls: Fix compilation with newer versions of GNU-TLS
    
    In my installation of GNU-TLS (v3.0.23) the type
    gnutls_anon_server_credentials is marked deprecated, so -Werror
    breaks compilation.
    Simply replacing it with the newer ..._t version fixed the compilation
    on my machine (Slackware 14.0). I cannot tell how far back this "new"
    type goes, at least the header file in RHEL 5.0 (v1.4.1) seems to have
    it already. If someone finds a broken distribution, tell me and I
    insert some compat code.
    
    Signed-off-by: Andre Przywara <andre.przywara at amd.com>
    Message-id: 1350551818-14717-1-git-send-email-andre.przywara at amd.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/ui/vnc-tls.c b/ui/vnc-tls.c
index 5629263..8d4cc8e 100644
--- a/ui/vnc-tls.c
+++ b/ui/vnc-tls.c
@@ -99,9 +99,9 @@ static ssize_t vnc_tls_pull(gnutls_transport_ptr_t transport,
 }
 
 
-static gnutls_anon_server_credentials vnc_tls_initialize_anon_cred(void)
+static gnutls_anon_server_credentials_t vnc_tls_initialize_anon_cred(void)
 {
-    gnutls_anon_server_credentials anon_cred;
+    gnutls_anon_server_credentials_t anon_cred;
     int ret;
 
     if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
@@ -382,7 +382,7 @@ int vnc_tls_client_setup(struct VncState *vs,
             }
 
         } else {
-            gnutls_anon_server_credentials anon_cred = vnc_tls_initialize_anon_cred();
+            gnutls_anon_server_credentials_t anon_cred = vnc_tls_initialize_anon_cred();
             if (!anon_cred) {
                 gnutls_deinit(vs->tls.session);
                 vs->tls.session = NULL;
commit 10adb8be87c315573a5bf9f5bda885f25da28ce6
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:43 2013 +0100

    doc help: Collect block device stuff under its own heading
    
    Collect them from "Standard options", "File system options", "Virtual
    File system pass-through options", "Debug/Expert options".
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-8-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 27c9e61..4bc9c85 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -103,196 +103,6 @@ Simulate a multi node NUMA system. If mem and cpus are omitted, resources
 are split equally.
 ETEXI
 
-DEF("fda", HAS_ARG, QEMU_OPTION_fda,
-    "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
-DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
-STEXI
- at item -fda @var{file}
- at item -fdb @var{file}
- at findex -fda
- at findex -fdb
-Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can
-use the host floppy by using @file{/dev/fd0} as filename (@pxref{host_drives}).
-ETEXI
-
-DEF("hda", HAS_ARG, QEMU_OPTION_hda,
-    "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n", QEMU_ARCH_ALL)
-DEF("hdb", HAS_ARG, QEMU_OPTION_hdb, "", QEMU_ARCH_ALL)
-DEF("hdc", HAS_ARG, QEMU_OPTION_hdc,
-    "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n", QEMU_ARCH_ALL)
-DEF("hdd", HAS_ARG, QEMU_OPTION_hdd, "", QEMU_ARCH_ALL)
-STEXI
- at item -hda @var{file}
- at item -hdb @var{file}
- at item -hdc @var{file}
- at item -hdd @var{file}
- at findex -hda
- at findex -hdb
- at findex -hdc
- at findex -hdd
-Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}).
-ETEXI
-
-DEF("cdrom", HAS_ARG, QEMU_OPTION_cdrom,
-    "-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -cdrom @var{file}
- at findex -cdrom
-Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and
- at option{-cdrom} at the same time). You can use the host CD-ROM by
-using @file{/dev/cdrom} as filename (@pxref{host_drives}).
-ETEXI
-
-DEF("drive", HAS_ARG, QEMU_OPTION_drive,
-    "-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]\n"
-    "       [,cyls=c,heads=h,secs=s[,trans=t]][,snapshot=on|off]\n"
-    "       [,cache=writethrough|writeback|none|directsync|unsafe][,format=f]\n"
-    "       [,serial=s][,addr=A][,id=name][,aio=threads|native]\n"
-    "       [,readonly=on|off][,copy-on-read=on|off]\n"
-    "       [[,bps=b]|[[,bps_rd=r][,bps_wr=w]]][[,iops=i]|[[,iops_rd=r][,iops_wr=w]]\n"
-    "                use 'file' as a drive image\n", QEMU_ARCH_ALL)
-STEXI
- at item -drive @var{option}[, at var{option}[, at var{option}[,...]]]
- at findex -drive
-
-Define a new drive. Valid options are:
-
- at table @option
- at item file=@var{file}
-This option defines which disk image (@pxref{disk_images}) to use with
-this drive. If the filename contains comma, you must double it
-(for instance, "file=my,,file" to use file "my,file").
-
-Special files such as iSCSI devices can be specified using protocol
-specific URLs. See the section for "Device URL Syntax" for more information.
- at item if=@var{interface}
-This option defines on which type on interface the drive is connected.
-Available types are: ide, scsi, sd, mtd, floppy, pflash, virtio.
- at item bus=@var{bus},unit=@var{unit}
-These options define where is connected the drive by defining the bus number and
-the unit id.
- at item index=@var{index}
-This option defines where is connected the drive by using an index in the list
-of available connectors of a given interface type.
- at item media=@var{media}
-This option defines the type of the media: disk or cdrom.
- at item cyls=@var{c},heads=@var{h},secs=@var{s}[,trans=@var{t}]
-These options have the same definition as they have in @option{-hdachs}.
- at item snapshot=@var{snapshot}
- at var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
- at item cache=@var{cache}
- at var{cache} is "none", "writeback", "unsafe", "directsync" or "writethrough" and controls how the host cache is used to access block data.
- at item aio=@var{aio}
- at var{aio} is "threads", or "native" and selects between pthread based disk I/O and native Linux AIO.
- at item format=@var{format}
-Specify which disk @var{format} will be used rather than detecting
-the format.  Can be used to specifiy format=raw to avoid interpreting
-an untrusted format header.
- at item serial=@var{serial}
-This option specifies the serial number to assign to the device.
- at item addr=@var{addr}
-Specify the controller's PCI address (if=virtio only).
- at item werror=@var{action},rerror=@var{action}
-Specify which @var{action} to take on write and read errors. Valid actions are:
-"ignore" (ignore the error and try to continue), "stop" (pause QEMU),
-"report" (report the error to the guest), "enospc" (pause QEMU only if the
-host disk is full; report the error to the guest otherwise).
-The default setting is @option{werror=enospc} and @option{rerror=report}.
- at item readonly
-Open drive @option{file} as read-only. Guest write attempts will fail.
- at item copy-on-read=@var{copy-on-read}
- at var{copy-on-read} is "on" or "off" and enables whether to copy read backing
-file sectors into the image file.
- at end table
-
-By default, the @option{cache=writeback} mode is used. It will report data
-writes as completed as soon as the data is present in the host page cache.
-This is safe as long as your guest OS makes sure to correctly flush disk caches
-where needed. If your guest OS does not handle volatile disk write caches
-correctly and your host crashes or loses power, then the guest may experience
-data corruption.
-
-For such guests, you should consider using @option{cache=writethrough}. This
-means that the host page cache will be used to read and write data, but write
-notification will be sent to the guest only after QEMU has made sure to flush
-each write to the disk. Be aware that this has a major impact on performance.
-
-The host page cache can be avoided entirely with @option{cache=none}.  This will
-attempt to do disk IO directly to the guest's memory.  QEMU may still perform
-an internal copy of the data. Note that this is considered a writeback mode and
-the guest OS must handle the disk write cache correctly in order to avoid data
-corruption on host crashes.
-
-The host page cache can be avoided while only sending write notifications to
-the guest when the data has been flushed to the disk using
- at option{cache=directsync}.
-
-In case you don't care about data integrity over host failures, use
- at option{cache=unsafe}. This option tells QEMU that it never needs to write any
-data to the disk but can instead keep things in cache. If anything goes wrong,
-like your host losing power, the disk storage getting disconnected accidentally,
-etc. your image will most probably be rendered unusable.   When using
-the @option{-snapshot} option, unsafe caching is always used.
-
-Copy-on-read avoids accessing the same backing file sectors repeatedly and is
-useful when the backing file is over a slow network.  By default copy-on-read
-is off.
-
-Instead of @option{-cdrom} you can use:
- at example
-qemu-system-i386 -drive file=file,index=2,media=cdrom
- at end example
-
-Instead of @option{-hda}, @option{-hdb}, @option{-hdc}, @option{-hdd}, you can
-use:
- at example
-qemu-system-i386 -drive file=file,index=0,media=disk
-qemu-system-i386 -drive file=file,index=1,media=disk
-qemu-system-i386 -drive file=file,index=2,media=disk
-qemu-system-i386 -drive file=file,index=3,media=disk
- at end example
-
-You can open an image using pre-opened file descriptors from an fd set:
- at example
-qemu-system-i386
--add-fd fd=3,set=2,opaque="rdwr:/path/to/file"
--add-fd fd=4,set=2,opaque="rdonly:/path/to/file"
--drive file=/dev/fdset/2,index=0,media=disk
- at end example
-
-You can connect a CDROM to the slave of ide0:
- at example
-qemu-system-i386 -drive file=file,if=ide,index=1,media=cdrom
- at end example
-
-If you don't specify the "file=" argument, you define an empty drive:
- at example
-qemu-system-i386 -drive if=ide,index=1,media=cdrom
- at end example
-
-You can connect a SCSI disk with unit ID 6 on the bus #0:
- at example
-qemu-system-i386 -drive file=file,if=scsi,bus=0,unit=6
- at end example
-
-Instead of @option{-fda}, @option{-fdb}, you can use:
- at example
-qemu-system-i386 -drive file=file,index=0,if=floppy
-qemu-system-i386 -drive file=file,index=1,if=floppy
- at end example
-
-By default, @var{interface} is "ide" and @var{index} is automatically
-incremented:
- at example
-qemu-system-i386 -drive file=a -drive file=b"
- at end example
-is interpreted like:
- at example
-qemu-system-i386 -hda a -hdb b
- at end example
-ETEXI
-
 DEF("add-fd", HAS_ARG, QEMU_OPTION_add_fd,
     "-add-fd fd=fd,set=set[,opaque=opaque]\n"
     "                Add 'fd' to fd 'set'\n", QEMU_ARCH_ALL)
@@ -349,31 +159,6 @@ created automatically by the machine model. To create a device which is not
 created automatically and set properties on it, use - at option{device}.
 ETEXI
 
-DEF("mtdblock", HAS_ARG, QEMU_OPTION_mtdblock,
-    "-mtdblock file  use 'file' as on-board Flash memory image\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -mtdblock @var{file}
- at findex -mtdblock
-Use @var{file} as on-board Flash memory image.
-ETEXI
-
-DEF("sd", HAS_ARG, QEMU_OPTION_sd,
-    "-sd file        use 'file' as SecureDigital card image\n", QEMU_ARCH_ALL)
-STEXI
- at item -sd @var{file}
- at findex -sd
-Use @var{file} as SecureDigital card image.
-ETEXI
-
-DEF("pflash", HAS_ARG, QEMU_OPTION_pflash,
-    "-pflash file    use 'file' as a parallel flash image\n", QEMU_ARCH_ALL)
-STEXI
- at item -pflash @var{file}
- at findex -pflash
-Use @var{file} as a parallel flash image.
-ETEXI
-
 DEF("boot", HAS_ARG, QEMU_OPTION_boot,
     "-boot [order=drives][,once=drives][,menu=on|off]\n"
     "      [,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time]\n"
@@ -420,17 +205,6 @@ Note: The legacy format '-boot @var{drives}' is still supported but its
 use is discouraged as it may be removed from future versions.
 ETEXI
 
-DEF("snapshot", 0, QEMU_OPTION_snapshot,
-    "-snapshot       write to temporary files instead of disk image files\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -snapshot
- at findex -snapshot
-Write to temporary files instead of disk image files. In this case,
-the raw disk image you use is not written back. You can however force
-the write back by pressing @key{C-a s} (@pxref{disk_images}).
-ETEXI
-
 DEF("m", HAS_ARG, QEMU_OPTION_m,
     "-m megs         set virtual RAM size to megs MB [default="
     stringify(DEFAULT_RAM_SIZE) "]\n", QEMU_ARCH_ALL)
@@ -506,146 +280,323 @@ Enable audio and selected sound hardware. Use 'help' to print all
 available sound hardware.
 
 @example
-qemu-system-i386 -soundhw sb16,adlib disk.img
-qemu-system-i386 -soundhw es1370 disk.img
-qemu-system-i386 -soundhw ac97 disk.img
-qemu-system-i386 -soundhw hda disk.img
-qemu-system-i386 -soundhw all disk.img
-qemu-system-i386 -soundhw help
+qemu-system-i386 -soundhw sb16,adlib disk.img
+qemu-system-i386 -soundhw es1370 disk.img
+qemu-system-i386 -soundhw ac97 disk.img
+qemu-system-i386 -soundhw hda disk.img
+qemu-system-i386 -soundhw all disk.img
+qemu-system-i386 -soundhw help
+ at end example
+
+Note that Linux's i810_audio OSS kernel (for AC97) module might
+require manually specifying clocking.
+
+ at example
+modprobe i810_audio clocking=48000
+ at end example
+ETEXI
+
+DEF("balloon", HAS_ARG, QEMU_OPTION_balloon,
+    "-balloon none   disable balloon device\n"
+    "-balloon virtio[,addr=str]\n"
+    "                enable virtio balloon device (default)\n", QEMU_ARCH_ALL)
+STEXI
+ at item -balloon none
+ at findex -balloon
+Disable balloon device.
+ at item -balloon virtio[,addr=@var{addr}]
+Enable virtio balloon device (default), optionally with PCI address
+ at var{addr}.
+ETEXI
+
+DEF("device", HAS_ARG, QEMU_OPTION_device,
+    "-device driver[,prop[=value][,...]]\n"
+    "                add device (based on driver)\n"
+    "                prop=value,... sets driver properties\n"
+    "                use '-device help' to print all possible drivers\n"
+    "                use '-device driver,help' to print all possible properties\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -device @var{driver}[, at var{prop}[=@var{value}][,...]]
+ at findex -device
+Add device @var{driver}.  @var{prop}=@var{value} sets driver
+properties.  Valid properties depend on the driver.  To get help on
+possible drivers and properties, use @code{-device help} and
+ at code{-device @var{driver},help}.
+ETEXI
+
+DEF("name", HAS_ARG, QEMU_OPTION_name,
+    "-name string1[,process=string2]\n"
+    "                set the name of the guest\n"
+    "                string1 sets the window title and string2 the process name (on Linux)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -name @var{name}
+ at findex -name
+Sets the @var{name} of the guest.
+This name will be displayed in the SDL window caption.
+The @var{name} will also be used for the VNC server.
+Also optionally set the top visible process name in Linux.
+ETEXI
+
+DEF("uuid", HAS_ARG, QEMU_OPTION_uuid,
+    "-uuid %08x-%04x-%04x-%04x-%012x\n"
+    "                specify machine UUID\n", QEMU_ARCH_ALL)
+STEXI
+ at item -uuid @var{uuid}
+ at findex -uuid
+Set system UUID.
+ETEXI
+
+STEXI
+ at end table
+ETEXI
+DEFHEADING()
+
+DEFHEADING(Block device options:)
+STEXI
+ at table @option
+ETEXI
+
+DEF("fda", HAS_ARG, QEMU_OPTION_fda,
+    "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
+DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
+STEXI
+ at item -fda @var{file}
+ at item -fdb @var{file}
+ at findex -fda
+ at findex -fdb
+Use @var{file} as floppy disk 0/1 image (@pxref{disk_images}). You can
+use the host floppy by using @file{/dev/fd0} as filename (@pxref{host_drives}).
+ETEXI
+
+DEF("hda", HAS_ARG, QEMU_OPTION_hda,
+    "-hda/-hdb file  use 'file' as IDE hard disk 0/1 image\n", QEMU_ARCH_ALL)
+DEF("hdb", HAS_ARG, QEMU_OPTION_hdb, "", QEMU_ARCH_ALL)
+DEF("hdc", HAS_ARG, QEMU_OPTION_hdc,
+    "-hdc/-hdd file  use 'file' as IDE hard disk 2/3 image\n", QEMU_ARCH_ALL)
+DEF("hdd", HAS_ARG, QEMU_OPTION_hdd, "", QEMU_ARCH_ALL)
+STEXI
+ at item -hda @var{file}
+ at item -hdb @var{file}
+ at item -hdc @var{file}
+ at item -hdd @var{file}
+ at findex -hda
+ at findex -hdb
+ at findex -hdc
+ at findex -hdd
+Use @var{file} as hard disk 0, 1, 2 or 3 image (@pxref{disk_images}).
+ETEXI
+
+DEF("cdrom", HAS_ARG, QEMU_OPTION_cdrom,
+    "-cdrom file     use 'file' as IDE cdrom image (cdrom is ide1 master)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -cdrom @var{file}
+ at findex -cdrom
+Use @var{file} as CD-ROM image (you cannot use @option{-hdc} and
+ at option{-cdrom} at the same time). You can use the host CD-ROM by
+using @file{/dev/cdrom} as filename (@pxref{host_drives}).
+ETEXI
+
+DEF("drive", HAS_ARG, QEMU_OPTION_drive,
+    "-drive [file=file][,if=type][,bus=n][,unit=m][,media=d][,index=i]\n"
+    "       [,cyls=c,heads=h,secs=s[,trans=t]][,snapshot=on|off]\n"
+    "       [,cache=writethrough|writeback|none|directsync|unsafe][,format=f]\n"
+    "       [,serial=s][,addr=A][,id=name][,aio=threads|native]\n"
+    "       [,readonly=on|off][,copy-on-read=on|off]\n"
+    "       [[,bps=b]|[[,bps_rd=r][,bps_wr=w]]][[,iops=i]|[[,iops_rd=r][,iops_wr=w]]\n"
+    "                use 'file' as a drive image\n", QEMU_ARCH_ALL)
+STEXI
+ at item -drive @var{option}[, at var{option}[, at var{option}[,...]]]
+ at findex -drive
+
+Define a new drive. Valid options are:
+
+ at table @option
+ at item file=@var{file}
+This option defines which disk image (@pxref{disk_images}) to use with
+this drive. If the filename contains comma, you must double it
+(for instance, "file=my,,file" to use file "my,file").
+
+Special files such as iSCSI devices can be specified using protocol
+specific URLs. See the section for "Device URL Syntax" for more information.
+ at item if=@var{interface}
+This option defines on which type on interface the drive is connected.
+Available types are: ide, scsi, sd, mtd, floppy, pflash, virtio.
+ at item bus=@var{bus},unit=@var{unit}
+These options define where is connected the drive by defining the bus number and
+the unit id.
+ at item index=@var{index}
+This option defines where is connected the drive by using an index in the list
+of available connectors of a given interface type.
+ at item media=@var{media}
+This option defines the type of the media: disk or cdrom.
+ at item cyls=@var{c},heads=@var{h},secs=@var{s}[,trans=@var{t}]
+These options have the same definition as they have in @option{-hdachs}.
+ at item snapshot=@var{snapshot}
+ at var{snapshot} is "on" or "off" and allows to enable snapshot for given drive (see @option{-snapshot}).
+ at item cache=@var{cache}
+ at var{cache} is "none", "writeback", "unsafe", "directsync" or "writethrough" and controls how the host cache is used to access block data.
+ at item aio=@var{aio}
+ at var{aio} is "threads", or "native" and selects between pthread based disk I/O and native Linux AIO.
+ at item format=@var{format}
+Specify which disk @var{format} will be used rather than detecting
+the format.  Can be used to specifiy format=raw to avoid interpreting
+an untrusted format header.
+ at item serial=@var{serial}
+This option specifies the serial number to assign to the device.
+ at item addr=@var{addr}
+Specify the controller's PCI address (if=virtio only).
+ at item werror=@var{action},rerror=@var{action}
+Specify which @var{action} to take on write and read errors. Valid actions are:
+"ignore" (ignore the error and try to continue), "stop" (pause QEMU),
+"report" (report the error to the guest), "enospc" (pause QEMU only if the
+host disk is full; report the error to the guest otherwise).
+The default setting is @option{werror=enospc} and @option{rerror=report}.
+ at item readonly
+Open drive @option{file} as read-only. Guest write attempts will fail.
+ at item copy-on-read=@var{copy-on-read}
+ at var{copy-on-read} is "on" or "off" and enables whether to copy read backing
+file sectors into the image file.
+ at end table
+
+By default, the @option{cache=writeback} mode is used. It will report data
+writes as completed as soon as the data is present in the host page cache.
+This is safe as long as your guest OS makes sure to correctly flush disk caches
+where needed. If your guest OS does not handle volatile disk write caches
+correctly and your host crashes or loses power, then the guest may experience
+data corruption.
+
+For such guests, you should consider using @option{cache=writethrough}. This
+means that the host page cache will be used to read and write data, but write
+notification will be sent to the guest only after QEMU has made sure to flush
+each write to the disk. Be aware that this has a major impact on performance.
+
+The host page cache can be avoided entirely with @option{cache=none}.  This will
+attempt to do disk IO directly to the guest's memory.  QEMU may still perform
+an internal copy of the data. Note that this is considered a writeback mode and
+the guest OS must handle the disk write cache correctly in order to avoid data
+corruption on host crashes.
+
+The host page cache can be avoided while only sending write notifications to
+the guest when the data has been flushed to the disk using
+ at option{cache=directsync}.
+
+In case you don't care about data integrity over host failures, use
+ at option{cache=unsafe}. This option tells QEMU that it never needs to write any
+data to the disk but can instead keep things in cache. If anything goes wrong,
+like your host losing power, the disk storage getting disconnected accidentally,
+etc. your image will most probably be rendered unusable.   When using
+the @option{-snapshot} option, unsafe caching is always used.
+
+Copy-on-read avoids accessing the same backing file sectors repeatedly and is
+useful when the backing file is over a slow network.  By default copy-on-read
+is off.
+
+Instead of @option{-cdrom} you can use:
+ at example
+qemu-system-i386 -drive file=file,index=2,media=cdrom
+ at end example
+
+Instead of @option{-hda}, @option{-hdb}, @option{-hdc}, @option{-hdd}, you can
+use:
+ at example
+qemu-system-i386 -drive file=file,index=0,media=disk
+qemu-system-i386 -drive file=file,index=1,media=disk
+qemu-system-i386 -drive file=file,index=2,media=disk
+qemu-system-i386 -drive file=file,index=3,media=disk
+ at end example
+
+You can open an image using pre-opened file descriptors from an fd set:
+ at example
+qemu-system-i386
+-add-fd fd=3,set=2,opaque="rdwr:/path/to/file"
+-add-fd fd=4,set=2,opaque="rdonly:/path/to/file"
+-drive file=/dev/fdset/2,index=0,media=disk
+ at end example
+
+You can connect a CDROM to the slave of ide0:
+ at example
+qemu-system-i386 -drive file=file,if=ide,index=1,media=cdrom
 @end example
 
-Note that Linux's i810_audio OSS kernel (for AC97) module might
-require manually specifying clocking.
+If you don't specify the "file=" argument, you define an empty drive:
+ at example
+qemu-system-i386 -drive if=ide,index=1,media=cdrom
+ at end example
 
+You can connect a SCSI disk with unit ID 6 on the bus #0:
 @example
-modprobe i810_audio clocking=48000
+qemu-system-i386 -drive file=file,if=scsi,bus=0,unit=6
 @end example
-ETEXI
 
-DEF("balloon", HAS_ARG, QEMU_OPTION_balloon,
-    "-balloon none   disable balloon device\n"
-    "-balloon virtio[,addr=str]\n"
-    "                enable virtio balloon device (default)\n", QEMU_ARCH_ALL)
-STEXI
- at item -balloon none
- at findex -balloon
-Disable balloon device.
- at item -balloon virtio[,addr=@var{addr}]
-Enable virtio balloon device (default), optionally with PCI address
- at var{addr}.
-ETEXI
+Instead of @option{-fda}, @option{-fdb}, you can use:
+ at example
+qemu-system-i386 -drive file=file,index=0,if=floppy
+qemu-system-i386 -drive file=file,index=1,if=floppy
+ at end example
 
-DEF("device", HAS_ARG, QEMU_OPTION_device,
-    "-device driver[,prop[=value][,...]]\n"
-    "                add device (based on driver)\n"
-    "                prop=value,... sets driver properties\n"
-    "                use '-device help' to print all possible drivers\n"
-    "                use '-device driver,help' to print all possible properties\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -device @var{driver}[, at var{prop}[=@var{value}][,...]]
- at findex -device
-Add device @var{driver}.  @var{prop}=@var{value} sets driver
-properties.  Valid properties depend on the driver.  To get help on
-possible drivers and properties, use @code{-device help} and
- at code{-device @var{driver},help}.
+By default, @var{interface} is "ide" and @var{index} is automatically
+incremented:
+ at example
+qemu-system-i386 -drive file=a -drive file=b"
+ at end example
+is interpreted like:
+ at example
+qemu-system-i386 -hda a -hdb b
+ at end example
 ETEXI
 
-DEF("name", HAS_ARG, QEMU_OPTION_name,
-    "-name string1[,process=string2]\n"
-    "                set the name of the guest\n"
-    "                string1 sets the window title and string2 the process name (on Linux)\n",
+DEF("mtdblock", HAS_ARG, QEMU_OPTION_mtdblock,
+    "-mtdblock file  use 'file' as on-board Flash memory image\n",
     QEMU_ARCH_ALL)
 STEXI
- at item -name @var{name}
- at findex -name
-Sets the @var{name} of the guest.
-This name will be displayed in the SDL window caption.
-The @var{name} will also be used for the VNC server.
-Also optionally set the top visible process name in Linux.
-ETEXI
-
-DEF("uuid", HAS_ARG, QEMU_OPTION_uuid,
-    "-uuid %08x-%04x-%04x-%04x-%012x\n"
-    "                specify machine UUID\n", QEMU_ARCH_ALL)
-STEXI
- at item -uuid @var{uuid}
- at findex -uuid
-Set system UUID.
+ at item -mtdblock @var{file}
+ at findex -mtdblock
+Use @var{file} as on-board Flash memory image.
 ETEXI
 
+DEF("sd", HAS_ARG, QEMU_OPTION_sd,
+    "-sd file        use 'file' as SecureDigital card image\n", QEMU_ARCH_ALL)
 STEXI
- at end table
+ at item -sd @var{file}
+ at findex -sd
+Use @var{file} as SecureDigital card image.
 ETEXI
-DEFHEADING()
 
-DEFHEADING(USB options:)
+DEF("pflash", HAS_ARG, QEMU_OPTION_pflash,
+    "-pflash file    use 'file' as a parallel flash image\n", QEMU_ARCH_ALL)
 STEXI
- at table @option
+ at item -pflash @var{file}
+ at findex -pflash
+Use @var{file} as a parallel flash image.
 ETEXI
 
-DEF("usb", 0, QEMU_OPTION_usb,
-    "-usb            enable the USB driver (will be the default soon)\n",
+DEF("snapshot", 0, QEMU_OPTION_snapshot,
+    "-snapshot       write to temporary files instead of disk image files\n",
     QEMU_ARCH_ALL)
 STEXI
- at item -usb
- at findex -usb
-Enable the USB driver (will be the default soon)
+ at item -snapshot
+ at findex -snapshot
+Write to temporary files instead of disk image files. In this case,
+the raw disk image you use is not written back. You can however force
+the write back by pressing @key{C-a s} (@pxref{disk_images}).
 ETEXI
 
-DEF("usbdevice", HAS_ARG, QEMU_OPTION_usbdevice,
-    "-usbdevice name add the host or guest USB device 'name'\n",
+DEF("hdachs", HAS_ARG, QEMU_OPTION_hdachs, \
+    "-hdachs c,h,s[,t]\n" \
+    "                force hard disk 0 physical geometry and the optional BIOS\n" \
+    "                translation (t=none or lba) (usually QEMU can guess them)\n",
     QEMU_ARCH_ALL)
 STEXI
-
- at item -usbdevice @var{devname}
- at findex -usbdevice
-Add the USB device @var{devname}. @xref{usb_devices}.
-
- at table @option
-
- at item mouse
-Virtual Mouse. This will override the PS/2 mouse emulation when activated.
-
- at item tablet
-Pointer device that uses absolute coordinates (like a touchscreen). This
-means QEMU is able to report the mouse position without having to grab the
-mouse. Also overrides the PS/2 mouse emulation when activated.
-
- at item disk:[format=@var{format}]:@var{file}
-Mass storage device based on file. The optional @var{format} argument
-will be used rather than detecting the format. Can be used to specifiy
- at code{format=raw} to avoid interpreting an untrusted format header.
-
- at item host:@var{bus}. at var{addr}
-Pass through the host device identified by @var{bus}. at var{addr} (Linux only).
-
- at item host:@var{vendor_id}:@var{product_id}
-Pass through the host device identified by @var{vendor_id}:@var{product_id}
-(Linux only).
-
- at item serial:[vendorid=@var{vendor_id}][,productid=@var{product_id}]:@var{dev}
-Serial converter to host character device @var{dev}, see @code{-serial} for the
-available devices.
-
- at item braille
-Braille device.  This will use BrlAPI to display the braille output on a real
-or fake device.
-
- at item net:@var{options}
-Network adapter that supports CDC ethernet and RNDIS protocols.
-
- at end table
-ETEXI
-
-STEXI
- at end table
-ETEXI
-DEFHEADING()
-
-DEFHEADING(File system options:)
-STEXI
- at table @option
+ at item -hdachs @var{c}, at var{h}, at var{s},[, at var{t}]
+ at findex -hdachs
+Force hard disk 0 physical geometry (1 <= @var{c} <= 16383, 1 <=
+ at var{h} <= 16, 1 <= @var{s} <= 63) and optionally force the BIOS
+translation mode (@var{t}=none, lba or auto). Usually QEMU can guess
+all those parameters. This option is useful for old MS-DOS disk
+images.
 ETEXI
 
 DEF("fsdev", HAS_ARG, QEMU_OPTION_fsdev,
@@ -710,16 +661,6 @@ Specifies the tag name to be used by the guest to mount this export point
 
 ETEXI
 
-STEXI
- at end table
-ETEXI
-DEFHEADING()
-
-DEFHEADING(Virtual File system pass-through options:)
-STEXI
- at table @option
-ETEXI
-
 DEF("virtfs", HAS_ARG, QEMU_OPTION_virtfs,
     "-virtfs local,path=path,mount_tag=tag,security_model=[mapped-xattr|mapped-file|passthrough|none]\n"
     "        [,writeout=immediate][,readonly][,socket=socket|sock_fd=sock_fd]\n",
@@ -786,6 +727,70 @@ STEXI
 ETEXI
 DEFHEADING()
 
+DEFHEADING(USB options:)
+STEXI
+ at table @option
+ETEXI
+
+DEF("usb", 0, QEMU_OPTION_usb,
+    "-usb            enable the USB driver (will be the default soon)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -usb
+ at findex -usb
+Enable the USB driver (will be the default soon)
+ETEXI
+
+DEF("usbdevice", HAS_ARG, QEMU_OPTION_usbdevice,
+    "-usbdevice name add the host or guest USB device 'name'\n",
+    QEMU_ARCH_ALL)
+STEXI
+
+ at item -usbdevice @var{devname}
+ at findex -usbdevice
+Add the USB device @var{devname}. @xref{usb_devices}.
+
+ at table @option
+
+ at item mouse
+Virtual Mouse. This will override the PS/2 mouse emulation when activated.
+
+ at item tablet
+Pointer device that uses absolute coordinates (like a touchscreen). This
+means QEMU is able to report the mouse position without having to grab the
+mouse. Also overrides the PS/2 mouse emulation when activated.
+
+ at item disk:[format=@var{format}]:@var{file}
+Mass storage device based on file. The optional @var{format} argument
+will be used rather than detecting the format. Can be used to specifiy
+ at code{format=raw} to avoid interpreting an untrusted format header.
+
+ at item host:@var{bus}. at var{addr}
+Pass through the host device identified by @var{bus}. at var{addr} (Linux only).
+
+ at item host:@var{vendor_id}:@var{product_id}
+Pass through the host device identified by @var{vendor_id}:@var{product_id}
+(Linux only).
+
+ at item serial:[vendorid=@var{vendor_id}][,productid=@var{product_id}]:@var{dev}
+Serial converter to host character device @var{dev}, see @code{-serial} for the
+available devices.
+
+ at item braille
+Braille device.  This will use BrlAPI to display the braille output on a real
+or fake device.
+
+ at item net:@var{options}
+Network adapter that supports CDC ethernet and RNDIS protocols.
+
+ at end table
+ETEXI
+
+STEXI
+ at end table
+ETEXI
+DEFHEADING()
+
 DEFHEADING(Display options:)
 STEXI
 @table @option
@@ -2525,21 +2530,6 @@ STEXI
 Output log in @var{logfile} instead of /tmp/qemu.log
 ETEXI
 
-DEF("hdachs", HAS_ARG, QEMU_OPTION_hdachs, \
-    "-hdachs c,h,s[,t]\n" \
-    "                force hard disk 0 physical geometry and the optional BIOS\n" \
-    "                translation (t=none or lba) (usually QEMU can guess them)\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -hdachs @var{c}, at var{h}, at var{s},[, at var{t}]
- at findex -hdachs
-Force hard disk 0 physical geometry (1 <= @var{c} <= 16383, 1 <=
- at var{h} <= 16, 1 <= @var{s} <= 63) and optionally force the BIOS
-translation mode (@var{t}=none, lba or auto). Usually QEMU can guess
-all those parameters. This option is useful for old MS-DOS disk
-images.
-ETEXI
-
 DEF("L", HAS_ARG, QEMU_OPTION_L, \
     "-L path         set the directory for the BIOS, VGA BIOS and keymaps\n",
     QEMU_ARCH_ALL)
commit 84644c451ce7cf8e3cf027501f0f44041f8c6972
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:42 2013 +0100

    doc help: A few options are under inappropriate headings, fix
    
    --device is under heading "USB options".  --name and --uuid are under
    "Virtual File system pass-through options".  Move all three to
    "Standard options".
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index ce9602f..27c9e61 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -535,6 +535,45 @@ Enable virtio balloon device (default), optionally with PCI address
 @var{addr}.
 ETEXI
 
+DEF("device", HAS_ARG, QEMU_OPTION_device,
+    "-device driver[,prop[=value][,...]]\n"
+    "                add device (based on driver)\n"
+    "                prop=value,... sets driver properties\n"
+    "                use '-device help' to print all possible drivers\n"
+    "                use '-device driver,help' to print all possible properties\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -device @var{driver}[, at var{prop}[=@var{value}][,...]]
+ at findex -device
+Add device @var{driver}.  @var{prop}=@var{value} sets driver
+properties.  Valid properties depend on the driver.  To get help on
+possible drivers and properties, use @code{-device help} and
+ at code{-device @var{driver},help}.
+ETEXI
+
+DEF("name", HAS_ARG, QEMU_OPTION_name,
+    "-name string1[,process=string2]\n"
+    "                set the name of the guest\n"
+    "                string1 sets the window title and string2 the process name (on Linux)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -name @var{name}
+ at findex -name
+Sets the @var{name} of the guest.
+This name will be displayed in the SDL window caption.
+The @var{name} will also be used for the VNC server.
+Also optionally set the top visible process name in Linux.
+ETEXI
+
+DEF("uuid", HAS_ARG, QEMU_OPTION_uuid,
+    "-uuid %08x-%04x-%04x-%04x-%012x\n"
+    "                specify machine UUID\n", QEMU_ARCH_ALL)
+STEXI
+ at item -uuid @var{uuid}
+ at findex -uuid
+Set system UUID.
+ETEXI
+
 STEXI
 @end table
 ETEXI
@@ -599,22 +638,6 @@ Network adapter that supports CDC ethernet and RNDIS protocols.
 @end table
 ETEXI
 
-DEF("device", HAS_ARG, QEMU_OPTION_device,
-    "-device driver[,prop[=value][,...]]\n"
-    "                add device (based on driver)\n"
-    "                prop=value,... sets driver properties\n"
-    "                use '-device help' to print all possible drivers\n"
-    "                use '-device driver,help' to print all possible properties\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -device @var{driver}[, at var{prop}[=@var{value}][,...]]
- at findex -device
-Add device @var{driver}.  @var{prop}=@var{value} sets driver
-properties.  Valid properties depend on the driver.  To get help on
-possible drivers and properties, use @code{-device help} and
- at code{-device @var{driver},help}.
-ETEXI
-
 STEXI
 @end table
 ETEXI
@@ -758,31 +781,6 @@ STEXI
 Create synthetic file system image
 ETEXI
 
-DEFHEADING()
-
-DEF("name", HAS_ARG, QEMU_OPTION_name,
-    "-name string1[,process=string2]\n"
-    "                set the name of the guest\n"
-    "                string1 sets the window title and string2 the process name (on Linux)\n",
-    QEMU_ARCH_ALL)
-STEXI
- at item -name @var{name}
- at findex -name
-Sets the @var{name} of the guest.
-This name will be displayed in the SDL window caption.
-The @var{name} will also be used for the VNC server.
-Also optionally set the top visible process name in Linux.
-ETEXI
-
-DEF("uuid", HAS_ARG, QEMU_OPTION_uuid,
-    "-uuid %08x-%04x-%04x-%04x-%012x\n"
-    "                specify machine UUID\n", QEMU_ARCH_ALL)
-STEXI
- at item -uuid @var{uuid}
- at findex -uuid
-Set system UUID.
-ETEXI
-
 STEXI
 @end table
 ETEXI
commit f037809907bcc51295a471ad66b14e90f22d8caa
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:41 2013 +0100

    help: Fix markup of heading "USB options" so it appears in -help
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-6-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 8c435cd..ce9602f 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -538,9 +538,10 @@ ETEXI
 STEXI
 @end table
 ETEXI
+DEFHEADING()
 
+DEFHEADING(USB options:)
 STEXI
-USB options:
 @table @option
 ETEXI
 
commit c70a01e449536c616c85ab820c6fbad7d7e9cf39
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:40 2013 +0100

    doc: Fix texinfo @table markup in qemu-options.hx
    
    End tables before headings, start new ones afterwards.  Fixes
    incorrect indentation of headings "File system options" and "Virtual
    File system pass-through options" in manual page and qemu-doc.
    
    Normalize markup some to increase chances it survives future edits.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index e33cdc9..8c435cd 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -539,13 +539,15 @@ STEXI
 @end table
 ETEXI
 
-DEF("usb", 0, QEMU_OPTION_usb,
-    "-usb            enable the USB driver (will be the default soon)\n",
-    QEMU_ARCH_ALL)
 STEXI
 USB options:
 @table @option
+ETEXI
 
+DEF("usb", 0, QEMU_OPTION_usb,
+    "-usb            enable the USB driver (will be the default soon)\n",
+    QEMU_ARCH_ALL)
+STEXI
 @item -usb
 @findex -usb
 Enable the USB driver (will be the default soon)
@@ -612,9 +614,15 @@ possible drivers and properties, use @code{-device help} and
 @code{-device @var{driver},help}.
 ETEXI
 
+STEXI
+ at end table
+ETEXI
 DEFHEADING()
 
 DEFHEADING(File system options:)
+STEXI
+ at table @option
+ETEXI
 
 DEF("fsdev", HAS_ARG, QEMU_OPTION_fsdev,
     "-fsdev fsdriver,id=id[,path=path,][security_model={mapped-xattr|mapped-file|passthrough|none}]\n"
@@ -678,9 +686,15 @@ Specifies the tag name to be used by the guest to mount this export point
 
 ETEXI
 
+STEXI
+ at end table
+ETEXI
 DEFHEADING()
 
 DEFHEADING(Virtual File system pass-through options:)
+STEXI
+ at table @option
+ETEXI
 
 DEF("virtfs", HAS_ARG, QEMU_OPTION_virtfs,
     "-virtfs local,path=path,mount_tag=tag,security_model=[mapped-xattr|mapped-file|passthrough|none]\n"
@@ -771,11 +785,9 @@ ETEXI
 STEXI
 @end table
 ETEXI
-
 DEFHEADING()
 
 DEFHEADING(Display options:)
-
 STEXI
 @table @option
 ETEXI
@@ -1217,7 +1229,6 @@ ETEXI
 STEXI
 @end table
 ETEXI
-
 ARCHHEADING(, QEMU_ARCH_I386)
 
 ARCHHEADING(i386 target only:, QEMU_ARCH_I386)
@@ -1302,10 +1313,10 @@ Specify SMBIOS type 0 fields
 Specify SMBIOS type 1 fields
 ETEXI
 
-DEFHEADING()
 STEXI
 @end table
 ETEXI
+DEFHEADING()
 
 DEFHEADING(Network options:)
 STEXI
@@ -1720,13 +1731,19 @@ libpcap, so it can be analyzed with tools such as tcpdump or Wireshark.
 Indicate that no network devices should be configured. It is used to
 override the default configuration (@option{-net nic -net user}) which
 is activated if no @option{-net} options are provided.
+ETEXI
 
+STEXI
 @end table
 ETEXI
-
 DEFHEADING()
 
 DEFHEADING(Character device options:)
+STEXI
+
+The general form of a character device option is:
+ at table @option
+ETEXI
 
 DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
     "-chardev null,id=id[,mux=on|off]\n"
@@ -1768,10 +1785,6 @@ DEF("chardev", HAS_ARG, QEMU_OPTION_chardev,
 )
 
 STEXI
-
-The general form of a character device option is:
- at table @option
-
 @item -chardev @var{backend} ,id=@var{id} [,mux=on|off] [, at var{options}]
 @findex -chardev
 Backend is one of:
@@ -1992,14 +2005,15 @@ Connect to a spice virtual machine channel, such as vdiport.
 
 Connect to a spice port, allowing a Spice client to handle the traffic
 identified by a name (preferably a fqdn).
+ETEXI
 
+STEXI
 @end table
 ETEXI
-
 DEFHEADING()
 
-STEXI
 DEFHEADING(Device URL Syntax:)
+STEXI
 
 In addition to using normal file images for the emulated storage devices,
 QEMU can also use networked resources such as iSCSI devices. These are
@@ -2115,10 +2129,16 @@ qemu-system-x86_84 --drive file=gluster://192.0.2.1/testvol/a.img
 @end example
 
 See also @url{http://www.gluster.org}.
+ETEXI
+
+STEXI
 @end table
 ETEXI
 
 DEFHEADING(Bluetooth(R) options:)
+STEXI
+ at table @option
+ETEXI
 
 DEF("bt", HAS_ARG, QEMU_OPTION_bt, \
     "-bt hci,null    dumb bluetooth HCI - doesn't respond to commands\n" \
@@ -2132,8 +2152,6 @@ DEF("bt", HAS_ARG, QEMU_OPTION_bt, \
     "                emulate a bluetooth device 'dev' in scatternet 'n'\n",
     QEMU_ARCH_ALL)
 STEXI
- at table @option
-
 @item -bt hci[...]
 @findex -bt
 Defines the function of the corresponding Bluetooth HCI.  -bt options
@@ -2185,9 +2203,11 @@ currently:
 @item keyboard
 Virtual wireless keyboard implementing the HIDP bluetooth profile.
 @end table
- at end table
 ETEXI
 
+STEXI
+ at end table
+ETEXI
 DEFHEADING()
 
 DEFHEADING(Linux/Multiboot boot specific:)
@@ -2244,11 +2264,9 @@ ETEXI
 STEXI
 @end table
 ETEXI
-
 DEFHEADING()
 
 DEFHEADING(Debug/Expert options:)
-
 STEXI
 @table @option
 ETEXI
commit 6265c43b0c872015e4331d3a93ff99946f3edb01
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:39 2013 +0100

    doc: Fill some option doc gaps in manual page and qemu-doc
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index f7d8482..e33cdc9 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -326,9 +326,9 @@ DEF("set", HAS_ARG, QEMU_OPTION_set,
     "                set <arg> parameter for item <id> of type <group>\n"
     "                i.e. -set drive.$id.file=/path/to/image\n", QEMU_ARCH_ALL)
 STEXI
- at item -set
+ at item -set @var{group}. at var{id}. at var{arg}=@var{value}
 @findex -set
-TODO
+Set parameter @var{arg} for item @var{id} of type @var{group}\n"
 ETEXI
 
 DEF("global", HAS_ARG, QEMU_OPTION_global,
@@ -1000,7 +1000,7 @@ DEF("rotate", HAS_ARG, QEMU_OPTION_rotate,
     "-rotate <deg>   rotate graphical output some deg left (only PXA LCD)\n",
     QEMU_ARCH_ALL)
 STEXI
- at item -rotate
+ at item -rotate @var{deg}
 @findex -rotate
 Rotate graphical output some deg left (only PXA LCD).
 ETEXI
@@ -2858,7 +2858,7 @@ DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
     "-sandbox <arg>  Enable seccomp mode 2 system call filter (default 'off').\n",
     QEMU_ARCH_ALL)
 STEXI
- at item -sandbox
+ at item -sandbox @var{arg}
 @findex -sandbox
 Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will
 disable it.  The default is 'off'.
@@ -2969,6 +2969,14 @@ DEF("object", HAS_ARG, QEMU_OPTION_object,
     "                property must be set.  These objects are placed in the\n"
     "                '/objects' path.\n",
     QEMU_ARCH_ALL)
+STEXI
+ at item -object @var{typename}[, at var{prop1}=@var{value1},...]
+ at findex -object
+Create an new object of type @var{typename} setting properties
+in the order they are specified.  Note that the 'id'
+property must be set.  These objects are placed in the
+'/objects' path.
+ETEXI
 
 HXCOMM This is the last statement. Insert new options before this line!
 STEXI
commit b8f490eb271cf07f491f05e11e3a3a4e7fde9f70
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:38 2013 +0100

    doc: Fix some option entries in qemu-doc's function index
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 7fc4af9..f7d8482 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -446,6 +446,7 @@ DEF("mem-path", HAS_ARG, QEMU_OPTION_mempath,
     "-mem-path FILE  provide backing storage for guest RAM\n", QEMU_ARCH_ALL)
 STEXI
 @item -mem-path @var{path}
+ at findex -mem-path
 Allocate guest RAM from a temporarily created file in @var{path}.
 ETEXI
 
@@ -455,6 +456,7 @@ DEF("mem-prealloc", 0, QEMU_OPTION_mem_prealloc,
     QEMU_ARCH_ALL)
 STEXI
 @item -mem-prealloc
+ at findex -mem-prealloc
 Preallocate memory when using -mem-path.
 ETEXI
 #endif
@@ -827,7 +829,7 @@ DEF("curses", 0, QEMU_OPTION_curses,
     QEMU_ARCH_ALL)
 STEXI
 @item -curses
- at findex curses
+ at findex -curses
 Normally, QEMU uses SDL to display the VGA output.  With this option,
 QEMU can display the VGA output when in text mode using a
 curses/ncurses interface.  Nothing is displayed in graphical mode.
@@ -1294,7 +1296,6 @@ STEXI
 Load SMBIOS entry from binary file.
 
 @item -smbios type=0[,vendor=@var{str}][,version=@var{str}][,date=@var{str}][,release=@var{%d.%d}]
- at findex -smbios
 Specify SMBIOS type 0 fields
 
 @item -smbios type=1[,manufacturer=@var{str}][,product=@var{str}] [,version=@var{str}][,serial=@var{str}][,uuid=@var{uuid}][,sku=@var{str}] [,family=@var{str}]
@@ -1409,6 +1410,7 @@ Not all devices are supported on all targets.  Use @code{-net nic,model=help}
 for a list of available devices for your target.
 
 @item -netdev user,id=@var{id}[, at var{option}][, at var{option}][,...]
+ at findex -netdev
 @item -net user[, at var{option}][, at var{option}][,...]
 Use the user mode network stack which requires no administrator
 privilege to run. Valid options are:
@@ -2709,6 +2711,7 @@ DEF("watchdog-action", HAS_ARG, QEMU_OPTION_watchdog_action, \
     QEMU_ARCH_ALL)
 STEXI
 @item -watchdog-action @var{action}
+ at findex -watchdog-action
 
 The @var{action} controls what QEMU will do when the watchdog timer
 expires.
commit 31e70d6c12d8f0170d7eeb56fa8275a9cc77c4a4
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 19:49:37 2013 +0100

    help: Drop bogus help on -qtest and -qtest-log
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360781383-28635-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 9d7131a..7fc4af9 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2928,13 +2928,9 @@ the @var{simple} tracing backend.
 @end table
 ETEXI
 
-DEF("qtest", HAS_ARG, QEMU_OPTION_qtest,
-    "-qtest CHR      specify tracing options\n",
-    QEMU_ARCH_ALL)
-
-DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log,
-    "-qtest-log LOG  specify tracing options\n",
-    QEMU_ARCH_ALL)
+HXCOMM Internal use
+DEF("qtest", HAS_ARG, QEMU_OPTION_qtest, "", QEMU_ARCH_ALL)
+DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
 
 #ifdef __linux__
 DEF("enable-fips", 0, QEMU_OPTION_enablefips,
commit c538ca66ffec97432057d3fe1aa5a4bb417ae9e9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 16 11:27:26 2013 +0100

    isa: Split off instance_init for ISADevice
    
    Prepares for assigning IRQs before QOM realize.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1361010446-1427-1-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/isa-bus.c b/hw/isa-bus.c
index fce311b..6dc34f0 100644
--- a/hw/isa-bus.c
+++ b/hw/isa-bus.c
@@ -124,9 +124,6 @@ static int isa_qdev_init(DeviceState *qdev)
     ISADevice *dev = ISA_DEVICE(qdev);
     ISADeviceClass *klass = ISA_DEVICE_GET_CLASS(dev);
 
-    dev->isairq[0] = -1;
-    dev->isairq[1] = -1;
-
     if (klass->init) {
         return klass->init(dev);
     }
@@ -134,6 +131,14 @@ static int isa_qdev_init(DeviceState *qdev)
     return 0;
 }
 
+static void isa_device_init(Object *obj)
+{
+    ISADevice *dev = ISA_DEVICE(obj);
+
+    dev->isairq[0] = -1;
+    dev->isairq[1] = -1;
+}
+
 ISADevice *isa_create(ISABus *bus, const char *name)
 {
     DeviceState *dev;
@@ -233,6 +238,7 @@ static const TypeInfo isa_device_type_info = {
     .name = TYPE_ISA_DEVICE,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(ISADevice),
+    .instance_init = isa_device_init,
     .abstract = true,
     .class_size = sizeof(ISADeviceClass),
     .class_init = isa_device_class_init,
commit 872536bf5dfdf207d275cd627caec2aefb68aab9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 16 22:44:03 2013 +0100

    qtest: Add MMIO support
    
    Introduce [qtest_]{read,write}[bwlq]() libqtest functions and
    corresponding QTest protocol commands to replace local versions in
    libi2c-omap.c.
    
    Also convert m48t59-test's cmos_{read,write}_mmio() to {read,write}b().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1361051043-27944-4-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/Makefile.objs b/Makefile.objs
index 21e9c91..a68cdac 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -72,7 +72,6 @@ common-obj-y += ui/
 common-obj-y += bt-host.o bt-vhci.o
 
 common-obj-y += dma-helpers.o
-common-obj-y += qtest.o
 common-obj-y += vl.o
 
 common-obj-$(CONFIG_SLIRP) += slirp/
diff --git a/Makefile.target b/Makefile.target
index 760da1e..ca657b3 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -109,6 +109,7 @@ CONFIG_NO_GET_MEMORY_MAPPING = $(if $(subst n,,$(CONFIG_HAVE_GET_MEMORY_MAPPING)
 CONFIG_NO_CORE_DUMP = $(if $(subst n,,$(CONFIG_HAVE_CORE_DUMP)),n,y)
 
 obj-y += arch_init.o cpus.o monitor.o gdbstub.o balloon.o ioport.o
+obj-y += qtest.o
 obj-y += hw/
 obj-$(CONFIG_KVM) += kvm-all.o
 obj-$(CONFIG_NO_KVM) += kvm-stub.o
diff --git a/qtest.c b/qtest.c
index 4663a38..5e0e9ec 100644
--- a/qtest.c
+++ b/qtest.c
@@ -87,6 +87,30 @@ static bool qtest_opened;
  *  > inl ADDR
  *  < OK VALUE
  *
+ *  > writeb ADDR VALUE
+ *  < OK
+ *
+ *  > writew ADDR VALUE
+ *  < OK
+ *
+ *  > writel ADDR VALUE
+ *  < OK
+ *
+ *  > writeq ADDR VALUE
+ *  < OK
+ *
+ *  > readb ADDR
+ *  < OK VALUE
+ *
+ *  > readw ADDR
+ *  < OK VALUE
+ *
+ *  > readl ADDR
+ *  < OK VALUE
+ *
+ *  > readq ADDR
+ *  < OK VALUE
+ *
  *  > read ADDR SIZE
  *  < OK DATA
  *
@@ -277,6 +301,63 @@ static void qtest_process_command(CharDriverState *chr, gchar **words)
         }
         qtest_send_prefix(chr);
         qtest_send(chr, "OK 0x%04x\n", value);
+    } else if (strcmp(words[0], "writeb") == 0 ||
+               strcmp(words[0], "writew") == 0 ||
+               strcmp(words[0], "writel") == 0 ||
+               strcmp(words[0], "writeq") == 0) {
+        uint64_t addr;
+        uint64_t value;
+
+        g_assert(words[1] && words[2]);
+        addr = strtoull(words[1], NULL, 0);
+        value = strtoull(words[2], NULL, 0);
+
+        if (words[0][5] == 'b') {
+            uint8_t data = value;
+            cpu_physical_memory_write(addr, &data, 1);
+        } else if (words[0][5] == 'w') {
+            uint16_t data = value;
+            tswap16s(&data);
+            cpu_physical_memory_write(addr, &data, 2);
+        } else if (words[0][5] == 'l') {
+            uint32_t data = value;
+            tswap32s(&data);
+            cpu_physical_memory_write(addr, &data, 4);
+        } else if (words[0][5] == 'q') {
+            uint64_t data = value;
+            tswap64s(&data);
+            cpu_physical_memory_write(addr, &data, 8);
+        }
+        qtest_send_prefix(chr);
+        qtest_send(chr, "OK\n");
+    } else if (strcmp(words[0], "readb") == 0 ||
+               strcmp(words[0], "readw") == 0 ||
+               strcmp(words[0], "readl") == 0 ||
+               strcmp(words[0], "readq") == 0) {
+        uint64_t addr;
+        uint64_t value = UINT64_C(-1);
+
+        g_assert(words[1]);
+        addr = strtoull(words[1], NULL, 0);
+
+        if (words[0][4] == 'b') {
+            uint8_t data;
+            cpu_physical_memory_read(addr, &data, 1);
+            value = data;
+        } else if (words[0][4] == 'w') {
+            uint16_t data;
+            cpu_physical_memory_read(addr, &data, 2);
+            value = tswap16(data);
+        } else if (words[0][4] == 'l') {
+            uint32_t data;
+            cpu_physical_memory_read(addr, &data, 4);
+            value = tswap32(data);
+        } else if (words[0][4] == 'q') {
+            cpu_physical_memory_read(addr, &value, 8);
+            tswap64s(&value);
+        }
+        qtest_send_prefix(chr);
+        qtest_send(chr, "OK 0x%016" PRIx64 "\n", value);
     } else if (strcmp(words[0], "read") == 0) {
         uint64_t addr, len, i;
         uint8_t *data;
diff --git a/tests/libi2c-omap.c b/tests/libi2c-omap.c
index b7b10b5..c52458c 100644
--- a/tests/libi2c-omap.c
+++ b/tests/libi2c-omap.c
@@ -49,29 +49,6 @@ typedef struct OMAPI2C {
 } OMAPI2C;
 
 
-/* FIXME Use TBD readw qtest API */
-static inline uint16_t readw(uint64_t addr)
-{
-    uint16_t data;
-
-    memread(addr, &data, 2);
-    return le16_to_cpu(data);
-}
-
-/* FIXME Use TBD writew qtest API */
-static inline void writew(uint64_t addr, uint16_t data)
-{
-    data = cpu_to_le16(data);
-    memwrite(addr, &data, 2);
-}
-
-#ifdef __GNUC__
-#undef memread
-#undef memwrite
-#pragma GCC poison memread
-#pragma GCC poison memwrite
-#endif
-
 static void omap_i2c_set_slave_addr(OMAPI2C *s, uint8_t addr)
 {
     uint16_t data = addr;
diff --git a/tests/libqtest.c b/tests/libqtest.c
index da58ff5..389596a 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -3,10 +3,12 @@
  *
  * Copyright IBM, Corp. 2012
  * Copyright Red Hat, Inc. 2012
+ * Copyright SUSE LINUX Products GmbH 2013
  *
  * Authors:
  *  Anthony Liguori   <aliguori at us.ibm.com>
  *  Paolo Bonzini     <pbonzini at redhat.com>
+ *  Andreas Färber    <afaerber at suse.de>
  *
  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  * See the COPYING file in the top-level directory.
@@ -437,6 +439,66 @@ uint32_t qtest_inl(QTestState *s, uint16_t addr)
     return qtest_in(s, "inl", addr);
 }
 
+static void qtest_write(QTestState *s, const char *cmd, uint64_t addr,
+                        uint64_t value)
+{
+    qtest_sendf(s, "%s 0x%" PRIx64 " 0x%" PRIx64 "\n", cmd, addr, value);
+    qtest_rsp(s, 0);
+}
+
+void qtest_writeb(QTestState *s, uint64_t addr, uint8_t value)
+{
+    qtest_write(s, "writeb", addr, value);
+}
+
+void qtest_writew(QTestState *s, uint64_t addr, uint16_t value)
+{
+    qtest_write(s, "writew", addr, value);
+}
+
+void qtest_writel(QTestState *s, uint64_t addr, uint32_t value)
+{
+    qtest_write(s, "writel", addr, value);
+}
+
+void qtest_writeq(QTestState *s, uint64_t addr, uint64_t value)
+{
+    qtest_write(s, "writeq", addr, value);
+}
+
+static uint64_t qtest_read(QTestState *s, const char *cmd, uint64_t addr)
+{
+    gchar **args;
+    uint64_t value;
+
+    qtest_sendf(s, "%s 0x%" PRIx64 "\n", cmd, addr);
+    args = qtest_rsp(s, 2);
+    value = strtoull(args[1], NULL, 0);
+    g_strfreev(args);
+
+    return value;
+}
+
+uint8_t qtest_readb(QTestState *s, uint64_t addr)
+{
+    return qtest_read(s, "readb", addr);
+}
+
+uint16_t qtest_readw(QTestState *s, uint64_t addr)
+{
+    return qtest_read(s, "readw", addr);
+}
+
+uint32_t qtest_readl(QTestState *s, uint64_t addr)
+{
+    return qtest_read(s, "readl", addr);
+}
+
+uint64_t qtest_readq(QTestState *s, uint64_t addr)
+{
+    return qtest_read(s, "readq", addr);
+}
+
 static int hex2nib(char ch)
 {
     if (ch >= '0' && ch <= '9') {
diff --git a/tests/libqtest.h b/tests/libqtest.h
index f5c6e21..437bda3 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -3,10 +3,12 @@
  *
  * Copyright IBM, Corp. 2012
  * Copyright Red Hat, Inc. 2012
+ * Copyright SUSE LINUX Products GmbH 2013
  *
  * Authors:
  *  Anthony Liguori   <aliguori at us.ibm.com>
  *  Paolo Bonzini     <pbonzini at redhat.com>
+ *  Andreas Färber    <afaerber at suse.de>
  *
  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  * See the COPYING file in the top-level directory.
@@ -146,6 +148,90 @@ uint16_t qtest_inw(QTestState *s, uint16_t addr);
 uint32_t qtest_inl(QTestState *s, uint16_t addr);
 
 /**
+ * qtest_writeb:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes an 8-bit value to memory.
+ */
+void qtest_writeb(QTestState *s, uint64_t addr, uint8_t value);
+
+/**
+ * qtest_writew:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 16-bit value to memory.
+ */
+void qtest_writew(QTestState *s, uint64_t addr, uint16_t value);
+
+/**
+ * qtest_writel:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 32-bit value to memory.
+ */
+void qtest_writel(QTestState *s, uint64_t addr, uint32_t value);
+
+/**
+ * qtest_writeq:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 64-bit value to memory.
+ */
+void qtest_writeq(QTestState *s, uint64_t addr, uint64_t value);
+
+/**
+ * qtest_readb:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to read from.
+ *
+ * Reads an 8-bit value from memory.
+ *
+ * Returns: Value read.
+ */
+uint8_t qtest_readb(QTestState *s, uint64_t addr);
+
+/**
+ * qtest_readw:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to read from.
+ *
+ * Reads a 16-bit value from memory.
+ *
+ * Returns: Value read.
+ */
+uint16_t qtest_readw(QTestState *s, uint64_t addr);
+
+/**
+ * qtest_readl:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to read from.
+ *
+ * Reads a 32-bit value from memory.
+ *
+ * Returns: Value read.
+ */
+uint32_t qtest_readl(QTestState *s, uint64_t addr);
+
+/**
+ * qtest_readq:
+ * @s: #QTestState instance to operate on.
+ * @addr: Guest address to read from.
+ *
+ * Reads a 64-bit value from memory.
+ *
+ * Returns: Value read.
+ */
+uint64_t qtest_readq(QTestState *s, uint64_t addr);
+
+/**
  * qtest_memread:
  * @s: #QTestState instance to operate on.
  * @addr: Guest address to read from.
@@ -358,6 +444,106 @@ static inline uint32_t inl(uint16_t addr)
 }
 
 /**
+ * writeb:
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes an 8-bit value to guest memory.
+ */
+static inline void writeb(uint64_t addr, uint8_t value)
+{
+    qtest_writeb(global_qtest, addr, value);
+}
+
+/**
+ * writew:
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 16-bit value to guest memory.
+ */
+static inline void writew(uint64_t addr, uint16_t value)
+{
+    qtest_writew(global_qtest, addr, value);
+}
+
+/**
+ * writel:
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 32-bit value to guest memory.
+ */
+static inline void writel(uint64_t addr, uint32_t value)
+{
+    qtest_writel(global_qtest, addr, value);
+}
+
+/**
+ * writeq:
+ * @addr: Guest address to write to.
+ * @value: Value being written.
+ *
+ * Writes a 64-bit value to guest memory.
+ */
+static inline void writeq(uint64_t addr, uint64_t value)
+{
+    qtest_writeq(global_qtest, addr, value);
+}
+
+/**
+ * readb:
+ * @addr: Guest address to read from.
+ *
+ * Reads an 8-bit value from guest memory.
+ *
+ * Returns: Value read.
+ */
+static inline uint8_t readb(uint64_t addr)
+{
+    return qtest_readb(global_qtest, addr);
+}
+
+/**
+ * readw:
+ * @addr: Guest address to read from.
+ *
+ * Reads a 16-bit value from guest memory.
+ *
+ * Returns: Value read.
+ */
+static inline uint16_t readw(uint64_t addr)
+{
+    return qtest_readw(global_qtest, addr);
+}
+
+/**
+ * readl:
+ * @addr: Guest address to read from.
+ *
+ * Reads a 32-bit value from guest memory.
+ *
+ * Returns: Value read.
+ */
+static inline uint32_t readl(uint64_t addr)
+{
+    return qtest_readl(global_qtest, addr);
+}
+
+/**
+ * readq:
+ * @addr: Guest address to read from.
+ *
+ * Reads a 64-bit value from guest memory.
+ *
+ * Returns: Value read.
+ */
+static inline uint64_t readq(uint64_t addr)
+{
+    return qtest_readq(global_qtest, addr);
+}
+
+/**
  * memread:
  * @addr: Guest address to read from.
  * @data: Pointer to where memory contents will be stored.
diff --git a/tests/m48t59-test.c b/tests/m48t59-test.c
index 77d69b3..4081a5f 100644
--- a/tests/m48t59-test.c
+++ b/tests/m48t59-test.c
@@ -35,17 +35,14 @@ static bool use_mmio;
 
 static uint8_t cmos_read_mmio(uint8_t reg)
 {
-    uint8_t data;
-
-    memread(base + (uint32_t)reg_base + (uint32_t)reg, &data, 1);
-    return data;
+    return readb(base + (uint32_t)reg_base + (uint32_t)reg);
 }
 
 static void cmos_write_mmio(uint8_t reg, uint8_t val)
 {
     uint8_t data = val;
 
-    memwrite(base + (uint32_t)reg_base + (uint32_t)reg, &data, 1);
+    writeb(base + (uint32_t)reg_base + (uint32_t)reg, data);
 }
 
 static uint8_t cmos_read_ioio(uint8_t reg)
commit b73cf9e93f1c7fd6e949f71172c49848b4d70aa9
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 16 22:44:02 2013 +0100

    libqtest: Introduce qtest_qmpv() and convert remaining macro
    
    In order to convert qmp() macro to an inline function, expose a
    qtest_qmpv() function, reused by qtest_qmp().
    
    We can't apply GCC_FMT_ATTR() since fdc-test is using zero-length format
    strings, which would result in warnings treated as errors.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1361051043-27944-3-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqtest.c b/tests/libqtest.c
index 762dec4..da58ff5 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -288,16 +288,13 @@ redo:
     return words;
 }
 
-void qtest_qmp(QTestState *s, const char *fmt, ...)
+void qtest_qmpv(QTestState *s, const char *fmt, va_list ap)
 {
-    va_list ap;
     bool has_reply = false;
     int nesting = 0;
 
     /* Send QMP request */
-    va_start(ap, fmt);
     socket_sendf(s->qmp_fd, fmt, ap);
-    va_end(ap);
 
     /* Receive reply */
     while (!has_reply || nesting > 0) {
@@ -326,6 +323,15 @@ void qtest_qmp(QTestState *s, const char *fmt, ...)
     }
 }
 
+void qtest_qmp(QTestState *s, const char *fmt, ...)
+{
+    va_list ap;
+
+    va_start(ap, fmt);
+    qtest_qmpv(s, fmt, ap);
+    va_end(ap);
+}
+
 const char *qtest_get_arch(void)
 {
     const char *qemu = getenv("QTEST_QEMU_BINARY");
diff --git a/tests/libqtest.h b/tests/libqtest.h
index a111c9c..f5c6e21 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -17,6 +17,7 @@
 
 #include <stdint.h>
 #include <stdbool.h>
+#include <stdarg.h>
 #include <sys/types.h>
 
 typedef struct QTestState QTestState;
@@ -49,6 +50,16 @@ void qtest_quit(QTestState *s);
 void qtest_qmp(QTestState *s, const char *fmt, ...);
 
 /**
+ * qtest_qmpv:
+ * @s: #QTestState instance to operate on.
+ * @fmt: QMP message to send to QEMU
+ * @ap: QMP message arguments
+ *
+ * Sends a QMP message to QEMU.
+ */
+void qtest_qmpv(QTestState *s, const char *fmt, va_list ap);
+
+/**
  * qtest_get_irq:
  * @s: #QTestState instance to operate on.
  * @num: Interrupt to observe.
@@ -227,7 +238,14 @@ static inline QTestState *qtest_start(const char *args)
  *
  * Sends a QMP message to QEMU
  */
-#define qmp(fmt, ...) qtest_qmp(global_qtest, fmt, ## __VA_ARGS__)
+static inline void qmp(const char *fmt, ...)
+{
+    va_list ap;
+
+    va_start(ap, fmt);
+    qtest_qmpv(global_qtest, fmt, ap);
+    va_end(ap);
+}
 
 /**
  * get_irq:
commit 6acf801de5a6e299c02ab3efe3e0dcd75ae678e0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 16 22:44:01 2013 +0100

    libqtest: Convert macros to functions and clean up documentation
    
    libqtest.h provides a number of shortcut macros to avoid tests feeding
    it the QTestState they operate on. Most of these can easily be turned
    into static inline functions, so let's do that for clarity.
    This avoids getting off-by-one error messages when passing wrong args.
    
    Some macros had a val argument but documented @value argument. Fix this.
    
    While touching things, enforce gtk-doc markup for return values and for
    referencing types.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1361051043-27944-2-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqtest.h b/tests/libqtest.h
index 110e2ec..a111c9c 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -26,12 +26,14 @@ extern QTestState *global_qtest;
 /**
  * qtest_init:
  * @extra_args: other arguments to pass to QEMU.
+ *
+ * Returns: #QTestState instance.
  */
 QTestState *qtest_init(const char *extra_args);
 
 /**
  * qtest_quit:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  *
  * Shut down the QEMU process associated to @s.
  */
@@ -39,7 +41,7 @@ void qtest_quit(QTestState *s);
 
 /**
  * qtest_qmp:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @fmt...: QMP message to send to qemu
  *
  * Sends a QMP message to QEMU
@@ -48,16 +50,16 @@ void qtest_qmp(QTestState *s, const char *fmt, ...);
 
 /**
  * qtest_get_irq:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @num: Interrupt to observe.
  *
- * Return the level of the @num interrupt.
+ * Returns: The level of the @num interrupt.
  */
 bool qtest_get_irq(QTestState *s, int num);
 
 /**
  * qtest_irq_intercept_in:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @string: QOM path of a device.
  *
  * Associate qtest irqs with the GPIO-in pins of the device
@@ -67,7 +69,7 @@ void qtest_irq_intercept_in(QTestState *s, const char *string);
 
 /**
  * qtest_irq_intercept_out:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @string: QOM path of a device.
  *
  * Associate qtest irqs with the GPIO-out pins of the device
@@ -77,7 +79,7 @@ void qtest_irq_intercept_out(QTestState *s, const char *string);
 
 /**
  * qtest_outb:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to write to.
  * @value: Value being written.
  *
@@ -87,7 +89,7 @@ void qtest_outb(QTestState *s, uint16_t addr, uint8_t value);
 
 /**
  * qtest_outw:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to write to.
  * @value: Value being written.
  *
@@ -97,7 +99,7 @@ void qtest_outw(QTestState *s, uint16_t addr, uint16_t value);
 
 /**
  * qtest_outl:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to write to.
  * @value: Value being written.
  *
@@ -107,7 +109,7 @@ void qtest_outl(QTestState *s, uint16_t addr, uint32_t value);
 
 /**
  * qtest_inb:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to read from.
  *
  * Returns an 8-bit value from an I/O port.
@@ -116,7 +118,7 @@ uint8_t qtest_inb(QTestState *s, uint16_t addr);
 
 /**
  * qtest_inw:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to read from.
  *
  * Returns a 16-bit value from an I/O port.
@@ -125,7 +127,7 @@ uint16_t qtest_inw(QTestState *s, uint16_t addr);
 
 /**
  * qtest_inl:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: I/O port to read from.
  *
  * Returns a 32-bit value from an I/O port.
@@ -134,7 +136,7 @@ uint32_t qtest_inl(QTestState *s, uint16_t addr);
 
 /**
  * qtest_memread:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: Guest address to read from.
  * @data: Pointer to where memory contents will be stored.
  * @size: Number of bytes to read.
@@ -145,7 +147,7 @@ void qtest_memread(QTestState *s, uint64_t addr, void *data, size_t size);
 
 /**
  * qtest_memwrite:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
  * @addr: Guest address to write to.
  * @data: Pointer to the bytes that will be written to guest memory.
  * @size: Number of bytes to write.
@@ -156,10 +158,11 @@ void qtest_memwrite(QTestState *s, uint64_t addr, const void *data, size_t size)
 
 /**
  * qtest_clock_step_next:
- * @s: QTestState instance to operate on.
+ * @s: #QTestState instance to operate on.
+ *
+ * Advance the vm_clock to the next deadline.
  *
- * Advance the vm_clock to the next deadline.  Return the current
- * value of the vm_clock in nanoseconds.
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
 int64_t qtest_clock_step_next(QTestState *s);
 
@@ -168,8 +171,9 @@ int64_t qtest_clock_step_next(QTestState *s);
  * @s: QTestState instance to operate on.
  * @step: Number of nanoseconds to advance the clock by.
  *
- * Advance the vm_clock by @step nanoseconds.  Return the current
- * value of the vm_clock in nanoseconds.
+ * Advance the vm_clock by @step nanoseconds.
+ *
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
 int64_t qtest_clock_step(QTestState *s, int64_t step);
 
@@ -179,14 +183,15 @@ int64_t qtest_clock_step(QTestState *s, int64_t step);
  * @val: Nanoseconds value to advance the clock to.
  *
  * Advance the vm_clock to @val nanoseconds since the VM was launched.
- * Return the current value of the vm_clock in nanoseconds.
+ *
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
 int64_t qtest_clock_set(QTestState *s, int64_t val);
 
 /**
  * qtest_get_arch:
  *
- * Returns the architecture for the QEMU executable under test.
+ * Returns: The architecture for the QEMU executable under test.
  */
 const char *qtest_get_arch(void);
 
@@ -197,7 +202,7 @@ const char *qtest_get_arch(void);
  *
  * Add a GTester testcase with the given name and function.
  * The path is prefixed with the architecture under test, as
- * returned by qtest_get_arch.
+ * returned by qtest_get_arch().
  */
 void qtest_add_func(const char *str, void (*fn));
 
@@ -205,12 +210,16 @@ void qtest_add_func(const char *str, void (*fn));
  * qtest_start:
  * @args: other arguments to pass to QEMU
  *
- * Start QEMU and assign the resulting QTestState to a global variable.
- * The global variable is used by "shortcut" macros documented below.
+ * Start QEMU and assign the resulting #QTestState to a global variable.
+ * The global variable is used by "shortcut" functions documented below.
+ *
+ * Returns: #QTestState instance.
  */
-#define qtest_start(args) (            \
-    global_qtest = qtest_init((args)) \
-        )
+static inline QTestState *qtest_start(const char *args)
+{
+    global_qtest = qtest_init(args);
+    return global_qtest;
+}
 
 /**
  * qmp:
@@ -224,9 +233,12 @@ void qtest_add_func(const char *str, void (*fn));
  * get_irq:
  * @num: Interrupt to observe.
  *
- * Return the level of the @num interrupt.
+ * Returns: The level of the @num interrupt.
  */
-#define get_irq(num) qtest_get_irq(global_qtest, num)
+static inline bool get_irq(int num)
+{
+    return qtest_get_irq(global_qtest, num);
+}
 
 /**
  * irq_intercept_in:
@@ -235,7 +247,10 @@ void qtest_add_func(const char *str, void (*fn));
  * Associate qtest irqs with the GPIO-in pins of the device
  * whose path is specified by @string.
  */
-#define irq_intercept_in(string) qtest_irq_intercept_in(global_qtest, string)
+static inline void irq_intercept_in(const char *string)
+{
+    qtest_irq_intercept_in(global_qtest, string);
+}
 
 /**
  * qtest_irq_intercept_out:
@@ -244,7 +259,10 @@ void qtest_add_func(const char *str, void (*fn));
  * Associate qtest irqs with the GPIO-out pins of the device
  * whose path is specified by @string.
  */
-#define irq_intercept_out(string) qtest_irq_intercept_out(global_qtest, string)
+static inline void irq_intercept_out(const char *string)
+{
+    qtest_irq_intercept_out(global_qtest, string);
+}
 
 /**
  * outb:
@@ -253,7 +271,10 @@ void qtest_add_func(const char *str, void (*fn));
  *
  * Write an 8-bit value to an I/O port.
  */
-#define outb(addr, val) qtest_outb(global_qtest, addr, val)
+static inline void outb(uint16_t addr, uint8_t value)
+{
+    qtest_outb(global_qtest, addr, value);
+}
 
 /**
  * outw:
@@ -262,7 +283,10 @@ void qtest_add_func(const char *str, void (*fn));
  *
  * Write a 16-bit value to an I/O port.
  */
-#define outw(addr, val) qtest_outw(global_qtest, addr, val)
+static inline void outw(uint16_t addr, uint16_t value)
+{
+    qtest_outw(global_qtest, addr, value);
+}
 
 /**
  * outl:
@@ -271,31 +295,49 @@ void qtest_add_func(const char *str, void (*fn));
  *
  * Write a 32-bit value to an I/O port.
  */
-#define outl(addr, val) qtest_outl(global_qtest, addr, val)
+static inline void outl(uint16_t addr, uint32_t value)
+{
+    qtest_outl(global_qtest, addr, value);
+}
 
 /**
  * inb:
  * @addr: I/O port to read from.
  *
- * Returns an 8-bit value from an I/O port.
+ * Reads an 8-bit value from an I/O port.
+ *
+ * Returns: Value read.
  */
-#define inb(addr) qtest_inb(global_qtest, addr)
+static inline uint8_t inb(uint16_t addr)
+{
+    return qtest_inb(global_qtest, addr);
+}
 
 /**
  * inw:
  * @addr: I/O port to read from.
  *
- * Returns a 16-bit value from an I/O port.
+ * Reads a 16-bit value from an I/O port.
+ *
+ * Returns: Value read.
  */
-#define inw(addr) qtest_inw(global_qtest, addr)
+static inline uint16_t inw(uint16_t addr)
+{
+    return qtest_inw(global_qtest, addr);
+}
 
 /**
  * inl:
  * @addr: I/O port to read from.
  *
- * Returns a 32-bit value from an I/O port.
+ * Reads a 32-bit value from an I/O port.
+ *
+ * Returns: Value read.
  */
-#define inl(addr) qtest_inl(global_qtest, addr)
+static inline uint32_t inl(uint16_t addr)
+{
+    return qtest_inl(global_qtest, addr);
+}
 
 /**
  * memread:
@@ -305,7 +347,10 @@ void qtest_add_func(const char *str, void (*fn));
  *
  * Read guest memory into a buffer.
  */
-#define memread(addr, data, size) qtest_memread(global_qtest, addr, data, size)
+static inline void memread(uint64_t addr, void *data, size_t size)
+{
+    qtest_memread(global_qtest, addr, data, size);
+}
 
 /**
  * memwrite:
@@ -315,32 +360,47 @@ void qtest_add_func(const char *str, void (*fn));
  *
  * Write a buffer to guest memory.
  */
-#define memwrite(addr, data, size) qtest_memwrite(global_qtest, addr, data, size)
+static inline void memwrite(uint64_t addr, const void *data, size_t size)
+{
+    qtest_memwrite(global_qtest, addr, data, size);
+}
 
 /**
  * clock_step_next:
  *
- * Advance the vm_clock to the next deadline.  Return the current
- * value of the vm_clock in nanoseconds.
+ * Advance the vm_clock to the next deadline.
+ *
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
-#define clock_step_next() qtest_clock_step_next(global_qtest)
+static inline int64_t clock_step_next(void)
+{
+    return qtest_clock_step_next(global_qtest);
+}
 
 /**
  * clock_step:
  * @step: Number of nanoseconds to advance the clock by.
  *
- * Advance the vm_clock by @step nanoseconds.  Return the current
- * value of the vm_clock in nanoseconds.
+ * Advance the vm_clock by @step nanoseconds.
+ *
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
-#define clock_step(step) qtest_clock_step(global_qtest, step)
+static inline int64_t clock_step(int64_t step)
+{
+    return qtest_clock_step(global_qtest, step);
+}
 
 /**
  * clock_set:
  * @val: Nanoseconds value to advance the clock to.
  *
  * Advance the vm_clock to @val nanoseconds since the VM was launched.
- * Return the current value of the vm_clock in nanoseconds.
+ *
+ * Returns: The current value of the vm_clock in nanoseconds.
  */
-#define clock_set(val) qtest_clock_set(global_qtest, val)
+static inline int64_t clock_set(int64_t val)
+{
+    return qtest_clock_set(global_qtest, val);
+}
 
 #endif
commit 3c3adde005ec929d7d581d495d9a0bb223e6e055
Merge: f4c0f98 2d64255
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Feb 18 08:37:29 2013 -0600

    Merge remote-tracking branch 'afaerber/qom-cpu' into staging
    
    # By Andreas Färber
    # Via Andreas Färber
    * afaerber/qom-cpu: (47 commits)
      target-i386: Split command line parsing out of cpu_x86_register()
      target-i386: Move cpu_x86_init()
      target-lm32: Drop unused cpu_lm32_close() prototype
      target-s390x: Drop unused cpu_s390x_close() prototype
      spapr_hcall: Replace open-coded CPU loop with qemu_get_cpu()
      ppce500_spin: Replace open-coded CPU loop with qemu_get_cpu()
      e500: Replace open-coded loop with qemu_get_cpu()
      cpu: Add CPUArchState pointer to CPUState
      cputlb: Pass CPUState to cpu_unlink_tb()
      cpu: Move current_tb field to CPUState
      cpu: Move exit_request field to CPUState
      cpu: Move running field to CPUState
      cpu: Move host_tid field to CPUState
      target-cris: Introduce CRISCPU subclasses
      target-m68k: Pass M68kCPU to m68k_set_irq_level()
      mcf_intc: Pass M68kCPU to mcf_intc_init()
      mcf5206: Pass M68kCPU to mcf5206_init()
      target-m68k: Return M68kCPU from cpu_m68k_init()
      ppc405_uc: Pass PowerPCCPU to ppc40x_{core,chip,system}_reset()
      target-xtensa: Move TCG initialization to XtensaCPU initfn
      ...

commit f4c0f986c061f34fd5b020c30e2aa8c37e17193b
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Feb 16 12:47:01 2013 -0800

    tests: Add unit tests for mulu64 and muls64
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/tests/Makefile b/tests/Makefile
index a2d62b8..567e36e 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -54,6 +54,8 @@ check-unit-y += tests/test-xbzrle$(EXESUF)
 gcov-files-test-xbzrle-y = xbzrle.c
 check-unit-y += tests/test-cutils$(EXESUF)
 gcov-files-test-cutils-y += util/cutils.c
+check-unit-y += tests/test-mul64$(EXESUF)
+gcov-files-test-mul64-y = util/host-utils.c
 
 check-block-$(CONFIG_POSIX) += tests/qemu-iotests-quick.sh
 
@@ -82,7 +84,7 @@ test-obj-y = tests/check-qint.o tests/check-qstring.o tests/check-qdict.o \
 	tests/test-string-input-visitor.o tests/test-qmp-output-visitor.o \
 	tests/test-qmp-input-visitor.o tests/test-qmp-input-strict.o \
 	tests/test-qmp-commands.o tests/test-visitor-serialization.o \
-	tests/test-x86-cpuid.o
+	tests/test-x86-cpuid.o tests/test-mul64.o
 
 test-qapi-obj-y = tests/test-qapi-visit.o tests/test-qapi-types.o
 
@@ -124,6 +126,8 @@ tests/test-qmp-input-strict$(EXESUF): tests/test-qmp-input-strict.o $(test-qapi-
 tests/test-qmp-commands$(EXESUF): tests/test-qmp-commands.o tests/test-qmp-marshal.o $(test-qapi-obj-y) qapi-types.o qapi-visit.o libqemuutil.a libqemustub.a
 tests/test-visitor-serialization$(EXESUF): tests/test-visitor-serialization.o $(test-qapi-obj-y) libqemuutil.a libqemustub.a
 
+tests/test-mul64$(EXESUF): tests/test-mul64.o libqemuutil.a
+
 tests/rtc-test$(EXESUF): tests/rtc-test.o
 tests/m48t59-test$(EXESUF): tests/m48t59-test.o
 tests/fdc-test$(EXESUF): tests/fdc-test.o
diff --git a/tests/test-mul64.c b/tests/test-mul64.c
new file mode 100644
index 0000000..a0a17f7
--- /dev/null
+++ b/tests/test-mul64.c
@@ -0,0 +1,70 @@
+/*
+ * Test 64x64 -> 128 multiply subroutines
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include <glib.h>
+#include <stdint.h>
+#include "qemu/host-utils.h"
+#include "qemu/osdep.h"
+
+
+typedef struct {
+    uint64_t a, b;
+    uint64_t rh, rl;
+} Test;
+
+static const Test test_u_data[] = {
+    { 1, 1, 0, 1 },
+    { 10000, 10000, 0, 100000000 },
+    { 0xffffffffffffffffULL, 2, 1, 0xfffffffffffffffeULL },
+    { 0xffffffffffffffffULL, 0xffffffffffffffffULL,
+      0xfffffffffffffffeULL, 0x0000000000000001ULL },
+    { 0x1122334455667788ull, 0x8877665544332211ull,
+      0x092228fb777ae38full, 0x0a3e963337c60008ull },
+};
+
+static const Test test_s_data[] = {
+    { 1, 1, 0, 1 },
+    { 1, -1, -1, -1 },
+    { -10, -10, 0, 100 },
+    { 10000, 10000, 0, 100000000 },
+    { -1, 2, -1, -2 },
+    { 0x1122334455667788ULL, 0x1122334455667788ULL,
+      0x01258f60bbc2975cULL, 0x1eace4a3c82fb840ULL },
+};
+
+static void test_u(void)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(test_u_data); ++i) {
+        uint64_t rl, rh;
+        mulu64(&rl, &rh, test_u_data[i].a, test_u_data[i].b);
+        g_assert_cmpuint(rl, ==, test_u_data[i].rl);
+        g_assert_cmpuint(rh, ==, test_u_data[i].rh);
+    }
+}
+
+static void test_s(void)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(test_s_data); ++i) {
+        uint64_t rl, rh;
+        muls64(&rl, &rh, test_s_data[i].a, test_s_data[i].b);
+        g_assert_cmpuint(rl, ==, test_s_data[i].rl);
+        g_assert_cmpint(rh, ==, test_s_data[i].rh);
+    }
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+    g_test_add_func("/host-utils/mulu64", test_u);
+    g_test_add_func("/host-utils/muls64", test_s);
+    return g_test_run();
+}
commit ff7a1eb0a1262f7d451cc1e70c65dd23771ce2a2
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Feb 16 12:47:00 2013 -0800

    host-utils: Improve mulu64 and muls64
    
    The new formulation makes better use of add-with-carry type insns
    that the host may have.  Use gcc's sign adjustment trick to avoid
    having to perform a 128-bit negation.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/util/host-utils.c b/util/host-utils.c
index 2d06a2c..f0784d6 100644
--- a/util/host-utils.c
+++ b/util/host-utils.c
@@ -27,79 +27,63 @@
 #include <stdint.h>
 #include "qemu/host-utils.h"
 
-//#define DEBUG_MULDIV
-
 /* Long integer helpers */
 #ifndef CONFIG_INT128
-static void add128 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
-{
-    *plow += a;
-    /* carry test */
-    if (*plow < a)
-        (*phigh)++;
-    *phigh += b;
-}
-
-static void neg128 (uint64_t *plow, uint64_t *phigh)
+static inline void mul64(uint64_t *plow, uint64_t *phigh,
+                         uint64_t a, uint64_t b)
 {
-    *plow = ~*plow;
-    *phigh = ~*phigh;
-    add128(plow, phigh, 1, 0);
-}
-
-static void mul64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
-{
-    uint32_t a0, a1, b0, b1;
-    uint64_t v;
-
-    a0 = a;
-    a1 = a >> 32;
-
-    b0 = b;
-    b1 = b >> 32;
+    typedef union {
+        uint64_t ll;
+        struct {
+#ifdef HOST_WORDS_BIGENDIAN
+            uint32_t high, low;
+#else
+            uint32_t low, high;
+#endif
+        } l;
+    } LL;
+    LL rl, rm, rn, rh, a0, b0;
+    uint64_t c;
 
-    v = (uint64_t)a0 * (uint64_t)b0;
-    *plow = v;
-    *phigh = 0;
+    a0.ll = a;
+    b0.ll = b;
 
-    v = (uint64_t)a0 * (uint64_t)b1;
-    add128(plow, phigh, v << 32, v >> 32);
+    rl.ll = (uint64_t)a0.l.low * b0.l.low;
+    rm.ll = (uint64_t)a0.l.low * b0.l.high;
+    rn.ll = (uint64_t)a0.l.high * b0.l.low;
+    rh.ll = (uint64_t)a0.l.high * b0.l.high;
 
-    v = (uint64_t)a1 * (uint64_t)b0;
-    add128(plow, phigh, v << 32, v >> 32);
+    c = (uint64_t)rl.l.high + rm.l.low + rn.l.low;
+    rl.l.high = c;
+    c >>= 32;
+    c = c + rm.l.high + rn.l.high + rh.l.low;
+    rh.l.low = c;
+    rh.l.high += (uint32_t)(c >> 32);
 
-    v = (uint64_t)a1 * (uint64_t)b1;
-    *phigh += v;
+    *plow = rl.ll;
+    *phigh = rh.ll;
 }
 
 /* Unsigned 64x64 -> 128 multiplication */
 void mulu64 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
 {
     mul64(plow, phigh, a, b);
-#if defined(DEBUG_MULDIV)
-    printf("mulu64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
-           a, b, *phigh, *plow);
-#endif
 }
 
 /* Signed 64x64 -> 128 multiplication */
 void muls64 (uint64_t *plow, uint64_t *phigh, int64_t a, int64_t b)
 {
-    int sa, sb;
+    uint64_t rh;
 
-    sa = (a < 0);
-    if (sa)
-        a = -a;
-    sb = (b < 0);
-    if (sb)
-        b = -b;
-    mul64(plow, phigh, a, b);
-    if (sa ^ sb) {
-        neg128(plow, phigh);
+    mul64(plow, &rh, a, b);
+
+    /* Adjust for signs.  */
+    if (b < 0) {
+        rh -= a;
     }
-#if defined(DEBUG_MULDIV)
-    printf("muls64: 0x%016llx * 0x%016llx = 0x%016llx%016llx\n",
-           a, b, *phigh, *plow);
-#endif
+    if (a < 0) {
+        rh -= b;
+    }
+    *phigh = rh;
 }
 #endif /* !CONFIG_INT128 */
commit f540166b7dfdf4ec2057ac322d8cbfd0691e1d65
Author: Richard Henderson <rth at twiddle.net>
Date:   Sat Feb 16 12:46:59 2013 -0800

    host-utils: Use __int128_t for mul[us]64
    
    Replace some x86_64 specific inline assembly with something that
    all 64-bit hosts ought to optimize well.  At worst this becomes
    a call to the gcc __multi3 routine, which is no worse than our
    implementation in util/host-utils.c.
    
    With gcc 4.7, we get identical code generation for x86_64.  We
    now get native multiplication on ia64 and s390x hosts.  With minor
    improvements to gcc we can get it for ppc64 as well.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/configure b/configure
index 8789324..bf5970f 100755
--- a/configure
+++ b/configure
@@ -3150,6 +3150,22 @@ if compile_prog "" "" ; then
     cpuid_h=yes
 fi
 
+########################################
+# check if __[u]int128_t is usable.
+
+int128=no
+cat > $TMPC << EOF
+__int128_t a;
+__uint128_t b;
+int main (void) {
+  a = a + b;
+  b = a * b;
+  return 0;
+}
+EOF
+if compile_prog "" "" ; then
+    int128=yes
+fi
 
 ##########################################
 # End of CC checks
@@ -3692,6 +3708,10 @@ if test "$cpuid_h" = "yes" ; then
   echo "CONFIG_CPUID_H=y" >> $config_host_mak
 fi
 
+if test "$int128" = "yes" ; then
+  echo "CONFIG_INT128=y" >> $config_host_mak
+fi
+
 if test "$glusterfs" = "yes" ; then
   echo "CONFIG_GLUSTERFS=y" >> $config_host_mak
 fi
diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index f0dd850..0f688c1 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -28,22 +28,21 @@
 #include "qemu/compiler.h"   /* QEMU_GNUC_PREREQ */
 #include <limits.h>
 
-#if defined(__x86_64__)
-#define __HAVE_FAST_MULU64__
+#ifdef CONFIG_INT128
 static inline void mulu64(uint64_t *plow, uint64_t *phigh,
                           uint64_t a, uint64_t b)
 {
-    __asm__ ("mul %0\n\t"
-             : "=d" (*phigh), "=a" (*plow)
-             : "a" (a), "0" (b));
+    __uint128_t r = (__uint128_t)a * b;
+    *plow = r;
+    *phigh = r >> 64;
 }
-#define __HAVE_FAST_MULS64__
+
 static inline void muls64(uint64_t *plow, uint64_t *phigh,
                           int64_t a, int64_t b)
 {
-    __asm__ ("imul %0\n\t"
-             : "=d" (*phigh), "=a" (*plow)
-             : "a" (a), "0" (b));
+    __int128_t r = (__int128_t)a * b;
+    *plow = r;
+    *phigh = r >> 64;
 }
 #else
 void muls64(uint64_t *phigh, uint64_t *plow, int64_t a, int64_t b);
diff --git a/util/host-utils.c b/util/host-utils.c
index 5e3915a..2d06a2c 100644
--- a/util/host-utils.c
+++ b/util/host-utils.c
@@ -30,7 +30,7 @@
 //#define DEBUG_MULDIV
 
 /* Long integer helpers */
-#if !defined(__x86_64__)
+#ifndef CONFIG_INT128
 static void add128 (uint64_t *plow, uint64_t *phigh, uint64_t a, uint64_t b)
 {
     *plow += a;
@@ -102,4 +102,4 @@ void muls64 (uint64_t *plow, uint64_t *phigh, int64_t a, int64_t b)
            a, b, *phigh, *plow);
 #endif
 }
-#endif /* !defined(__x86_64__) */
+#endif /* !CONFIG_INT128 */
commit be96bd3fbffde908a392c830c856063e122791c1
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Sat Feb 16 23:21:24 2013 +0100

    tcg/ppc: Fix build of tcg_qemu_tb_exec()
    
    Commit 0b0d3320db74cde233ee7855ad32a9c121d20eb4 (TCG: Final globals
    clean-up) moved code_gen_prologue but forgot to update ppc code.
    This broke the build on 32-bit ppc. ppc64 is unaffected.
    
    Cc: Evgeny Voevodin <evgenyvoevodin at gmail.com>
    Cc: Blue Swirl <blauwirbel at gmail.com>
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/tcg/ppc/tcg-target.h b/tcg/ppc/tcg-target.h
index ea26769..0fdad04 100644
--- a/tcg/ppc/tcg-target.h
+++ b/tcg/ppc/tcg-target.h
@@ -99,6 +99,6 @@ typedef enum {
 
 #define tcg_qemu_tb_exec(env, tb_ptr) \
     ((long __attribute__ ((longcall)) \
-      (*)(void *, void *))code_gen_prologue)(env, tb_ptr)
+      (*)(void *, void *))tcg_ctx.code_gen_prologue)(env, tb_ptr)
 
 #endif
commit 05499f4b9fd431631299dc1b70156dbc1fb43318
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 27 14:32:05 2013 +0100

    target-sparc: Fix debug output for DEBUG_MMU
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/target-sparc/ldst_helper.c b/target-sparc/ldst_helper.c
index cf1bddf..7decd66 100644
--- a/target-sparc/ldst_helper.c
+++ b/target-sparc/ldst_helper.c
@@ -1850,7 +1850,7 @@ void helper_st_asi(CPUSPARCState *env, target_ulong addr, target_ulong val,
                 DPRINTF_MMU("LSU change: 0x%" PRIx64 " -> 0x%" PRIx64 "\n",
                             oldreg, env->lsu);
 #ifdef DEBUG_MMU
-                dump_mmu(stdout, fprintf, env1);
+                dump_mmu(stdout, fprintf, env);
 #endif
                 tlb_flush(env, 1);
             }
commit 2d64255bd7c0d3933ff5ab2cabff11bcb09117a8
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 15 14:06:56 2013 +0100

    target-i386: Split command line parsing out of cpu_x86_register()
    
    In order to instantiate a CPU subtype we will need to know which type,
    so move the cpu_model splitting into cpu_x86_init().
    
    Parameters need to be set on the X86CPU instance, so move
    cpu_x86_parse_featurestr() into cpu_x86_init() as well.
    
    This leaves cpu_x86_register() operating on the model name only.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/pc.c b/hw/pc.c
index 53cc173..07caba7 100644
--- a/hw/pc.c
+++ b/hw/pc.c
@@ -876,7 +876,6 @@ void pc_cpus_init(const char *cpu_model)
 
     for (i = 0; i < smp_cpus; i++) {
         if (!cpu_x86_init(cpu_model)) {
-            fprintf(stderr, "Unable to find x86 CPU definition\n");
             exit(1);
         }
     }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 462d6c9..dfcf86e 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1516,27 +1516,16 @@ static void filter_features_for_kvm(X86CPU *cpu)
 }
 #endif
 
-static int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
+static void cpu_x86_register(X86CPU *cpu, const char *name, Error **errp)
 {
     CPUX86State *env = &cpu->env;
     x86_def_t def1, *def = &def1;
-    Error *error = NULL;
-    char *name, *features;
-    gchar **model_pieces;
 
     memset(def, 0, sizeof(*def));
 
-    model_pieces = g_strsplit(cpu_model, ",", 2);
-    if (!model_pieces[0]) {
-        error_setg(&error, "Invalid/empty CPU model name");
-        goto out;
-    }
-    name = model_pieces[0];
-    features = model_pieces[1];
-
     if (cpu_x86_find_by_name(def, name) < 0) {
-        error_setg(&error, "Unable to find CPU definition: %s", name);
-        goto out;
+        error_setg(errp, "Unable to find CPU definition: %s", name);
+        return;
     }
 
     if (kvm_enabled()) {
@@ -1544,58 +1533,69 @@ static int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
     }
     def->ext_features |= CPUID_EXT_HYPERVISOR;
 
-    object_property_set_str(OBJECT(cpu), def->vendor, "vendor", &error);
-    object_property_set_int(OBJECT(cpu), def->level, "level", &error);
-    object_property_set_int(OBJECT(cpu), def->family, "family", &error);
-    object_property_set_int(OBJECT(cpu), def->model, "model", &error);
-    object_property_set_int(OBJECT(cpu), def->stepping, "stepping", &error);
+    object_property_set_str(OBJECT(cpu), def->vendor, "vendor", errp);
+    object_property_set_int(OBJECT(cpu), def->level, "level", errp);
+    object_property_set_int(OBJECT(cpu), def->family, "family", errp);
+    object_property_set_int(OBJECT(cpu), def->model, "model", errp);
+    object_property_set_int(OBJECT(cpu), def->stepping, "stepping", errp);
     env->cpuid_features = def->features;
     env->cpuid_ext_features = def->ext_features;
     env->cpuid_ext2_features = def->ext2_features;
     env->cpuid_ext3_features = def->ext3_features;
-    object_property_set_int(OBJECT(cpu), def->xlevel, "xlevel", &error);
+    object_property_set_int(OBJECT(cpu), def->xlevel, "xlevel", errp);
     env->cpuid_kvm_features = def->kvm_features;
     env->cpuid_svm_features = def->svm_features;
     env->cpuid_ext4_features = def->ext4_features;
     env->cpuid_7_0_ebx_features = def->cpuid_7_0_ebx_features;
     env->cpuid_xlevel2 = def->xlevel2;
 
-    object_property_set_str(OBJECT(cpu), def->model_id, "model-id", &error);
-    if (error) {
-        goto out;
-    }
-
-    cpu_x86_parse_featurestr(cpu, features, &error);
-out:
-    g_strfreev(model_pieces);
-    if (error) {
-        fprintf(stderr, "%s\n", error_get_pretty(error));
-        error_free(error);
-        return -1;
-    }
-    return 0;
+    object_property_set_str(OBJECT(cpu), def->model_id, "model-id", errp);
 }
 
 X86CPU *cpu_x86_init(const char *cpu_model)
 {
-    X86CPU *cpu;
+    X86CPU *cpu = NULL;
     CPUX86State *env;
+    gchar **model_pieces;
+    char *name, *features;
     Error *error = NULL;
 
+    model_pieces = g_strsplit(cpu_model, ",", 2);
+    if (!model_pieces[0]) {
+        error_setg(&error, "Invalid/empty CPU model name");
+        goto out;
+    }
+    name = model_pieces[0];
+    features = model_pieces[1];
+
     cpu = X86_CPU(object_new(TYPE_X86_CPU));
     env = &cpu->env;
     env->cpu_model_str = cpu_model;
 
-    if (cpu_x86_register(cpu, cpu_model) < 0) {
-        object_unref(OBJECT(cpu));
-        return NULL;
+    cpu_x86_register(cpu, name, &error);
+    if (error) {
+        goto out;
+    }
+
+    cpu_x86_parse_featurestr(cpu, features, &error);
+    if (error) {
+        goto out;
     }
 
     object_property_set_bool(OBJECT(cpu), true, "realized", &error);
     if (error) {
+        goto out;
+    }
+
+out:
+    g_strfreev(model_pieces);
+    if (error) {
+        fprintf(stderr, "%s\n", error_get_pretty(error));
         error_free(error);
-        object_unref(OBJECT(cpu));
-        return NULL;
+        if (cpu != NULL) {
+            object_unref(OBJECT(cpu));
+            cpu = NULL;
+        }
     }
     return cpu;
 }
commit 5c3c6a682dedb3ef6becf112867cf92abf203816
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 1 15:12:13 2013 +0100

    target-i386: Move cpu_x86_init()
    
    Consolidate CPU functions in cpu.c.
    Allows to make cpu_x86_register() static.
    
    No functional changes.
    
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 635f334..462d6c9 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1516,7 +1516,7 @@ static void filter_features_for_kvm(X86CPU *cpu)
 }
 #endif
 
-int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
+static int cpu_x86_register(X86CPU *cpu, const char *cpu_model)
 {
     CPUX86State *env = &cpu->env;
     x86_def_t def1, *def = &def1;
@@ -1576,6 +1576,30 @@ out:
     return 0;
 }
 
+X86CPU *cpu_x86_init(const char *cpu_model)
+{
+    X86CPU *cpu;
+    CPUX86State *env;
+    Error *error = NULL;
+
+    cpu = X86_CPU(object_new(TYPE_X86_CPU));
+    env = &cpu->env;
+    env->cpu_model_str = cpu_model;
+
+    if (cpu_x86_register(cpu, cpu_model) < 0) {
+        object_unref(OBJECT(cpu));
+        return NULL;
+    }
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", &error);
+    if (error) {
+        error_free(error);
+        object_unref(OBJECT(cpu));
+        return NULL;
+    }
+    return cpu;
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 void cpu_clear_apic_feature(CPUX86State *env)
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 9e6e1a6..7577e4f 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -1002,7 +1002,6 @@ int cpu_x86_signal_handler(int host_signum, void *pinfo,
 void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                    uint32_t *eax, uint32_t *ebx,
                    uint32_t *ecx, uint32_t *edx);
-int cpu_x86_register(X86CPU *cpu, const char *cpu_model);
 void cpu_clear_apic_feature(CPUX86State *env);
 void host_cpuid(uint32_t function, uint32_t count,
                 uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx);
diff --git a/target-i386/helper.c b/target-i386/helper.c
index 1a872fa..4bf9db7 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1267,30 +1267,6 @@ int cpu_x86_get_descr_debug(CPUX86State *env, unsigned int selector,
     return 1;
 }
 
-X86CPU *cpu_x86_init(const char *cpu_model)
-{
-    X86CPU *cpu;
-    CPUX86State *env;
-    Error *error = NULL;
-
-    cpu = X86_CPU(object_new(TYPE_X86_CPU));
-    env = &cpu->env;
-    env->cpu_model_str = cpu_model;
-
-    if (cpu_x86_register(cpu, cpu_model) < 0) {
-        object_unref(OBJECT(cpu));
-        return NULL;
-    }
-
-    object_property_set_bool(OBJECT(cpu), true, "realized", &error);
-    if (error) {
-        error_free(error);
-        object_unref(OBJECT(cpu));
-        return NULL;
-    }
-    return cpu;
-}
-
 #if !defined(CONFIG_USER_ONLY)
 void do_cpu_init(X86CPU *cpu)
 {
commit 0203f86f5205e09a56df41021d872c6353754250
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 2 12:13:15 2013 +0100

    target-lm32: Drop unused cpu_lm32_close() prototype
    
    It was never implemented.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-lm32/cpu.h b/target-lm32/cpu.h
index 4e202db..6948d0e 100644
--- a/target-lm32/cpu.h
+++ b/target-lm32/cpu.h
@@ -189,7 +189,6 @@ struct CPULM32State {
 LM32CPU *cpu_lm32_init(const char *cpu_model);
 void cpu_lm32_list(FILE *f, fprintf_function cpu_fprintf);
 int cpu_lm32_exec(CPULM32State *s);
-void cpu_lm32_close(CPULM32State *s);
 void do_interrupt(CPULM32State *env);
 /* you can call this signal handler from your SIGBUS and SIGSEGV
    signal handlers to inform the virtual CPU of exceptions. non zero
commit 0dac84597a66eb8f416972faef451ce786b3cdd4
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Feb 2 12:10:37 2013 +0100

    target-s390x: Drop unused cpu_s390x_close() prototype
    
    It was never implemented.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index fa8dfe0..e450db7 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -315,7 +315,6 @@ static inline int get_ilen(uint8_t opc)
 S390CPU *cpu_s390x_init(const char *cpu_model);
 void s390x_translate_init(void);
 int cpu_s390x_exec(CPUS390XState *s);
-void cpu_s390x_close(CPUS390XState *s);
 void do_interrupt (CPUS390XState *env);
 
 /* you can call this signal handler from your SIGBUS and SIGSEGV
commit 5353d03dd7917875b46ff03e0d9e2935770f5e9d
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 15 16:43:08 2013 +0100

    spapr_hcall: Replace open-coded CPU loop with qemu_get_cpu()
    
    The helper functions all access ppc-specific fields only so don't bother
    to change arguments to PowerPCCPU and use env_ptr instead.
    
    No functional change.
    
    Acked-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index af1db6e..7b89594 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -469,16 +469,11 @@ static target_ulong h_register_vpa(PowerPCCPU *cpu, sPAPREnvironment *spapr,
     CPUPPCState *tenv;
     CPUState *tcpu;
 
-    for (tenv = first_cpu; tenv; tenv = tenv->next_cpu) {
-        tcpu = CPU(ppc_env_get_cpu(tenv));
-        if (tcpu->cpu_index == procno) {
-            break;
-        }
-    }
-
-    if (!tenv) {
+    tcpu = qemu_get_cpu(procno);
+    if (!tcpu) {
         return H_PARAMETER;
     }
+    tenv = tcpu->env_ptr;
 
     switch (flags) {
     case FLAGS_REGISTER_VPA:
commit 912ebe10eff6cf7e05f908a44283033c1c0270a0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 15 15:56:27 2013 +0100

    ppce500_spin: Replace open-coded CPU loop with qemu_get_cpu()
    
    Potentially env could be NULL whereas cpu would still be valid and
    correspond to a previous env.
    
    Wrapping this in qemu_get_cpu(), env is no longer needed, so simplify
    code that existed before 55e5c2850293547203874098f7cec148ffd12dfa.
    
    Acked-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppce500_spin.c b/hw/ppce500_spin.c
index 7e90fb9..5bdce52 100644
--- a/hw/ppce500_spin.c
+++ b/hw/ppce500_spin.c
@@ -123,18 +123,11 @@ static void spin_write(void *opaque, hwaddr addr, uint64_t value,
 {
     SpinState *s = opaque;
     int env_idx = addr / sizeof(SpinInfo);
-    CPUPPCState *env;
-    CPUState *cpu = NULL;
+    CPUState *cpu;
     SpinInfo *curspin = &s->spin[env_idx];
     uint8_t *curspin_p = (uint8_t*)curspin;
 
-    for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        cpu = CPU(ppc_env_get_cpu(env));
-        if (cpu->cpu_index == env_idx) {
-            break;
-        }
-    }
-
+    cpu = qemu_get_cpu(env_idx);
     if (cpu == NULL) {
         /* Unknown CPU */
         return;
@@ -161,11 +154,11 @@ static void spin_write(void *opaque, hwaddr addr, uint64_t value,
     if (!(ldq_p(&curspin->addr) & 1)) {
         /* run CPU */
         SpinKick kick = {
-            .cpu = ppc_env_get_cpu(env),
+            .cpu = POWERPC_CPU(cpu),
             .spin = curspin,
         };
 
-        run_on_cpu(CPU(kick.cpu), spin_kick, &kick);
+        run_on_cpu(cpu, spin_kick, &kick);
     }
 }
 
commit 440c8152bd410b0f928d4de6f187f1e2280e1324
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Feb 15 15:21:13 2013 +0100

    e500: Replace open-coded loop with qemu_get_cpu()
    
    Since we still need env for ppc-specific fields, obtain it via the new
    env_ptr fields to avoid "cpu" name conflicts between CPUState and
    PowerPCCPU for now.
    
    This fixes a potential issue with env being NULL at the end of the loop
    but cpu still being a valid pointer corresponding to a previous env.
    
    Acked-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index b7474c0..451682c 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -240,20 +240,15 @@ static int ppce500_load_device_tree(CPUPPCState *env,
     /* We need to generate the cpu nodes in reverse order, so Linux can pick
        the first node as boot node and be happy */
     for (i = smp_cpus - 1; i >= 0; i--) {
-        CPUState *cpu = NULL;
+        CPUState *cpu;
         char cpu_name[128];
         uint64_t cpu_release_addr = MPC8544_SPIN_BASE + (i * 0x20);
 
-        for (env = first_cpu; env != NULL; env = env->next_cpu) {
-            cpu = ENV_GET_CPU(env);
-            if (cpu->cpu_index == i) {
-                break;
-            }
-        }
-
+        cpu = qemu_get_cpu(i);
         if (cpu == NULL) {
             continue;
         }
+        env = cpu->env_ptr;
 
         snprintf(cpu_name, sizeof(cpu_name), "/cpus/PowerPC,8544@%x",
                  cpu->cpu_index);
commit c05efcb18ee30cdf2b00b3512aa0f5233b52911f
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jan 17 12:13:41 2013 +0100

    cpu: Add CPUArchState pointer to CPUState
    
    The target-specific ENV_GET_CPU() macros have allowed us to navigate
    from CPUArchState to CPUState. The reverse direction was not supported.
    Avoid introducing CPU_GET_ENV() macros by initializing an untyped
    pointer that is initialized in derived instance_init functions.
    
    The field may not be called "env" due to it being poisoned.
    
    Acked-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c25a997..ee1a7c8 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -71,6 +71,7 @@ struct kvm_run;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
+ * @env_ptr: Pointer to subclass-specific CPUArchState field.
  * @current_tb: Currently executing TB.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
@@ -100,6 +101,7 @@ struct CPUState {
     bool stopped;
     volatile sig_atomic_t exit_request;
 
+    void *env_ptr; /* CPUArchState */
     struct TranslationBlock *current_tb;
 
     int kvm_fd;
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 0cdae69..cec9989 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -233,9 +233,11 @@ static const TypeInfo ev68_cpu_type_info = {
 
 static void alpha_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     AlphaCPU *cpu = ALPHA_CPU(obj);
     CPUAlphaState *env = &cpu->env;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
     tlb_flush(env, 1);
 
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index f54d200..5dfcb74 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -134,9 +134,11 @@ static inline void set_feature(CPUARMState *env, int feature)
 
 static void arm_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     ARMCPU *cpu = ARM_CPU(obj);
     static bool inited;
 
+    cs->env_ptr = &cpu->env;
     cpu_exec_init(&cpu->env);
     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
                                          g_free, g_free);
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 8008988..7974be3 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -146,11 +146,13 @@ static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void cris_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     CRISCPU *cpu = CRIS_CPU(obj);
     CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(obj);
     CPUCRISState *env = &cpu->env;
     static bool tcg_initialized;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     env->pregs[PR_VR] = ccc->vr;
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index e2fd626..635f334 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2164,6 +2164,7 @@ static void x86_cpu_initfn(Object *obj)
     CPUX86State *env = &cpu->env;
     static int inited;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     object_property_add(obj, "family", "int",
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 5f16734..a2badb5 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -56,10 +56,12 @@ static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void lm32_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     LM32CPU *cpu = LM32_CPU(obj);
     CPULM32State *env = &cpu->env;
     static bool tcg_initialized;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     env->flags = 0;
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index 42735db..f5a1098 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -154,10 +154,12 @@ static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void m68k_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     M68kCPU *cpu = M68K_CPU(obj);
     CPUM68KState *env = &cpu->env;
     static bool inited;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     if (tcg_enabled() && !inited) {
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 28b5a88..81359db 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -98,10 +98,12 @@ static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void mb_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);
     CPUMBState *env = &cpu->env;
     static bool tcg_initialized;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 09d6172..4d62031 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -55,9 +55,11 @@ static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void mips_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     MIPSCPU *cpu = MIPS_CPU(obj);
     CPUMIPSState *env = &cpu->env;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     if (tcg_enabled()) {
diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index d8cc533..72d5e8d 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -75,9 +75,11 @@ static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void openrisc_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     OpenRISCCPU *cpu = OPENRISC_CPU(obj);
     static int inited;
 
+    cs->env_ptr = &cpu->env;
     cpu_exec_init(&cpu->env);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 5a2acaa..5df2057 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -10529,11 +10529,13 @@ static void ppc_cpu_reset(CPUState *s)
 
 static void ppc_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     PowerPCCPU *cpu = POWERPC_CPU(obj);
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     CPUPPCState *env = &cpu->env;
     ppc_def_t *def = pcc->info;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     env->msr_mask = def->msr_mask;
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index 787c937..b746547 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -110,6 +110,7 @@ static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void s390_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     S390CPU *cpu = S390_CPU(obj);
     CPUS390XState *env = &cpu->env;
     static bool inited;
@@ -118,6 +119,7 @@ static void s390_cpu_initfn(Object *obj)
     struct tm tm;
 #endif
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 #if !defined(CONFIG_USER_ONLY)
     qemu_register_reset(s390_cpu_machine_reset_cb, cpu);
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index dc5d756..ef0e621 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -67,9 +67,11 @@ static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void superh_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     SuperHCPU *cpu = SUPERH_CPU(obj);
     CPUSH4State *env = &cpu->env;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     env->movcal_backup_tail = &(env->movcal_backup);
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 759be53..ef52df6 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -860,9 +860,11 @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void sparc_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     SPARCCPU *cpu = SPARC_CPU(obj);
     CPUSPARCState *env = &cpu->env;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     if (tcg_enabled()) {
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 7bcf3b3..b7024c8 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -93,10 +93,12 @@ static void uc32_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void uc32_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     UniCore32CPU *cpu = UNICORE32_CPU(obj);
     CPUUniCore32State *env = &cpu->env;
     static bool inited;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index 309bb16..785e56d 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -69,10 +69,12 @@ static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
 
 static void xtensa_cpu_initfn(Object *obj)
 {
+    CPUState *cs = CPU(obj);
     XtensaCPU *cpu = XTENSA_CPU(obj);
     CPUXtensaState *env = &cpu->env;
     static bool tcg_inited;
 
+    cs->env_ptr = env;
     cpu_exec_init(env);
 
     if (tcg_enabled() && !tcg_inited) {
commit 907a5e32f293a0af8875973d4cce12b96bea5bae
Author: Andreas Färber <afaerber at suse.de>
Date:   Thu Jan 17 09:16:15 2013 +0100

    cputlb: Pass CPUState to cpu_unlink_tb()
    
    CPUArchState is no longer needed.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/exec.c b/exec.c
index dbb893a..a41bcb8 100644
--- a/exec.c
+++ b/exec.c
@@ -495,7 +495,7 @@ void cpu_exit(CPUArchState *env)
     CPUState *cpu = ENV_GET_CPU(env);
 
     cpu->exit_request = 1;
-    cpu_unlink_tb(env);
+    cpu_unlink_tb(cpu);
 }
 
 void cpu_abort(CPUArchState *env, const char *fmt, ...)
diff --git a/translate-all.c b/translate-all.c
index 52128aa..b50fb89 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -1416,13 +1416,12 @@ void tb_invalidate_phys_addr(hwaddr addr)
 }
 #endif /* TARGET_HAS_ICE && !defined(CONFIG_USER_ONLY) */
 
-void cpu_unlink_tb(CPUArchState *env)
+void cpu_unlink_tb(CPUState *cpu)
 {
     /* FIXME: TB unchaining isn't SMP safe.  For now just ignore the
        problem and hope the cpu will stop of its own accord.  For userspace
        emulation this often isn't actually as bad as it sounds.  Often
        signals are used primarily to interrupt blocking syscalls.  */
-    CPUState *cpu = ENV_GET_CPU(env);
     TranslationBlock *tb;
     static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
 
@@ -1476,7 +1475,7 @@ static void tcg_handle_interrupt(CPUArchState *env, int mask)
             cpu_abort(env, "Raised interrupt while not in I/O function");
         }
     } else {
-        cpu_unlink_tb(env);
+        cpu_unlink_tb(cpu);
     }
 }
 
@@ -1624,8 +1623,10 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
 
 void cpu_interrupt(CPUArchState *env, int mask)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
+
     env->interrupt_request |= mask;
-    cpu_unlink_tb(env);
+    cpu_unlink_tb(cpu);
 }
 
 /*
diff --git a/translate-all.h b/translate-all.h
index b181fb4..5c38819 100644
--- a/translate-all.h
+++ b/translate-all.h
@@ -28,7 +28,7 @@
 
 /* translate-all.c */
 void tb_invalidate_phys_page_fast(tb_page_addr_t start, int len);
-void cpu_unlink_tb(CPUArchState *env);
+void cpu_unlink_tb(CPUState *cpu);
 void tb_check_watchpoint(CPUArchState *env);
 
 #endif /* TRANSLATE_ALL_H */
commit d77953b94ff20868b21796ee22ca57baa1cfc941
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 19:29:31 2013 +0100

    cpu: Move current_tb field to CPUState
    
    Explictly NULL it on CPU reset since it was located before breakpoints.
    
    Change vapic_report_tpr_access() argument to CPUState. This also
    resolves the use of void* for cpu.h independence.
    Change vAPIC patch_instruction() argument to X86CPU.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index cf103f2..9fcfe9e 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -32,7 +32,9 @@ bool qemu_cpu_has_work(CPUState *cpu)
 
 void cpu_loop_exit(CPUArchState *env)
 {
-    env->current_tb = NULL;
+    CPUState *cpu = ENV_GET_CPU(env);
+
+    cpu->current_tb = NULL;
     longjmp(env->jmp_env, 1);
 }
 
@@ -54,6 +56,7 @@ void cpu_resume_from_signal(CPUArchState *env, void *puc)
 static void cpu_exec_nocache(CPUArchState *env, int max_cycles,
                              TranslationBlock *orig_tb)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     tcg_target_ulong next_tb;
     TranslationBlock *tb;
 
@@ -64,10 +67,10 @@ static void cpu_exec_nocache(CPUArchState *env, int max_cycles,
 
     tb = tb_gen_code(env, orig_tb->pc, orig_tb->cs_base, orig_tb->flags,
                      max_cycles);
-    env->current_tb = tb;
+    cpu->current_tb = tb;
     /* execute the generated code */
     next_tb = tcg_qemu_tb_exec(env, tb->tc_ptr);
-    env->current_tb = NULL;
+    cpu->current_tb = NULL;
 
     if ((next_tb & 3) == 2) {
         /* Restore PC.  This may happen if async event occurs before
@@ -589,7 +592,7 @@ int cpu_exec(CPUArchState *env)
                    TB, but before it is linked into a potentially
                    infinite loop and becomes env->current_tb. Avoid
                    starting execution if there is a pending interrupt. */
-                env->current_tb = tb;
+                cpu->current_tb = tb;
                 barrier();
                 if (likely(!cpu->exit_request)) {
                     tc_ptr = tb->tc_ptr;
@@ -623,7 +626,7 @@ int cpu_exec(CPUArchState *env)
                         }
                     }
                 }
-                env->current_tb = NULL;
+                cpu->current_tb = NULL;
                 /* reset soft MMU for next block (it can currently
                    only be set by a memory fault) */
             } /* for(;;) */
diff --git a/cputlb.c b/cputlb.c
index 88239c4..aba7e44 100644
--- a/cputlb.c
+++ b/cputlb.c
@@ -54,6 +54,7 @@ static const CPUTLBEntry s_cputlb_empty_entry = {
  */
 void tlb_flush(CPUArchState *env, int flush_global)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     int i;
 
 #if defined(DEBUG_TLB)
@@ -61,7 +62,7 @@ void tlb_flush(CPUArchState *env, int flush_global)
 #endif
     /* must reset current TB so that interrupts cannot modify the
        links while we are modifying them */
-    env->current_tb = NULL;
+    cpu->current_tb = NULL;
 
     for (i = 0; i < CPU_TLB_SIZE; i++) {
         int mmu_idx;
@@ -92,6 +93,7 @@ static inline void tlb_flush_entry(CPUTLBEntry *tlb_entry, target_ulong addr)
 
 void tlb_flush_page(CPUArchState *env, target_ulong addr)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
     int i;
     int mmu_idx;
 
@@ -110,7 +112,7 @@ void tlb_flush_page(CPUArchState *env, target_ulong addr)
     }
     /* must reset current TB so that interrupts cannot modify the
        links while we are modifying them */
-    env->current_tb = NULL;
+    cpu->current_tb = NULL;
 
     addr &= TARGET_PAGE_MASK;
     i = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1);
diff --git a/hw/apic_common.c b/hw/apic_common.c
index 6e1b1e0..d8c9810 100644
--- a/hw/apic_common.c
+++ b/hw/apic_common.c
@@ -103,7 +103,7 @@ void apic_handle_tpr_access_report(DeviceState *d, target_ulong ip,
 {
     APICCommonState *s = DO_UPCAST(APICCommonState, busdev.qdev, d);
 
-    vapic_report_tpr_access(s->vapic, &s->cpu->env, ip, access);
+    vapic_report_tpr_access(s->vapic, CPU(s->cpu), ip, access);
 }
 
 void apic_report_irq_delivered(int delivered)
diff --git a/hw/apic_internal.h b/hw/apic_internal.h
index dcbbfd4..9265e52 100644
--- a/hw/apic_internal.h
+++ b/hw/apic_internal.h
@@ -143,7 +143,7 @@ bool apic_next_timer(APICCommonState *s, int64_t current_time);
 void apic_enable_tpr_access_reporting(DeviceState *d, bool enable);
 void apic_enable_vapic(DeviceState *d, hwaddr paddr);
 
-void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip,
+void vapic_report_tpr_access(DeviceState *dev, CPUState *cpu, target_ulong ip,
                              TPRAccess access);
 
 #endif /* !QEMU_APIC_INTERNAL_H */
diff --git a/hw/kvmvapic.c b/hw/kvmvapic.c
index 1b5f416..9265baf 100644
--- a/hw/kvmvapic.c
+++ b/hw/kvmvapic.c
@@ -382,8 +382,10 @@ static void patch_call(VAPICROMState *s, CPUX86State *env, target_ulong ip,
     cpu_memory_rw_debug(env, ip + 1, (void *)&offset, sizeof(offset), 1);
 }
 
-static void patch_instruction(VAPICROMState *s, CPUX86State *env, target_ulong ip)
+static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
 {
+    CPUState *cs = CPU(cpu);
+    CPUX86State *env = &cpu->env;
     VAPICHandlers *handlers;
     uint8_t opcode[2];
     uint32_t imm32;
@@ -439,17 +441,18 @@ static void patch_instruction(VAPICROMState *s, CPUX86State *env, target_ulong i
     resume_all_vcpus();
 
     if (!kvm_enabled()) {
-        env->current_tb = NULL;
+        cs->current_tb = NULL;
         tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
         cpu_resume_from_signal(env, NULL);
     }
 }
 
-void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip,
+void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
                              TPRAccess access)
 {
     VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev);
-    CPUX86State *env = cpu;
+    X86CPU *cpu = X86_CPU(cs);
+    CPUX86State *env = &cpu->env;
 
     cpu_synchronize_state(env);
 
@@ -465,7 +468,7 @@ void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip,
     if (vapic_enable(s, env) < 0) {
         return;
     }
-    patch_instruction(s, env, ip);
+    patch_instruction(s, cpu, ip);
 }
 
 typedef struct VAPICEnableTPRReporting {
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index ca39f05..ae64590 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -148,7 +148,6 @@ typedef struct CPUWatchpoint {
 
 #define CPU_TEMP_BUF_NLONGS 128
 #define CPU_COMMON                                                      \
-    struct TranslationBlock *current_tb; /* currently executing TB  */  \
     /* soft mmu support */                                              \
     /* in order to avoid passing too many arguments to the MMIO         \
        helpers, we store some rarely used information in the CPU        \
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index f685c28..e856191 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -404,11 +404,13 @@ extern volatile sig_atomic_t exit_request;
    instruction of a TB so that interrupts take effect immediately.  */
 static inline int can_do_io(CPUArchState *env)
 {
+    CPUState *cpu = ENV_GET_CPU(env);
+
     if (!use_icount) {
         return 1;
     }
     /* If not executing code then assume we are ok.  */
-    if (!env->current_tb) {
+    if (cpu->current_tb == NULL) {
         return 1;
     }
     return env->can_do_io != 0;
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 42f3f34..c25a997 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -71,6 +71,7 @@ struct kvm_run;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
+ * @current_tb: Currently executing TB.
  * @kvm_fd: vCPU file descriptor for KVM.
  *
  * State of one CPU core or thread.
@@ -99,6 +100,8 @@ struct CPUState {
     bool stopped;
     volatile sig_atomic_t exit_request;
 
+    struct TranslationBlock *current_tb;
+
     int kvm_fd;
     bool kvm_vcpu_dirty;
     struct KVMState *kvm_state;
diff --git a/qom/cpu.c b/qom/cpu.c
index 7d8c675..0a2194d 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -33,6 +33,7 @@ void cpu_reset(CPUState *cpu)
 static void cpu_common_reset(CPUState *cpu)
 {
     cpu->exit_request = 0;
+    cpu->current_tb = NULL;
 }
 
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
diff --git a/translate-all.c b/translate-all.c
index efeb247..52128aa 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -998,6 +998,7 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
 {
     TranslationBlock *tb, *tb_next, *saved_tb;
     CPUArchState *env = cpu_single_env;
+    CPUState *cpu = NULL;
     tb_page_addr_t tb_start, tb_end;
     PageDesc *p;
     int n;
@@ -1020,6 +1021,9 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
         /* build code bitmap */
         build_page_bitmap(p);
     }
+    if (env != NULL) {
+        cpu = ENV_GET_CPU(env);
+    }
 
     /* we remove all the TBs in the range [start, end[ */
     /* XXX: see if in some cases it could be faster to invalidate all
@@ -1066,14 +1070,14 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
             /* we need to do that to handle the case where a signal
                occurs while doing tb_phys_invalidate() */
             saved_tb = NULL;
-            if (env) {
-                saved_tb = env->current_tb;
-                env->current_tb = NULL;
+            if (cpu != NULL) {
+                saved_tb = cpu->current_tb;
+                cpu->current_tb = NULL;
             }
             tb_phys_invalidate(tb, -1);
-            if (env) {
-                env->current_tb = saved_tb;
-                if (env->interrupt_request && env->current_tb) {
+            if (cpu != NULL) {
+                cpu->current_tb = saved_tb;
+                if (env && env->interrupt_request && cpu->current_tb) {
                     cpu_interrupt(env, env->interrupt_request);
                 }
             }
@@ -1094,7 +1098,7 @@ void tb_invalidate_phys_page_range(tb_page_addr_t start, tb_page_addr_t end,
         /* we generate a block containing just the instruction
            modifying the memory. It will ensure that it cannot modify
            itself */
-        env->current_tb = NULL;
+        cpu->current_tb = NULL;
         tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
         cpu_resume_from_signal(env, NULL);
     }
@@ -1142,6 +1146,7 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
 #ifdef TARGET_HAS_PRECISE_SMC
     TranslationBlock *current_tb = NULL;
     CPUArchState *env = cpu_single_env;
+    CPUState *cpu = NULL;
     int current_tb_modified = 0;
     target_ulong current_pc = 0;
     target_ulong current_cs_base = 0;
@@ -1158,6 +1163,9 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
     if (tb && pc != 0) {
         current_tb = tb_find_pc(pc);
     }
+    if (env != NULL) {
+        cpu = ENV_GET_CPU(env);
+    }
 #endif
     while (tb != NULL) {
         n = (uintptr_t)tb & 3;
@@ -1186,7 +1194,7 @@ static void tb_invalidate_phys_page(tb_page_addr_t addr,
         /* we generate a block containing just the instruction
            modifying the memory. It will ensure that it cannot modify
            itself */
-        env->current_tb = NULL;
+        cpu->current_tb = NULL;
         tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
         cpu_resume_from_signal(env, puc);
     }
@@ -1414,15 +1422,16 @@ void cpu_unlink_tb(CPUArchState *env)
        problem and hope the cpu will stop of its own accord.  For userspace
        emulation this often isn't actually as bad as it sounds.  Often
        signals are used primarily to interrupt blocking syscalls.  */
+    CPUState *cpu = ENV_GET_CPU(env);
     TranslationBlock *tb;
     static spinlock_t interrupt_lock = SPIN_LOCK_UNLOCKED;
 
     spin_lock(&interrupt_lock);
-    tb = env->current_tb;
+    tb = cpu->current_tb;
     /* if the cpu is currently executing code, we must unlink it and
        all the potentially executing TB */
     if (tb) {
-        env->current_tb = NULL;
+        cpu->current_tb = NULL;
         tb_reset_jump_recursive(tb);
     }
     spin_unlock(&interrupt_lock);
commit fcd7d0034b7eddba505a548f456f452bf5a7d56c
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Dec 17 08:02:44 2012 +0100

    cpu: Move exit_request field to CPUState
    
    Since it was located before breakpoints field, it needs to be reset.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/cpu-exec.c b/cpu-exec.c
index ff9a884..cf103f2 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -196,7 +196,7 @@ int cpu_exec(CPUArchState *env)
     cpu_single_env = env;
 
     if (unlikely(exit_request)) {
-        env->exit_request = 1;
+        cpu->exit_request = 1;
     }
 
 #if defined(TARGET_I386)
@@ -537,8 +537,8 @@ int cpu_exec(CPUArchState *env)
                         next_tb = 0;
                     }
                 }
-                if (unlikely(env->exit_request)) {
-                    env->exit_request = 0;
+                if (unlikely(cpu->exit_request)) {
+                    cpu->exit_request = 0;
                     env->exception_index = EXCP_INTERRUPT;
                     cpu_loop_exit(env);
                 }
@@ -591,7 +591,7 @@ int cpu_exec(CPUArchState *env)
                    starting execution if there is a pending interrupt. */
                 env->current_tb = tb;
                 barrier();
-                if (likely(!env->exit_request)) {
+                if (likely(!cpu->exit_request)) {
                     tc_ptr = tb->tc_ptr;
                     /* execute the generated code */
                     next_tb = tcg_qemu_tb_exec(env, tc_ptr);
diff --git a/exec.c b/exec.c
index b85508b..dbb893a 100644
--- a/exec.c
+++ b/exec.c
@@ -492,7 +492,9 @@ void cpu_reset_interrupt(CPUArchState *env, int mask)
 
 void cpu_exit(CPUArchState *env)
 {
-    env->exit_request = 1;
+    CPUState *cpu = ENV_GET_CPU(env);
+
+    cpu->exit_request = 1;
     cpu_unlink_tb(env);
 }
 
diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index 2889742..af1db6e 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -513,13 +513,14 @@ static target_ulong h_cede(PowerPCCPU *cpu, sPAPREnvironment *spapr,
                            target_ulong opcode, target_ulong *args)
 {
     CPUPPCState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
 
     env->msr |= (1ULL << MSR_EE);
     hreg_compute_hflags(env);
-    if (!cpu_has_work(CPU(cpu))) {
+    if (!cpu_has_work(cs)) {
         env->halted = 1;
         env->exception_index = EXCP_HLT;
-        env->exit_request = 1;
+        cs->exit_request = 1;
     }
     return H_SUCCESS;
 }
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index ba814ff..ca39f05 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -26,7 +26,6 @@
 #include "config.h"
 #include <setjmp.h>
 #include <inttypes.h>
-#include <signal.h>
 #include "qemu/osdep.h"
 #include "qemu/queue.h"
 #include "exec/hwaddr.h"
@@ -160,7 +159,6 @@ typedef struct CPUWatchpoint {
                                      memory was accessed */             \
     uint32_t halted; /* Nonzero if the CPU is in suspend state */       \
     uint32_t interrupt_request;                                         \
-    volatile sig_atomic_t exit_request;                                 \
     CPU_COMMON_TLB                                                      \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
     /* buffer for temporaries in the code generator */                  \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index c465d88..42f3f34 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -20,6 +20,7 @@
 #ifndef QEMU_CPU_H
 #define QEMU_CPU_H
 
+#include <signal.h>
 #include "hw/qdev-core.h"
 #include "qemu/thread.h"
 
@@ -96,6 +97,7 @@ struct CPUState {
     bool created;
     bool stop;
     bool stopped;
+    volatile sig_atomic_t exit_request;
 
     int kvm_fd;
     bool kvm_vcpu_dirty;
diff --git a/kvm-all.c b/kvm-all.c
index 04ec2d5..4decfdc 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -1537,7 +1537,7 @@ int kvm_cpu_exec(CPUArchState *env)
     DPRINTF("kvm_cpu_exec()\n");
 
     if (kvm_arch_process_async_events(cpu)) {
-        env->exit_request = 0;
+        cpu->exit_request = 0;
         return EXCP_HLT;
     }
 
@@ -1548,7 +1548,7 @@ int kvm_cpu_exec(CPUArchState *env)
         }
 
         kvm_arch_pre_run(cpu, run);
-        if (env->exit_request) {
+        if (cpu->exit_request) {
             DPRINTF("interrupt exit requested\n");
             /*
              * KVM requires us to reenter the kernel after IO exits to complete
@@ -1622,7 +1622,7 @@ int kvm_cpu_exec(CPUArchState *env)
         vm_stop(RUN_STATE_INTERNAL_ERROR);
     }
 
-    env->exit_request = 0;
+    cpu->exit_request = 0;
     return ret;
 }
 
diff --git a/qom/cpu.c b/qom/cpu.c
index 870e9ba..7d8c675 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -32,6 +32,7 @@ void cpu_reset(CPUState *cpu)
 
 static void cpu_common_reset(CPUState *cpu)
 {
+    cpu->exit_request = 0;
 }
 
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 9ebf181..0cf413d 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1777,7 +1777,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
          * or pending TPR access reports. */
         if (env->interrupt_request &
             (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
-            env->exit_request = 1;
+            cpu->exit_request = 1;
         }
 
         /* Try to inject an interrupt if the guest can accept it */
@@ -1847,7 +1847,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         if (env->exception_injected == EXCP08_DBLE) {
             /* this means triple fault */
             qemu_system_reset_request();
-            env->exit_request = 1;
+            cs->exit_request = 1;
             return 0;
         }
         env->exception_injected = EXCP12_MCHK;
commit 0315c31cda054775585b31f8cb3c9228cc6fc28b
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Dec 17 07:34:52 2012 +0100

    cpu: Move running field to CPUState
    
    Pass CPUState to cpu_exec_{start,end}() functions.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index ae832a9..ba814ff 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -191,7 +191,6 @@ typedef struct CPUWatchpoint {
     int exception_index;                                                \
                                                                         \
     CPUArchState *next_cpu; /* next CPU sharing TB cache */                 \
-    int running; /* Nonzero if cpu is currently running(usermode).  */  \
     /* user data */                                                     \
     void *opaque;                                                       \
                                                                         \
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index e371655..c465d88 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -66,6 +66,7 @@ struct kvm_run;
  * @nr_threads: Number of threads within this CPU.
  * @numa_node: NUMA node this CPU is belonging to.
  * @host_tid: Host thread ID.
+ * @running: #true if CPU is currently running (usermode).
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
@@ -88,6 +89,7 @@ struct CPUState {
 #endif
     int thread_id;
     uint32_t host_tid;
+    bool running;
     struct QemuCond *halt_cond;
     struct qemu_work_item *queued_work_first, *queued_work_last;
     bool thread_kicked;
diff --git a/linux-user/main.c b/linux-user/main.c
index 146a468..e515684 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -151,13 +151,16 @@ static inline void exclusive_idle(void)
 static inline void start_exclusive(void)
 {
     CPUArchState *other;
+    CPUState *other_cpu;
+
     pthread_mutex_lock(&exclusive_lock);
     exclusive_idle();
 
     pending_cpus = 1;
     /* Make all other cpus stop executing.  */
     for (other = first_cpu; other; other = other->next_cpu) {
-        if (other->running) {
+        other_cpu = ENV_GET_CPU(other);
+        if (other_cpu->running) {
             pending_cpus++;
             cpu_exit(other);
         }
@@ -176,19 +179,19 @@ static inline void end_exclusive(void)
 }
 
 /* Wait for exclusive ops to finish, and begin cpu execution.  */
-static inline void cpu_exec_start(CPUArchState *env)
+static inline void cpu_exec_start(CPUState *cpu)
 {
     pthread_mutex_lock(&exclusive_lock);
     exclusive_idle();
-    env->running = 1;
+    cpu->running = true;
     pthread_mutex_unlock(&exclusive_lock);
 }
 
 /* Mark cpu as not executing, and release pending exclusive ops.  */
-static inline void cpu_exec_end(CPUArchState *env)
+static inline void cpu_exec_end(CPUState *cpu)
 {
     pthread_mutex_lock(&exclusive_lock);
-    env->running = 0;
+    cpu->running = false;
     if (pending_cpus > 1) {
         pending_cpus--;
         if (pending_cpus == 1) {
@@ -210,11 +213,11 @@ void cpu_list_unlock(void)
 }
 #else /* if !CONFIG_USE_NPTL */
 /* These are no-ops because we are not threadsafe.  */
-static inline void cpu_exec_start(CPUArchState *env)
+static inline void cpu_exec_start(CPUState *cpu)
 {
 }
 
-static inline void cpu_exec_end(CPUArchState *env)
+static inline void cpu_exec_end(CPUState *cpu)
 {
 }
 
@@ -697,15 +700,16 @@ done:
 
 void cpu_loop(CPUARMState *env)
 {
+    CPUState *cs = CPU(arm_env_get_cpu(env));
     int trapnr;
     unsigned int n, insn;
     target_siginfo_t info;
     uint32_t addr;
 
     for(;;) {
-        cpu_exec_start(env);
+        cpu_exec_start(cs);
         trapnr = cpu_arm_exec(env);
-        cpu_exec_end(env);
+        cpu_exec_end(cs);
         switch(trapnr) {
         case EXCP_UDEF:
             {
@@ -912,14 +916,15 @@ void cpu_loop(CPUARMState *env)
 
 void cpu_loop(CPUUniCore32State *env)
 {
+    CPUState *cs = CPU(uc32_env_get_cpu(env));
     int trapnr;
     unsigned int n, insn;
     target_siginfo_t info;
 
     for (;;) {
-        cpu_exec_start(env);
+        cpu_exec_start(cs);
         trapnr = uc32_cpu_exec(env);
-        cpu_exec_end(env);
+        cpu_exec_end(cs);
         switch (trapnr) {
         case UC32_EXCP_PRIV:
             {
@@ -1367,14 +1372,15 @@ static int do_store_exclusive(CPUPPCState *env)
 
 void cpu_loop(CPUPPCState *env)
 {
+    CPUState *cs = CPU(ppc_env_get_cpu(env));
     target_siginfo_t info;
     int trapnr;
     target_ulong ret;
 
     for(;;) {
-        cpu_exec_start(env);
+        cpu_exec_start(cs);
         trapnr = cpu_ppc_exec(env);
-        cpu_exec_end(env);
+        cpu_exec_end(cs);
         switch(trapnr) {
         case POWERPC_EXCP_NONE:
             /* Just go on */
@@ -2184,14 +2190,15 @@ static int do_store_exclusive(CPUMIPSState *env)
 
 void cpu_loop(CPUMIPSState *env)
 {
+    CPUState *cs = CPU(mips_env_get_cpu(env));
     target_siginfo_t info;
     int trapnr, ret;
     unsigned int syscall_num;
 
     for(;;) {
-        cpu_exec_start(env);
+        cpu_exec_start(cs);
         trapnr = cpu_mips_exec(env);
-        cpu_exec_end(env);
+        cpu_exec_end(cs);
         switch(trapnr) {
         case EXCP_SYSCALL:
             syscall_num = env->active_tc.gpr[2] - 4000;
commit 0d34282fdde1d8f337d2a9e10f5ac793b12ef2e7
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Dec 17 07:12:13 2012 +0100

    cpu: Move host_tid field to CPUState
    
    Change gdbstub's cpu_index() argument to CPUState now that CPUArchState
    is no longer used.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/dump.c b/dump.c
index 4ed1fa8..a25f509 100644
--- a/dump.c
+++ b/dump.c
@@ -271,11 +271,13 @@ static int write_elf64_note(DumpState *s)
 static int write_elf64_notes(DumpState *s)
 {
     CPUArchState *env;
+    CPUState *cpu;
     int ret;
     int id;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        id = cpu_index(env);
+        cpu = ENV_GET_CPU(env);
+        id = cpu_index(cpu);
         ret = cpu_write_elf64_note(fd_write_vmcore, env, id, s);
         if (ret < 0) {
             dump_error(s, "dump: failed to write elf notes.\n");
@@ -321,11 +323,13 @@ static int write_elf32_note(DumpState *s)
 static int write_elf32_notes(DumpState *s)
 {
     CPUArchState *env;
+    CPUState *cpu;
     int ret;
     int id;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        id = cpu_index(env);
+        cpu = ENV_GET_CPU(env);
+        id = cpu_index(cpu);
         ret = cpu_write_elf32_note(fd_write_vmcore, env, id, s);
         if (ret < 0) {
             dump_error(s, "dump: failed to write elf notes.\n");
diff --git a/gdbstub.c b/gdbstub.c
index 6cd26f1..32dfea9 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -2066,9 +2066,11 @@ static void gdb_set_cpu_pc(GDBState *s, target_ulong pc)
 static CPUArchState *find_cpu(uint32_t thread_id)
 {
     CPUArchState *env;
+    CPUState *cpu;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
-        if (cpu_index(env) == thread_id) {
+        cpu = ENV_GET_CPU(env);
+        if (cpu_index(cpu) == thread_id) {
             return env;
         }
     }
@@ -2096,7 +2098,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
     case '?':
         /* TODO: Make this return the correct value for user-mode.  */
         snprintf(buf, sizeof(buf), "T%02xthread:%02x;", GDB_SIGNAL_TRAP,
-                 cpu_index(s->c_cpu));
+                 cpu_index(ENV_GET_CPU(s->c_cpu)));
         put_packet(s, buf);
         /* Remove all the breakpoints when this query is issued,
          * because gdb is doing and initial connect and the state
@@ -2391,7 +2393,8 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
         } else if (strcmp(p,"sThreadInfo") == 0) {
         report_cpuinfo:
             if (s->query_cpu) {
-                snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu));
+                snprintf(buf, sizeof(buf), "m%x",
+                         cpu_index(ENV_GET_CPU(s->query_cpu)));
                 put_packet(s, buf);
                 s->query_cpu = s->query_cpu->next_cpu;
             } else
@@ -2512,6 +2515,7 @@ static void gdb_vm_state_change(void *opaque, int running, RunState state)
 {
     GDBState *s = gdbserver_state;
     CPUArchState *env = s->c_cpu;
+    CPUState *cpu = ENV_GET_CPU(env);
     char buf[256];
     const char *type;
     int ret;
@@ -2540,7 +2544,7 @@ static void gdb_vm_state_change(void *opaque, int running, RunState state)
             }
             snprintf(buf, sizeof(buf),
                      "T%02xthread:%02x;%swatch:" TARGET_FMT_lx ";",
-                     GDB_SIGNAL_TRAP, cpu_index(env), type,
+                     GDB_SIGNAL_TRAP, cpu_index(cpu), type,
                      env->watchpoint_hit->vaddr);
             env->watchpoint_hit = NULL;
             goto send_packet;
@@ -2573,7 +2577,7 @@ static void gdb_vm_state_change(void *opaque, int running, RunState state)
         ret = GDB_SIGNAL_UNKNOWN;
         break;
     }
-    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(env));
+    snprintf(buf, sizeof(buf), "T%02xthread:%02x;", ret, cpu_index(cpu));
 
 send_packet:
     put_packet(s, buf);
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 2911b9f..ae832a9 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -191,7 +191,6 @@ typedef struct CPUWatchpoint {
     int exception_index;                                                \
                                                                         \
     CPUArchState *next_cpu; /* next CPU sharing TB cache */                 \
-    uint32_t host_tid; /* host thread ID */                             \
     int running; /* Nonzero if cpu is currently running(usermode).  */  \
     /* user data */                                                     \
     void *opaque;                                                       \
diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index 49231fe..ba20afa 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -30,12 +30,11 @@ void gdb_register_coprocessor(CPUArchState *env,
                               gdb_reg_cb get_reg, gdb_reg_cb set_reg,
                               int num_regs, const char *xml, int g_pos);
 
-static inline int cpu_index(CPUArchState *env)
+static inline int cpu_index(CPUState *cpu)
 {
 #if defined(CONFIG_USER_ONLY) && defined(CONFIG_USE_NPTL)
-    return env->host_tid;
+    return cpu->host_tid;
 #else
-    CPUState *cpu = ENV_GET_CPU(env);
     return cpu->cpu_index + 1;
 #endif
 }
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index 46f2247..e371655 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -65,6 +65,7 @@ struct kvm_run;
  * @nr_cores: Number of cores within this CPU package.
  * @nr_threads: Number of threads within this CPU.
  * @numa_node: NUMA node this CPU is belonging to.
+ * @host_tid: Host thread ID.
  * @created: Indicates whether the CPU thread has been successfully created.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
@@ -86,6 +87,7 @@ struct CPUState {
     HANDLE hThread;
 #endif
     int thread_id;
+    uint32_t host_tid;
     struct QemuCond *halt_cond;
     struct qemu_work_item *queued_work_first, *queued_work_last;
     bool thread_kicked;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 9e31ea7..19630ea 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4312,13 +4312,15 @@ static void *clone_func(void *arg)
 {
     new_thread_info *info = arg;
     CPUArchState *env;
+    CPUState *cpu;
     TaskState *ts;
 
     env = info->env;
+    cpu = ENV_GET_CPU(env);
     thread_env = env;
     ts = (TaskState *)thread_env->opaque;
     info->tid = gettid();
-    env->host_tid = info->tid;
+    cpu->host_tid = info->tid;
     task_settid(ts);
     if (info->child_tidptr)
         put_user_u32(info->tid, info->child_tidptr);
commit 6ae064fc671f1c475b1371c067fa3100ec6daf80
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Feb 6 17:18:12 2013 +0100

    target-cris: Introduce CRISCPU subclasses
    
    Use class_init functions to initialize the VR in preparation for
    overriding v32+ behavior there.
    
    Move cpu_cris_init() to cpu.c and hook up a class_by_name callback.
    
    This change leads to unknown -cpu model names no longer falling back
    to a CPU with VR 32 but instead returning NULL.
    
    Acked-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index 7ad8398..2bac71f 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -35,6 +35,7 @@
  * CRISCPUClass:
  * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
+ * @vr: Version Register value.
  *
  * A CRIS CPU model.
  */
@@ -45,6 +46,8 @@ typedef struct CRISCPUClass {
 
     DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
+
+    uint32_t vr;
 } CRISCPUClass;
 
 /**
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index fedf641..8008988 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -55,6 +55,84 @@ static void cris_cpu_reset(CPUState *s)
 #endif
 }
 
+static ObjectClass *cris_cpu_class_by_name(const char *cpu_model)
+{
+    ObjectClass *oc;
+    char *typename;
+
+    if (cpu_model == NULL) {
+        return NULL;
+    }
+
+    typename = g_strdup_printf("%s-" TYPE_CRIS_CPU, cpu_model);
+    oc = object_class_by_name(typename);
+    g_free(typename);
+    if (oc != NULL && (!object_class_dynamic_cast(oc, TYPE_CRIS_CPU) ||
+                       object_class_is_abstract(oc))) {
+        oc = NULL;
+    }
+    return oc;
+}
+
+CRISCPU *cpu_cris_init(const char *cpu_model)
+{
+    CRISCPU *cpu;
+    ObjectClass *oc;
+
+    oc = cris_cpu_class_by_name(cpu_model);
+    if (oc == NULL) {
+        return NULL;
+    }
+    cpu = CRIS_CPU(object_new(object_class_get_name(oc)));
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
+    return cpu;
+}
+
+/* Sort alphabetically by VR. */
+static gint cris_cpu_list_compare(gconstpointer a, gconstpointer b)
+{
+    CRISCPUClass *ccc_a = CRIS_CPU_CLASS(a);
+    CRISCPUClass *ccc_b = CRIS_CPU_CLASS(b);
+
+    /*  */
+    if (ccc_a->vr > ccc_b->vr) {
+        return 1;
+    } else if (ccc_a->vr < ccc_b->vr) {
+        return -1;
+    } else {
+        return 0;
+    }
+}
+
+static void cris_cpu_list_entry(gpointer data, gpointer user_data)
+{
+    ObjectClass *oc = data;
+    CPUListState *s = user_data;
+    const char *typename = object_class_get_name(oc);
+    char *name;
+
+    name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_CRIS_CPU));
+    (*s->cpu_fprintf)(s->file, "  %s\n", name);
+    g_free(name);
+}
+
+void cris_cpu_list(FILE *f, fprintf_function cpu_fprintf)
+{
+    CPUListState s = {
+        .file = f,
+        .cpu_fprintf = cpu_fprintf,
+    };
+    GSList *list;
+
+    list = object_class_get_list(TYPE_CRIS_CPU, false);
+    list = g_slist_sort(list, cris_cpu_list_compare);
+    (*cpu_fprintf)(f, "Available CPUs:\n");
+    g_slist_foreach(list, cris_cpu_list_entry, &s);
+    g_slist_free(list);
+}
+
 static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     CRISCPU *cpu = CRIS_CPU(dev);
@@ -69,11 +147,14 @@ static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
 static void cris_cpu_initfn(Object *obj)
 {
     CRISCPU *cpu = CRIS_CPU(obj);
+    CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(obj);
     CPUCRISState *env = &cpu->env;
     static bool tcg_initialized;
 
     cpu_exec_init(env);
 
+    env->pregs[PR_VR] = ccc->vr;
+
     if (tcg_enabled() && !tcg_initialized) {
         tcg_initialized = true;
         if (env->pregs[PR_VR] < 32) {
@@ -84,6 +165,69 @@ static void cris_cpu_initfn(Object *obj)
     }
 }
 
+static void crisv8_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+
+    ccc->vr = 8;
+}
+
+static void crisv9_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+
+    ccc->vr = 9;
+}
+
+static void crisv10_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+
+    ccc->vr = 10;
+}
+
+static void crisv11_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+
+    ccc->vr = 11;
+}
+
+static void crisv32_cpu_class_init(ObjectClass *oc, void *data)
+{
+    CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
+
+    ccc->vr = 32;
+}
+
+#define TYPE(model) model "-" TYPE_CRIS_CPU
+
+static const TypeInfo cris_cpu_model_type_infos[] = {
+    {
+        .name = TYPE("crisv8"),
+        .parent = TYPE_CRIS_CPU,
+        .class_init = crisv8_cpu_class_init,
+    }, {
+        .name = TYPE("crisv9"),
+        .parent = TYPE_CRIS_CPU,
+        .class_init = crisv9_cpu_class_init,
+    }, {
+        .name = TYPE("crisv10"),
+        .parent = TYPE_CRIS_CPU,
+        .class_init = crisv10_cpu_class_init,
+    }, {
+        .name = TYPE("crisv11"),
+        .parent = TYPE_CRIS_CPU,
+        .class_init = crisv11_cpu_class_init,
+    }, {
+        .name = TYPE("crisv32"),
+        .parent = TYPE_CRIS_CPU,
+        .class_init = crisv32_cpu_class_init,
+    }
+};
+
+#undef TYPE
+
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -95,6 +239,8 @@ static void cris_cpu_class_init(ObjectClass *oc, void *data)
 
     ccc->parent_reset = cc->reset;
     cc->reset = cris_cpu_reset;
+
+    cc->class_by_name = cris_cpu_class_by_name;
 }
 
 static const TypeInfo cris_cpu_type_info = {
@@ -102,14 +248,19 @@ static const TypeInfo cris_cpu_type_info = {
     .parent = TYPE_CPU,
     .instance_size = sizeof(CRISCPU),
     .instance_init = cris_cpu_initfn,
-    .abstract = false,
+    .abstract = true,
     .class_size = sizeof(CRISCPUClass),
     .class_init = cris_cpu_class_init,
 };
 
 static void cris_cpu_register_types(void)
 {
+    int i;
+
     type_register_static(&cris_cpu_type_info);
+    for (i = 0; i < ARRAY_SIZE(cris_cpu_model_type_infos); i++) {
+        type_register_static(&cris_cpu_model_type_infos[i]);
+    }
 }
 
 type_init(cris_cpu_register_types)
diff --git a/target-cris/translate.c b/target-cris/translate.c
index 25a43fa..04a5379 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3513,54 +3513,6 @@ void cpu_dump_state (CPUCRISState *env, FILE *f, fprintf_function cpu_fprintf,
 
 }
 
-struct
-{
-    uint32_t vr;
-    const char *name;
-} cris_cores[] = {
-    {8, "crisv8"},
-    {9, "crisv9"},
-    {10, "crisv10"},
-    {11, "crisv11"},
-    {32, "crisv32"},
-};
-
-void cris_cpu_list(FILE *f, fprintf_function cpu_fprintf)
-{
-    unsigned int i;
-
-    (*cpu_fprintf)(f, "Available CPUs:\n");
-    for (i = 0; i < ARRAY_SIZE(cris_cores); i++) {
-        (*cpu_fprintf)(f, "  %s\n", cris_cores[i].name);
-    }
-}
-
-static uint32_t vr_by_name(const char *name)
-{
-    unsigned int i;
-    for (i = 0; i < ARRAY_SIZE(cris_cores); i++) {
-        if (strcmp(name, cris_cores[i].name) == 0) {
-            return cris_cores[i].vr;
-        }
-    }
-    return 32;
-}
-
-CRISCPU *cpu_cris_init(const char *cpu_model)
-{
-    CRISCPU *cpu;
-    CPUCRISState *env;
-
-    cpu = CRIS_CPU(object_new(TYPE_CRIS_CPU));
-    env = &cpu->env;
-
-    env->pregs[PR_VR] = vr_by_name(cpu_model);
-
-    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
-
-    return cpu;
-}
-
 void cris_initialize_tcg(void)
 {
     int i;
commit cb3fb38e91caacfcb0f86e8c587ed74ffa34fe8e
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jan 18 14:20:52 2013 +0100

    target-m68k: Pass M68kCPU to m68k_set_irq_level()
    
    Simplifies use of cpu_reset_interrupt() et al.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/mcf5206.c b/hw/mcf5206.c
index 9bb393e..ea2db23 100644
--- a/hw/mcf5206.c
+++ b/hw/mcf5206.c
@@ -226,7 +226,7 @@ static void m5206_mbar_update(m5206_mbar_state *s)
         level = 0;
         vector = 0;
     }
-    m68k_set_irq_level(&s->cpu->env, level, vector);
+    m68k_set_irq_level(s->cpu, level, vector);
 }
 
 static void m5206_mbar_set_irq(void *opaque, int irq, int level)
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index 450f622..b213656 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -40,7 +40,7 @@ static void mcf_intc_update(mcf_intc_state *s)
         }
     }
     s->active_vector = ((best == 64) ? 24 : (best + 64));
-    m68k_set_irq_level(&s->cpu->env, best_level, s->active_vector);
+    m68k_set_irq_level(s->cpu, best_level, s->active_vector);
 }
 
 static uint64_t mcf_intc_read(void *opaque, hwaddr addr,
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index ed9be80..2672eae 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -169,7 +169,7 @@ enum {
 #define MACSR_V     0x002
 #define MACSR_EV    0x001
 
-void m68k_set_irq_level(CPUM68KState *env, int level, uint8_t vector);
+void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector);
 void m68k_set_macsr(CPUM68KState *env, uint32_t val);
 void m68k_switch_sp(CPUM68KState *env);
 
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 7d3fd94..1bae3ab 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -310,8 +310,10 @@ int cpu_m68k_handle_mmu_fault (CPUM68KState *env, target_ulong address, int rw,
    be handled by the interrupt controller.  Real hardware only requests
    the vector when the interrupt is acknowledged by the CPU.  For
    simplicitly we calculate it when the interrupt is signalled.  */
-void m68k_set_irq_level(CPUM68KState *env, int level, uint8_t vector)
+void m68k_set_irq_level(M68kCPU *cpu, int level, uint8_t vector)
 {
+    CPUM68KState *env = &cpu->env;
+
     env->pending_level = level;
     env->pending_vector = vector;
     if (level)
commit 9a6ee9fd35483446fe14e083fa335358c86ba595
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jan 18 14:15:09 2013 +0100

    mcf_intc: Pass M68kCPU to mcf_intc_init()
    
    Store it in mcf_intc_state.
    Prepares for passing it to m68k_set_irq_level().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/mcf.h b/hw/mcf.h
index dc21028..fbc8dc2 100644
--- a/hw/mcf.h
+++ b/hw/mcf.h
@@ -17,7 +17,7 @@ void mcf_uart_mm_init(struct MemoryRegion *sysmem,
 /* mcf_intc.c */
 qemu_irq *mcf_intc_init(struct MemoryRegion *sysmem,
                         hwaddr base,
-                        CPUM68KState *env);
+                        M68kCPU *cpu);
 
 /* mcf_fec.c */
 void mcf_fec_init(struct MemoryRegion *sysmem, NICInfo *nd,
diff --git a/hw/mcf5208.c b/hw/mcf5208.c
index 2c9a5dc..86402d3 100644
--- a/hw/mcf5208.c
+++ b/hw/mcf5208.c
@@ -192,6 +192,7 @@ static void mcf5208evb_init(QEMUMachineInitArgs *args)
     ram_addr_t ram_size = args->ram_size;
     const char *cpu_model = args->cpu_model;
     const char *kernel_filename = args->kernel_filename;
+    M68kCPU *cpu;
     CPUM68KState *env;
     int kernel_size;
     uint64_t elf_entry;
@@ -201,13 +202,15 @@ static void mcf5208evb_init(QEMUMachineInitArgs *args)
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *sram = g_new(MemoryRegion, 1);
 
-    if (!cpu_model)
+    if (!cpu_model) {
         cpu_model = "m5208";
-    env = cpu_init(cpu_model);
-    if (!env) {
+    }
+    cpu = cpu_m68k_init(cpu_model);
+    if (!cpu) {
         fprintf(stderr, "Unable to find m68k CPU definition\n");
         exit(1);
     }
+    env = &cpu->env;
 
     /* Initialize CPU registers.  */
     env->vbr = 0;
@@ -224,7 +227,7 @@ static void mcf5208evb_init(QEMUMachineInitArgs *args)
     memory_region_add_subregion(address_space_mem, 0x80000000, sram);
 
     /* Internal peripherals.  */
-    pic = mcf_intc_init(address_space_mem, 0xfc048000, env);
+    pic = mcf_intc_init(address_space_mem, 0xfc048000, cpu);
 
     mcf_uart_mm_init(address_space_mem, 0xfc060000, pic[26], serial_hds[0]);
     mcf_uart_mm_init(address_space_mem, 0xfc064000, pic[27], serial_hds[1]);
diff --git a/hw/mcf_intc.c b/hw/mcf_intc.c
index 3bed3a2..450f622 100644
--- a/hw/mcf_intc.c
+++ b/hw/mcf_intc.c
@@ -16,7 +16,7 @@ typedef struct {
     uint64_t ifr;
     uint64_t enabled;
     uint8_t icr[64];
-    CPUM68KState *env;
+    M68kCPU *cpu;
     int active_vector;
 } mcf_intc_state;
 
@@ -40,7 +40,7 @@ static void mcf_intc_update(mcf_intc_state *s)
         }
     }
     s->active_vector = ((best == 64) ? 24 : (best + 64));
-    m68k_set_irq_level(s->env, best_level, s->active_vector);
+    m68k_set_irq_level(&s->cpu->env, best_level, s->active_vector);
 }
 
 static uint64_t mcf_intc_read(void *opaque, hwaddr addr,
@@ -139,12 +139,12 @@ static const MemoryRegionOps mcf_intc_ops = {
 
 qemu_irq *mcf_intc_init(MemoryRegion *sysmem,
                         hwaddr base,
-                        CPUM68KState *env)
+                        M68kCPU *cpu)
 {
     mcf_intc_state *s;
 
     s = g_malloc0(sizeof(mcf_intc_state));
-    s->env = env;
+    s->cpu = cpu;
     mcf_intc_reset(s);
 
     memory_region_init_io(&s->iomem, &mcf_intc_ops, s, "mcf", 0x100);
commit 4025cfd5d7175203008343a375f9287c77cd383c
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jan 18 14:10:34 2013 +0100

    mcf5206: Pass M68kCPU to mcf5206_init()
    
    Store it in m5206_mbar_state. Prepares for passing M68kCPU to
    m68k_set_irq_level().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/hw/an5206.c b/hw/an5206.c
index 750115a..924be81 100644
--- a/hw/an5206.c
+++ b/hw/an5206.c
@@ -24,6 +24,7 @@ static void an5206_init(QEMUMachineInitArgs *args)
     ram_addr_t ram_size = args->ram_size;
     const char *cpu_model = args->cpu_model;
     const char *kernel_filename = args->kernel_filename;
+    M68kCPU *cpu;
     CPUM68KState *env;
     int kernel_size;
     uint64_t elf_entry;
@@ -32,12 +33,14 @@ static void an5206_init(QEMUMachineInitArgs *args)
     MemoryRegion *ram = g_new(MemoryRegion, 1);
     MemoryRegion *sram = g_new(MemoryRegion, 1);
 
-    if (!cpu_model)
+    if (!cpu_model) {
         cpu_model = "m5206";
-    env = cpu_init(cpu_model);
-    if (!env) {
+    }
+    cpu = cpu_m68k_init(cpu_model);
+    if (!cpu) {
         hw_error("Unable to find m68k CPU definition\n");
     }
+    env = &cpu->env;
 
     /* Initialize CPU registers.  */
     env->vbr = 0;
@@ -55,7 +58,7 @@ static void an5206_init(QEMUMachineInitArgs *args)
     vmstate_register_ram_global(sram);
     memory_region_add_subregion(address_space_mem, AN5206_RAMBAR_ADDR, sram);
 
-    mcf5206_init(address_space_mem, AN5206_MBAR_ADDR, env);
+    mcf5206_init(address_space_mem, AN5206_MBAR_ADDR, cpu);
 
     /* Load kernel.  */
     if (!kernel_filename) {
diff --git a/hw/mcf.h b/hw/mcf.h
index f929910..dc21028 100644
--- a/hw/mcf.h
+++ b/hw/mcf.h
@@ -25,6 +25,6 @@ void mcf_fec_init(struct MemoryRegion *sysmem, NICInfo *nd,
 
 /* mcf5206.c */
 qemu_irq *mcf5206_init(struct MemoryRegion *sysmem,
-                       uint32_t base, CPUM68KState *env);
+                       uint32_t base, M68kCPU *cpu);
 
 #endif
diff --git a/hw/mcf5206.c b/hw/mcf5206.c
index d8c0059..9bb393e 100644
--- a/hw/mcf5206.c
+++ b/hw/mcf5206.c
@@ -145,7 +145,7 @@ static m5206_timer_state *m5206_timer_init(qemu_irq irq)
 /* System Integration Module.  */
 
 typedef struct {
-    CPUM68KState *env;
+    M68kCPU *cpu;
     MemoryRegion iomem;
     m5206_timer_state *timer[2];
     void *uart[2];
@@ -226,7 +226,7 @@ static void m5206_mbar_update(m5206_mbar_state *s)
         level = 0;
         vector = 0;
     }
-    m68k_set_irq_level(s->env, level, vector);
+    m68k_set_irq_level(&s->cpu->env, level, vector);
 }
 
 static void m5206_mbar_set_irq(void *opaque, int irq, int level)
@@ -525,7 +525,7 @@ static const MemoryRegionOps m5206_mbar_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, CPUM68KState *env)
+qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, M68kCPU *cpu)
 {
     m5206_mbar_state *s;
     qemu_irq *pic;
@@ -541,7 +541,7 @@ qemu_irq *mcf5206_init(MemoryRegion *sysmem, uint32_t base, CPUM68KState *env)
     s->timer[1] = m5206_timer_init(pic[10]);
     s->uart[0] = mcf_uart_init(pic[12], serial_hds[0]);
     s->uart[1] = mcf_uart_init(pic[13], serial_hds[1]);
-    s->env = env;
+    s->cpu = cpu;
 
     m5206_mbar_reset(s);
     return pic;
commit c7937d9f9a99d8cc2848e85f608d89c6f326daf0
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jan 18 14:03:58 2013 +0100

    target-m68k: Return M68kCPU from cpu_m68k_init()
    
    Turn cpu_init() into a static inline function for backwards
    compatibility.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index 94937c4..ed9be80 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -117,7 +117,7 @@ typedef struct CPUM68KState {
 
 void m68k_tcg_init(void);
 void m68k_cpu_init_gdb(M68kCPU *cpu);
-CPUM68KState *cpu_m68k_init(const char *cpu_model);
+M68kCPU *cpu_m68k_init(const char *cpu_model);
 int cpu_m68k_exec(CPUM68KState *s);
 void do_interrupt(CPUM68KState *env1);
 void do_interrupt_m68k_hardirq(CPUM68KState *env1);
@@ -215,7 +215,15 @@ void register_m68k_insns (CPUM68KState *env);
 #define TARGET_PHYS_ADDR_SPACE_BITS 32
 #define TARGET_VIRT_ADDR_SPACE_BITS 32
 
-#define cpu_init cpu_m68k_init
+static inline CPUM68KState *cpu_init(const char *cpu_model)
+{
+    M68kCPU *cpu = cpu_m68k_init(cpu_model);
+    if (cpu == NULL) {
+        return NULL;
+    }
+    return &cpu->env;
+}
+
 #define cpu_exec cpu_m68k_exec
 #define cpu_gen_code cpu_m68k_gen_code
 #define cpu_signal_handler cpu_m68k_signal_handler
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 6030807..7d3fd94 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -98,7 +98,7 @@ static int fpu_gdb_set_reg(CPUM68KState *env, uint8_t *mem_buf, int n)
     return 0;
 }
 
-CPUM68KState *cpu_m68k_init(const char *cpu_model)
+M68kCPU *cpu_m68k_init(const char *cpu_model)
 {
     M68kCPU *cpu;
     CPUM68KState *env;
@@ -116,7 +116,7 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
-    return env;
+    return cpu;
 }
 
 void m68k_cpu_init_gdb(M68kCPU *cpu)
commit f3273ba643f2d0221492381b24bbc35fb6089a48
Author: Andreas Färber <afaerber at suse.de>
Date:   Fri Jan 18 15:57:51 2013 +0100

    ppc405_uc: Pass PowerPCCPU to ppc40x_{core,chip,system}_reset()
    
    Prepares for changing cpu_interrupt() argument to CPUState.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Acked-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/ppc.c b/hw/ppc.c
index 6053bd5..8cfb84f 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -300,20 +300,20 @@ static void ppc40x_set_irq(void *opaque, int pin, int level)
             if (level) {
                 LOG_IRQ("%s: reset the PowerPC system\n",
                             __func__);
-                ppc40x_system_reset(env);
+                ppc40x_system_reset(cpu);
             }
             break;
         case PPC40x_INPUT_RESET_CHIP:
             if (level) {
                 LOG_IRQ("%s: reset the PowerPC chip\n", __func__);
-                ppc40x_chip_reset(env);
+                ppc40x_chip_reset(cpu);
             }
             break;
         case PPC40x_INPUT_RESET_CORE:
             /* XXX: TODO: update DBSR[MRR] */
             if (level) {
                 LOG_IRQ("%s: reset the PowerPC core\n", __func__);
-                ppc40x_core_reset(env);
+                ppc40x_core_reset(cpu);
             }
             break;
         case PPC40x_INPUT_CINT:
@@ -1011,13 +1011,13 @@ static void cpu_4xx_wdt_cb (void *opaque)
             /* No reset */
             break;
         case 0x1: /* Core reset */
-            ppc40x_core_reset(env);
+            ppc40x_core_reset(cpu);
             break;
         case 0x2: /* Chip reset */
-            ppc40x_chip_reset(env);
+            ppc40x_chip_reset(cpu);
             break;
         case 0x3: /* System reset */
-            ppc40x_system_reset(env);
+            ppc40x_system_reset(cpu);
             break;
         }
     }
diff --git a/hw/ppc.h b/hw/ppc.h
index ee0cd16..acaf0d6 100644
--- a/hw/ppc.h
+++ b/hw/ppc.h
@@ -58,9 +58,9 @@ clk_setup_cb ppc_40x_timers_init (CPUPPCState *env, uint32_t freq,
                                   unsigned int decr_excp);
 
 /* Embedded PowerPC reset */
-void ppc40x_core_reset (CPUPPCState *env);
-void ppc40x_chip_reset (CPUPPCState *env);
-void ppc40x_system_reset (CPUPPCState *env);
+void ppc40x_core_reset(PowerPCCPU *cpu);
+void ppc40x_chip_reset(PowerPCCPU *cpu);
+void ppc40x_system_reset(PowerPCCPU *cpu);
 void PREP_debug_write (void *opaque, uint32_t addr, uint32_t val);
 
 extern CPUWriteMemoryFunc * const PPC_io_write[];
diff --git a/hw/ppc405_uc.c b/hw/ppc405_uc.c
index c96d103..d8cbe87 100644
--- a/hw/ppc405_uc.c
+++ b/hw/ppc405_uc.c
@@ -1770,8 +1770,9 @@ static void ppc405_mal_init(CPUPPCState *env, qemu_irq irqs[4])
 
 /*****************************************************************************/
 /* SPR */
-void ppc40x_core_reset (CPUPPCState *env)
+void ppc40x_core_reset(PowerPCCPU *cpu)
 {
+    CPUPPCState *env = &cpu->env;
     target_ulong dbsr;
 
     printf("Reset PowerPC core\n");
@@ -1782,8 +1783,9 @@ void ppc40x_core_reset (CPUPPCState *env)
     env->spr[SPR_40x_DBSR] = dbsr;
 }
 
-void ppc40x_chip_reset (CPUPPCState *env)
+void ppc40x_chip_reset(PowerPCCPU *cpu)
 {
+    CPUPPCState *env = &cpu->env;
     target_ulong dbsr;
 
     printf("Reset PowerPC chip\n");
@@ -1795,7 +1797,7 @@ void ppc40x_chip_reset (CPUPPCState *env)
     env->spr[SPR_40x_DBSR] = dbsr;
 }
 
-void ppc40x_system_reset (CPUPPCState *env)
+void ppc40x_system_reset(PowerPCCPU *cpu)
 {
     printf("Reset PowerPC system\n");
     qemu_system_reset_request();
@@ -1803,21 +1805,23 @@ void ppc40x_system_reset (CPUPPCState *env)
 
 void store_40x_dbcr0 (CPUPPCState *env, uint32_t val)
 {
+    PowerPCCPU *cpu = ppc_env_get_cpu(env);
+
     switch ((val >> 28) & 0x3) {
     case 0x0:
         /* No action */
         break;
     case 0x1:
         /* Core reset */
-        ppc40x_core_reset(env);
+        ppc40x_core_reset(cpu);
         break;
     case 0x2:
         /* Chip reset */
-        ppc40x_chip_reset(env);
+        ppc40x_chip_reset(cpu);
         break;
     case 0x3:
         /* System reset */
-        ppc40x_system_reset(env);
+        ppc40x_system_reset(cpu);
         break;
     }
 }
commit 25733eada6c1d4928262e77e2ee1e9ed12de18fb
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:46:45 2013 +0100

    target-xtensa: Move TCG initialization to XtensaCPU initfn
    
    Combine this with breakpoint handler registration, guarding both with
    tcg_enabled() to suppress also TCG init for qtest. Rename the handler to
    xtensa_breakpoint_handler() since it needs to become global.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index d3706a3..309bb16 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -71,8 +71,15 @@ static void xtensa_cpu_initfn(Object *obj)
 {
     XtensaCPU *cpu = XTENSA_CPU(obj);
     CPUXtensaState *env = &cpu->env;
+    static bool tcg_inited;
 
     cpu_exec_init(env);
+
+    if (tcg_enabled() && !tcg_inited) {
+        tcg_inited = true;
+        xtensa_translate_init();
+        cpu_set_debug_excp_handler(xtensa_breakpoint_handler);
+    }
 }
 
 static const VMStateDescription vmstate_xtensa_cpu = {
diff --git a/target-xtensa/cpu.h b/target-xtensa/cpu.h
index 5acf78c..dece224 100644
--- a/target-xtensa/cpu.h
+++ b/target-xtensa/cpu.h
@@ -385,6 +385,7 @@ static inline CPUXtensaState *cpu_init(const char *cpu_model)
 }
 
 void xtensa_translate_init(void);
+void xtensa_breakpoint_handler(CPUXtensaState *env);
 int cpu_xtensa_exec(CPUXtensaState *s);
 void xtensa_register_core(XtensaConfigList *node);
 void do_interrupt(CPUXtensaState *s);
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index 14bcc7e..a8a6493 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -54,7 +54,7 @@ static uint32_t check_hw_breakpoints(CPUXtensaState *env)
     return 0;
 }
 
-static void breakpoint_handler(CPUXtensaState *env)
+void xtensa_breakpoint_handler(CPUXtensaState *env)
 {
     if (env->watchpoint_hit) {
         if (env->watchpoint_hit->flags & BP_CPU) {
@@ -72,8 +72,6 @@ static void breakpoint_handler(CPUXtensaState *env)
 
 XtensaCPU *cpu_xtensa_init(const char *cpu_model)
 {
-    static int tcg_inited;
-    static int debug_handler_inited;
     XtensaCPU *cpu;
     CPUXtensaState *env;
     const XtensaConfig *config = NULL;
@@ -93,16 +91,6 @@ XtensaCPU *cpu_xtensa_init(const char *cpu_model)
     env = &cpu->env;
     env->config = config;
 
-    if (!tcg_inited) {
-        tcg_inited = 1;
-        xtensa_translate_init();
-    }
-
-    if (!debug_handler_inited && tcg_enabled()) {
-        debug_handler_inited = 1;
-        cpu_set_debug_excp_handler(breakpoint_handler);
-    }
-
     xtensa_irq_init(env);
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
commit d9c27f00b174df070470d48d6577042d2186d969
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:36:47 2013 +0100

    target-unicore32: Move TCG initialization to UniCore32CPU initfn
    
    Normalize the "inited" logic and add a tcg_enabled() check to suppress
    it for qtest.
    
    Ensures that a QOM-created UniCore32CPU is usable.
    
    Acked-by: Guan Xuetao <gxt at mprc.pku.edu.cn>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 8de17a4..7bcf3b3 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -95,6 +95,7 @@ static void uc32_cpu_initfn(Object *obj)
 {
     UniCore32CPU *cpu = UNICORE32_CPU(obj);
     CPUUniCore32State *env = &cpu->env;
+    static bool inited;
 
     cpu_exec_init(env);
 
@@ -107,6 +108,11 @@ static void uc32_cpu_initfn(Object *obj)
 #endif
 
     tlb_flush(env, 1);
+
+    if (tcg_enabled() && !inited) {
+        inited = true;
+        uc32_translate_init();
+    }
 }
 
 static const VMStateDescription vmstate_uc32_cpu = {
diff --git a/target-unicore32/helper.c b/target-unicore32/helper.c
index 2442133..7eeb9bc 100644
--- a/target-unicore32/helper.c
+++ b/target-unicore32/helper.c
@@ -30,7 +30,6 @@ CPUUniCore32State *uc32_cpu_init(const char *cpu_model)
     UniCore32CPU *cpu;
     CPUUniCore32State *env;
     ObjectClass *oc;
-    static int inited = 1;
 
     oc = cpu_class_by_name(TYPE_UNICORE32_CPU, cpu_model);
     if (oc == NULL) {
@@ -40,11 +39,6 @@ CPUUniCore32State *uc32_cpu_init(const char *cpu_model)
     env = &cpu->env;
     env->cpu_model_str = cpu_model;
 
-    if (inited) {
-        inited = 0;
-        uc32_translate_init();
-    }
-
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     return env;
commit 5266d20a12f2ef01841aad5f1692d73551a39dac
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:34:18 2013 +0100

    target-sparc: Move TCG initialization to SPARCCPU initfn
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 1690cf5..759be53 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -114,10 +114,6 @@ SPARCCPU *cpu_sparc_init(const char *cpu_model)
     cpu = SPARC_CPU(object_new(TYPE_SPARC_CPU));
     env = &cpu->env;
 
-    if (tcg_enabled()) {
-        gen_intermediate_code_init(env);
-    }
-
     if (cpu_sparc_register(env, cpu_model) < 0) {
         object_unref(OBJECT(cpu));
         return NULL;
@@ -868,6 +864,10 @@ static void sparc_cpu_initfn(Object *obj)
     CPUSPARCState *env = &cpu->env;
 
     cpu_exec_init(env);
+
+    if (tcg_enabled()) {
+        gen_intermediate_code_init(env);
+    }
 }
 
 static void sparc_cpu_uninitfn(Object *obj)
commit aa7408ec18c3517b2476a3671cd0b7f171241e2d
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:30:32 2013 +0100

    target-sh4: Move TCG initialization to SuperHCPU initfn
    
    Add a tcg_enabled() check to suppress it for qtest.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index c66442f..dc5d756 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -73,6 +73,10 @@ static void superh_cpu_initfn(Object *obj)
     cpu_exec_init(env);
 
     env->movcal_backup_tail = &(env->movcal_backup);
+
+    if (tcg_enabled()) {
+        sh4_translate_init();
+    }
 }
 
 static const VMStateDescription vmstate_sh_cpu = {
diff --git a/target-sh4/cpu.h b/target-sh4/cpu.h
index 34e9b0a..49dcd9e 100644
--- a/target-sh4/cpu.h
+++ b/target-sh4/cpu.h
@@ -191,6 +191,7 @@ typedef struct CPUSH4State {
 
 #include "cpu-qom.h"
 
+void sh4_translate_init(void);
 SuperHCPU *cpu_sh4_init(const char *cpu_model);
 int cpu_sh4_exec(CPUSH4State * s);
 int cpu_sh4_signal_handler(int host_signum, void *pinfo,
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 2409a10..c58d79a 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -71,7 +71,7 @@ static uint32_t gen_opc_hflags[OPC_BUF_SIZE];
 
 #include "exec/gen-icount.h"
 
-static void sh4_translate_init(void)
+void sh4_translate_init(void)
 {
     int i;
     static int done_init = 0;
@@ -251,7 +251,6 @@ SuperHCPU *cpu_sh4_init(const char *cpu_model)
     cpu = SUPERH_CPU(object_new(TYPE_SUPERH_CPU));
     env = &cpu->env;
     env->features = def->features;
-    sh4_translate_init();
     env->cpu_model_str = cpu_model;
     cpu_register(env, def);
 
commit 2b7ac76729c8253d799a8d3bb9bae76cccb0714e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 19 22:43:32 2013 +0100

    target-s390x: Move TCG initialization to S390CPU initfn
    
    Ensures that a QOM-created S390CPU is usable.
    
    Acked-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index ee15783..787c937 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -112,6 +112,7 @@ static void s390_cpu_initfn(Object *obj)
 {
     S390CPU *cpu = S390_CPU(obj);
     CPUS390XState *env = &cpu->env;
+    static bool inited;
     static int cpu_num = 0;
 #if !defined(CONFIG_USER_ONLY)
     struct tm tm;
@@ -133,6 +134,11 @@ static void s390_cpu_initfn(Object *obj)
 #endif
     env->cpu_num = cpu_num++;
     env->ext_index = -1;
+
+    if (tcg_enabled() && !inited) {
+        inited = true;
+        s390x_translate_init();
+    }
 }
 
 static void s390_cpu_finalize(Object *obj)
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index d3bb456..1183b45 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -74,16 +74,9 @@ S390CPU *cpu_s390x_init(const char *cpu_model)
 {
     S390CPU *cpu;
     CPUS390XState *env;
-    static int inited;
 
     cpu = S390_CPU(object_new(TYPE_S390_CPU));
     env = &cpu->env;
-
-    if (tcg_enabled() && !inited) {
-        inited = 1;
-        s390x_translate_init();
-    }
-
     env->cpu_model_str = cpu_model;
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
commit 60925d2644953ce1ca7813411853d8c04e637050
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:26:37 2013 +0100

    target-ppc: Move TCG initialization to PowerPCCPU initfn
    
    Ensures that a QOM-created PowerPCCPU is usable.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 49eaeac..5a2acaa 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -10349,11 +10349,6 @@ PowerPCCPU *cpu_ppc_init(const char *cpu_model)
 
     cpu = POWERPC_CPU(object_new(object_class_get_name(oc)));
     env = &cpu->env;
-
-    if (tcg_enabled()) {
-        ppc_translate_init();
-    }
-
     env->cpu_model_str = cpu_model;
 
     object_property_set_bool(OBJECT(cpu), true, "realized", &err);
@@ -10571,6 +10566,10 @@ static void ppc_cpu_initfn(Object *obj)
         env->sps = defsps;
     }
 #endif /* defined(TARGET_PPC64) */
+
+    if (tcg_enabled()) {
+        ppc_translate_init();
+    }
 }
 
 static void ppc_cpu_class_init(ObjectClass *oc, void *data)
commit 78ce64f492498050083e46cdd7e6cbae6435843c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:22:25 2013 +0100

    target-mips: Move TCG initialization to MIPSCPU initfn
    
    Make mips_tcg_init() non-static and add tcg_enabled() check to suppress
    it for qtest.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 18895da..09d6172 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -59,6 +59,10 @@ static void mips_cpu_initfn(Object *obj)
     CPUMIPSState *env = &cpu->env;
 
     cpu_exec_init(env);
+
+    if (tcg_enabled()) {
+        mips_tcg_init();
+    }
 }
 
 static void mips_cpu_class_init(ObjectClass *c, void *data)
diff --git a/target-mips/cpu.h b/target-mips/cpu.h
index 5963d62..0e198b1 100644
--- a/target-mips/cpu.h
+++ b/target-mips/cpu.h
@@ -629,6 +629,7 @@ enum {
 #define CPU_INTERRUPT_WAKE CPU_INTERRUPT_TGT_INT_0
 
 int cpu_mips_exec(CPUMIPSState *s);
+void mips_tcg_init(void);
 MIPSCPU *cpu_mips_init(const char *cpu_model);
 int cpu_mips_signal_handler(int host_signum, void *pinfo, void *puc);
 
diff --git a/target-mips/translate.c b/target-mips/translate.c
index d7f650e..4ee9615 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15836,7 +15836,7 @@ void cpu_dump_state (CPUMIPSState *env, FILE *f, fprintf_function cpu_fprintf,
 #endif
 }
 
-static void mips_tcg_init(void)
+void mips_tcg_init(void)
 {
     int i;
     static int inited;
@@ -15915,7 +15915,6 @@ MIPSCPU *cpu_mips_init(const char *cpu_model)
 #endif
     fpu_init(env, def);
     mvp_init(env, def);
-    mips_tcg_init();
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
commit cd0c24f9095b1f825210bb9d9f99532c78668074
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 01:10:52 2013 +0100

    target-microblaze: Move TCG initialization to MicroBlazeCPU initfn
    
    Split off TCG initialization from cpu_mb_init() into mb_tcg_init() to
    call it from the initfn.
    
    Ensures that a QOM-created MicroBlazeCPU is usable.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index baae47b..28b5a88 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -100,10 +100,16 @@ static void mb_cpu_initfn(Object *obj)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);
     CPUMBState *env = &cpu->env;
+    static bool tcg_initialized;
 
     cpu_exec_init(env);
 
     set_float_rounding_mode(float_round_nearest_even, &env->fp_status);
+
+    if (tcg_enabled() && !tcg_initialized) {
+        tcg_initialized = true;
+        mb_tcg_init();
+    }
 }
 
 static const VMStateDescription vmstate_mb_cpu = {
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 41480e7..c3dd7f6 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -272,6 +272,7 @@ struct CPUMBState {
 
 #include "cpu-qom.h"
 
+void mb_tcg_init(void);
 MicroBlazeCPU *cpu_mb_init(const char *cpu_model);
 int cpu_mb_exec(CPUMBState *s);
 void do_interrupt(CPUMBState *env);
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index a84856b..12ea820 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1965,18 +1965,17 @@ void cpu_dump_state (CPUMBState *env, FILE *f, fprintf_function cpu_fprintf,
 MicroBlazeCPU *cpu_mb_init(const char *cpu_model)
 {
     MicroBlazeCPU *cpu;
-    static int tcg_initialized = 0;
-    int i;
 
     cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
-    if (tcg_initialized) {
-        return cpu;
-    }
+    return cpu;
+}
 
-    tcg_initialized = 1;
+void mb_tcg_init(void)
+{
+    int i;
 
     cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
 
@@ -2007,8 +2006,6 @@ MicroBlazeCPU *cpu_mb_init(const char *cpu_model)
     }
 #define GEN_HELPER 2
 #include "helper.h"
-
-    return cpu;
 }
 
 void restore_state_to_opc(CPUMBState *env, TranslationBlock *tb, int pc_pos)
commit 1cc896195bae54d7a5f48f9032037d8f6f65abd5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 00:48:29 2013 +0100

    target-m68k: Move TCG initialization to M68kCPU initfn
    
    Add a tcg_enabled() check to suppress it for qtest.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index e3eaffc..42735db 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -156,8 +156,14 @@ static void m68k_cpu_initfn(Object *obj)
 {
     M68kCPU *cpu = M68K_CPU(obj);
     CPUM68KState *env = &cpu->env;
+    static bool inited;
 
     cpu_exec_init(env);
+
+    if (tcg_enabled() && !inited) {
+        inited = true;
+        m68k_tcg_init();
+    }
 }
 
 static const VMStateDescription vmstate_m68k_cpu = {
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 3ae6fa0..6030807 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -103,7 +103,6 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     M68kCPU *cpu;
     CPUM68KState *env;
     ObjectClass *oc;
-    static int inited;
 
     oc = cpu_class_by_name(TYPE_M68K_CPU, cpu_model);
     if (oc == NULL) {
@@ -111,12 +110,6 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     }
     cpu = M68K_CPU(object_new(object_class_get_name(oc)));
     env = &cpu->env;
-
-    if (!inited) {
-        inited = 1;
-        m68k_tcg_init();
-    }
-
     env->cpu_model_str = cpu_model;
 
     register_m68k_insns(env);
commit 868e2824276cbe6ef2e202c05c4eb3a3a19d3ee0
Author: Andreas Färber <afaerber at suse.de>
Date:   Sun Jan 20 00:05:12 2013 +0100

    target-lm32: Move TCG initialization to LM32CPU initfn
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index 6a84f51..5f16734 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -58,10 +58,16 @@ static void lm32_cpu_initfn(Object *obj)
 {
     LM32CPU *cpu = LM32_CPU(obj);
     CPULM32State *env = &cpu->env;
+    static bool tcg_initialized;
 
     cpu_exec_init(env);
 
     env->flags = 0;
+
+    if (tcg_enabled() && !tcg_initialized) {
+        tcg_initialized = true;
+        lm32_translate_init();
+    }
 }
 
 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index a6691ad..47ae7e7 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -197,7 +197,6 @@ LM32CPU *cpu_lm32_init(const char *cpu_model)
     LM32CPU *cpu;
     CPULM32State *env;
     const LM32Def *def;
-    static int tcg_initialized;
 
     def = cpu_lm32_find_by_name(cpu_model);
     if (!def) {
@@ -212,11 +211,6 @@ LM32CPU *cpu_lm32_init(const char *cpu_model)
     env->num_wps = def->num_watchpoints;
     env->cfg = cfg_by_def(def);
 
-    if (tcg_enabled() && !tcg_initialized) {
-        tcg_initialized = 1;
-        lm32_translate_init();
-    }
-
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     return cpu;
commit d1a94fec3d8d70009fd5ac27ade5539fe58cd702
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 19 23:55:42 2013 +0100

    target-cris: Move TCG initialization to CRISCPU initfn
    
    Split out TCG initialization from cpu_cris_init(). Avoid CPUCRISState
    dependency for v10-specific initialization and for non-v10 by inlining
    the decision into the initfn as well.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 34c4f75..fedf641 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -70,8 +70,18 @@ static void cris_cpu_initfn(Object *obj)
 {
     CRISCPU *cpu = CRIS_CPU(obj);
     CPUCRISState *env = &cpu->env;
+    static bool tcg_initialized;
 
     cpu_exec_init(env);
+
+    if (tcg_enabled() && !tcg_initialized) {
+        tcg_initialized = true;
+        if (env->pregs[PR_VR] < 32) {
+            cris_initialize_crisv10_tcg();
+        } else {
+            cris_initialize_tcg();
+        }
+    }
 }
 
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
diff --git a/target-cris/cpu.h b/target-cris/cpu.h
index 257cb52..ebf2d40 100644
--- a/target-cris/cpu.h
+++ b/target-cris/cpu.h
@@ -182,6 +182,9 @@ void do_interrupt(CPUCRISState *env);
 int cpu_cris_signal_handler(int host_signum, void *pinfo,
                            void *puc);
 
+void cris_initialize_tcg(void);
+void cris_initialize_crisv10_tcg(void);
+
 enum {
     CC_OP_DYNAMIC, /* Use env->cc_op  */
     CC_OP_FLAGS,
diff --git a/target-cris/translate.c b/target-cris/translate.c
index 25ff490..25a43fa 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3550,8 +3550,6 @@ CRISCPU *cpu_cris_init(const char *cpu_model)
 {
     CRISCPU *cpu;
     CPUCRISState *env;
-    static int tcg_initialized = 0;
-    int i;
 
     cpu = CRIS_CPU(object_new(TYPE_CRIS_CPU));
     env = &cpu->env;
@@ -3560,21 +3558,16 @@ CRISCPU *cpu_cris_init(const char *cpu_model)
 
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
-    if (tcg_initialized) {
-        return cpu;
-    }
+    return cpu;
+}
 
-    tcg_initialized = 1;
+void cris_initialize_tcg(void)
+{
+    int i;
 
 #define GEN_HELPER 2
 #include "helper.h"
 
-    if (env->pregs[PR_VR] < 32) {
-        cpu_crisv10_init(env);
-        return cpu;
-    }
-
-
     cpu_env = tcg_global_reg_new_ptr(TCG_AREG0, "env");
     cc_x = tcg_global_mem_new(TCG_AREG0,
                               offsetof(CPUCRISState, cc_x), "cc_x");
@@ -3614,8 +3607,6 @@ CRISCPU *cpu_cris_init(const char *cpu_model)
                                        offsetof(CPUCRISState, pregs[i]),
                                        pregnames[i]);
     }
-
-    return cpu;
 }
 
 void restore_state_to_opc(CPUCRISState *env, TranslationBlock *tb, int pc_pos)
diff --git a/target-cris/translate_v10.c b/target-cris/translate_v10.c
index d2cca89..d6ef084 100644
--- a/target-cris/translate_v10.c
+++ b/target-cris/translate_v10.c
@@ -1257,7 +1257,7 @@ static unsigned int crisv10_decoder(CPUCRISState *env, DisasContext *dc)
     return insn_len;
 }
 
-static CPUCRISState *cpu_crisv10_init (CPUCRISState *env)
+void cris_initialize_crisv10_tcg(void)
 {
 	int i;
 
@@ -1300,7 +1300,4 @@ static CPUCRISState *cpu_crisv10_init (CPUCRISState *env)
 					       offsetof(CPUCRISState, pregs[i]),
 					       pregnames_v10[i]);
 	}
-
-	return env;
 }
-
commit 79614b781df5096ffecf531992314781dbab54af
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 19 07:37:45 2013 +0100

    target-arm: Move TCG initialization to ARMCPU initfn
    
    Ensures that a QOM-created ARMCPU is usable.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 9915172..f54d200 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -135,10 +135,16 @@ static inline void set_feature(CPUARMState *env, int feature)
 static void arm_cpu_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    static bool inited;
 
     cpu_exec_init(&cpu->env);
     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
                                          g_free, g_free);
+
+    if (tcg_enabled() && !inited) {
+        inited = true;
+        arm_translate_init();
+    }
 }
 
 static void arm_cpu_finalizefn(Object *obj)
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 4538a09..e63da57 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1263,7 +1263,6 @@ ARMCPU *cpu_arm_init(const char *cpu_model)
     ARMCPU *cpu;
     CPUARMState *env;
     ObjectClass *oc;
-    static int inited = 0;
 
     oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);
     if (!oc) {
@@ -1276,11 +1275,6 @@ ARMCPU *cpu_arm_init(const char *cpu_model)
     /* TODO this should be set centrally, once possible */
     object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
-    if (tcg_enabled() && !inited) {
-        inited = 1;
-        arm_translate_init();
-    }
-
     return cpu;
 }
 
commit 5f6c964389ea5320e81e2fb8c2bc3aa40c5a8013
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 04:19:35 2013 +0100

    target-xtensa: Introduce QOM realizefn for XtensaCPU
    
    Introduce realizefn and set realized = true in cpu_xtensa_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-xtensa/cpu-qom.h b/target-xtensa/cpu-qom.h
index e344a9a..270de16 100644
--- a/target-xtensa/cpu-qom.h
+++ b/target-xtensa/cpu-qom.h
@@ -43,6 +43,7 @@
 
 /**
  * XtensaCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * An Xtensa CPU model.
@@ -52,6 +53,7 @@ typedef struct XtensaCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } XtensaCPUClass;
 
diff --git a/target-xtensa/cpu.c b/target-xtensa/cpu.c
index ebc7e99..d3706a3 100644
--- a/target-xtensa/cpu.c
+++ b/target-xtensa/cpu.c
@@ -57,6 +57,16 @@ static void xtensa_cpu_reset(CPUState *s)
     reset_mmu(env);
 }
 
+static void xtensa_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    XtensaCPU *cpu = XTENSA_CPU(dev);
+    XtensaCPUClass *xcc = XTENSA_CPU_GET_CLASS(dev);
+
+    qemu_init_vcpu(&cpu->env);
+
+    xcc->parent_realize(dev, errp);
+}
+
 static void xtensa_cpu_initfn(Object *obj)
 {
     XtensaCPU *cpu = XTENSA_CPU(obj);
@@ -76,6 +86,9 @@ static void xtensa_cpu_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
     XtensaCPUClass *xcc = XTENSA_CPU_CLASS(cc);
 
+    xcc->parent_realize = dc->realize;
+    dc->realize = xtensa_cpu_realizefn;
+
     xcc->parent_reset = cc->reset;
     cc->reset = xtensa_cpu_reset;
 
diff --git a/target-xtensa/helper.c b/target-xtensa/helper.c
index 94c03a1..14bcc7e 100644
--- a/target-xtensa/helper.c
+++ b/target-xtensa/helper.c
@@ -104,7 +104,9 @@ XtensaCPU *cpu_xtensa_init(const char *cpu_model)
     }
 
     xtensa_irq_init(env);
-    qemu_init_vcpu(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
commit 088383e3220776917f538d0e43933e842e16b804
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 14:38:30 2013 +0100

    target-unicore32: Introduce QOM realizefn for UniCore32CPU
    
    Introduce a realizefn and set realized = true in uc32_cpu_init().
    
    Acked-by: Guan Xuetao <gxt at mprc.pku.edu.cn>
    [AF: Invoke the parent's realizefn]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-unicore32/cpu-qom.h b/target-unicore32/cpu-qom.h
index fe40b2d..625c614 100644
--- a/target-unicore32/cpu-qom.h
+++ b/target-unicore32/cpu-qom.h
@@ -25,6 +25,7 @@
 
 /**
  * UniCore32CPUClass:
+ * @parent_realize: The parent class' realize handler.
  *
  * A UniCore32 CPU model.
  */
@@ -32,6 +33,8 @@ typedef struct UniCore32CPUClass {
     /*< private >*/
     CPUClass parent_class;
     /*< public >*/
+
+    DeviceRealize parent_realize;
 } UniCore32CPUClass;
 
 /**
diff --git a/target-unicore32/cpu.c b/target-unicore32/cpu.c
index 4e4177f..8de17a4 100644
--- a/target-unicore32/cpu.c
+++ b/target-unicore32/cpu.c
@@ -81,6 +81,16 @@ static const UniCore32CPUInfo uc32_cpus[] = {
     { .name = "any",        .instance_init = uc32_any_cpu_initfn },
 };
 
+static void uc32_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    UniCore32CPU *cpu = UNICORE32_CPU(dev);
+    UniCore32CPUClass *ucc = UNICORE32_CPU_GET_CLASS(dev);
+
+    qemu_init_vcpu(&cpu->env);
+
+    ucc->parent_realize(dev, errp);
+}
+
 static void uc32_cpu_initfn(Object *obj)
 {
     UniCore32CPU *cpu = UNICORE32_CPU(obj);
@@ -108,6 +118,10 @@ static void uc32_cpu_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    UniCore32CPUClass *ucc = UNICORE32_CPU_CLASS(oc);
+
+    ucc->parent_realize = dc->realize;
+    dc->realize = uc32_cpu_realizefn;
 
     cc->class_by_name = uc32_cpu_class_by_name;
     dc->vmsd = &vmstate_uc32_cpu;
diff --git a/target-unicore32/helper.c b/target-unicore32/helper.c
index 3a92232..2442133 100644
--- a/target-unicore32/helper.c
+++ b/target-unicore32/helper.c
@@ -45,7 +45,8 @@ CPUUniCore32State *uc32_cpu_init(const char *cpu_model)
         uc32_translate_init();
     }
 
-    qemu_init_vcpu(env);
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return env;
 }
 
commit b6e91ebfe06f1d90331d162259553a5330514143
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 04:13:19 2013 +0100

    target-sparc: Introduce QOM realizefn for SPARCCPU
    
    Introduce realizefn and set realized = true in cpu_sparc_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sparc/cpu-qom.h b/target-sparc/cpu-qom.h
index 2a738ae..89cd1cf 100644
--- a/target-sparc/cpu-qom.h
+++ b/target-sparc/cpu-qom.h
@@ -38,6 +38,7 @@
 
 /**
  * SPARCCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A SPARC CPU model.
@@ -47,6 +48,7 @@ typedef struct SPARCCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } SPARCCPUClass;
 
diff --git a/target-sparc/cpu.c b/target-sparc/cpu.c
index 4bc1afc..1690cf5 100644
--- a/target-sparc/cpu.c
+++ b/target-sparc/cpu.c
@@ -122,7 +122,8 @@ SPARCCPU *cpu_sparc_init(const char *cpu_model)
         object_unref(OBJECT(cpu));
         return NULL;
     }
-    qemu_init_vcpu(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     return cpu;
 }
@@ -851,6 +852,16 @@ void cpu_dump_state(CPUSPARCState *env, FILE *f, fprintf_function cpu_fprintf,
     cpu_fprintf(f, "\n");
 }
 
+static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    SPARCCPU *cpu = SPARC_CPU(dev);
+    SPARCCPUClass *scc = SPARC_CPU_GET_CLASS(dev);
+
+    qemu_init_vcpu(&cpu->env);
+
+    scc->parent_realize(dev, errp);
+}
+
 static void sparc_cpu_initfn(Object *obj)
 {
     SPARCCPU *cpu = SPARC_CPU(obj);
@@ -871,6 +882,10 @@ static void sparc_cpu_class_init(ObjectClass *oc, void *data)
 {
     SPARCCPUClass *scc = SPARC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    scc->parent_realize = dc->realize;
+    dc->realize = sparc_cpu_realizefn;
 
     scc->parent_reset = cc->reset;
     cc->reset = sparc_cpu_reset;
commit 55acb588dd184a1e33be0ff1fe23f8c19f88fd6c
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Apr 23 18:16:02 2012 +0200

    target-sh4: Introduce QOM realizefn for SuperHCPU
    
    Introduce a realizefn and set realized = true in cpu_sh4_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-sh4/cpu-qom.h b/target-sh4/cpu-qom.h
index 09573c9..d368db1 100644
--- a/target-sh4/cpu-qom.h
+++ b/target-sh4/cpu-qom.h
@@ -33,6 +33,7 @@
 
 /**
  * SuperHCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A SuperH CPU model.
@@ -42,6 +43,7 @@ typedef struct SuperHCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } SuperHCPUClass;
 
diff --git a/target-sh4/cpu.c b/target-sh4/cpu.c
index d283122..c66442f 100644
--- a/target-sh4/cpu.c
+++ b/target-sh4/cpu.c
@@ -54,6 +54,17 @@ static void superh_cpu_reset(CPUState *s)
     set_default_nan_mode(1, &env->fp_status);
 }
 
+static void superh_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    SuperHCPU *cpu = SUPERH_CPU(dev);
+    SuperHCPUClass *scc = SUPERH_CPU_GET_CLASS(dev);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(&cpu->env);
+
+    scc->parent_realize(dev, errp);
+}
+
 static void superh_cpu_initfn(Object *obj)
 {
     SuperHCPU *cpu = SUPERH_CPU(obj);
@@ -75,6 +86,9 @@ static void superh_cpu_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
     SuperHCPUClass *scc = SUPERH_CPU_CLASS(oc);
 
+    scc->parent_realize = dc->realize;
+    dc->realize = superh_cpu_realizefn;
+
     scc->parent_reset = cc->reset;
     cc->reset = superh_cpu_reset;
 
diff --git a/target-sh4/translate.c b/target-sh4/translate.c
index 260aaab..2409a10 100644
--- a/target-sh4/translate.c
+++ b/target-sh4/translate.c
@@ -253,9 +253,10 @@ SuperHCPU *cpu_sh4_init(const char *cpu_model)
     env->features = def->features;
     sh4_translate_init();
     env->cpu_model_str = cpu_model;
-    cpu_reset(CPU(cpu));
     cpu_register(env, def);
-    qemu_init_vcpu(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
commit 1f1366322b21678c33003a373366697a4542d2d4
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 04:00:41 2013 +0100

    target-s390x: Introduce QOM realizefn for S390CPU
    
    Introduce realizefn and set realized = true in cpu_s390x_init().
    
    Defer CPU reset from initfn to realizefn.
    
    Acked-by: Richard Henderson <rth at twiddle.net>
    [AF: Invoke parent's realizefn]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-s390x/cpu-qom.h b/target-s390x/cpu-qom.h
index d54e4a2..237184f 100644
--- a/target-s390x/cpu-qom.h
+++ b/target-s390x/cpu-qom.h
@@ -34,6 +34,7 @@
 
 /**
  * S390CPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * An S/390 CPU model.
@@ -43,6 +44,7 @@ typedef struct S390CPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } S390CPUClass;
 
diff --git a/target-s390x/cpu.c b/target-s390x/cpu.c
index d765e7b..ee15783 100644
--- a/target-s390x/cpu.c
+++ b/target-s390x/cpu.c
@@ -97,6 +97,17 @@ static void s390_cpu_machine_reset_cb(void *opaque)
 }
 #endif
 
+static void s390_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    S390CPU *cpu = S390_CPU(dev);
+    S390CPUClass *scc = S390_CPU_GET_CLASS(dev);
+
+    qemu_init_vcpu(&cpu->env);
+    cpu_reset(CPU(cpu));
+
+    scc->parent_realize(dev, errp);
+}
+
 static void s390_cpu_initfn(Object *obj)
 {
     S390CPU *cpu = S390_CPU(obj);
@@ -122,8 +133,6 @@ static void s390_cpu_initfn(Object *obj)
 #endif
     env->cpu_num = cpu_num++;
     env->ext_index = -1;
-
-    cpu_reset(CPU(cpu));
 }
 
 static void s390_cpu_finalize(Object *obj)
@@ -146,6 +155,9 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(scc);
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    scc->parent_realize = dc->realize;
+    dc->realize = s390_cpu_realizefn;
+
     scc->parent_reset = cc->reset;
     cc->reset = s390_cpu_reset;
 
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 7626831..d3bb456 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -85,7 +85,9 @@ S390CPU *cpu_s390x_init(const char *cpu_model)
     }
 
     env->cpu_model_str = cpu_model;
-    qemu_init_vcpu(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
commit c1caf1d961288e41c25de6631c6751ae7baa20f0
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 03:48:37 2013 +0100

    target-mips: Introduce QOM realizefn for MIPSCPU
    
    Introduce a realizefn and set realized = true from cpu_mips_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-mips/cpu-qom.h b/target-mips/cpu-qom.h
index 2a4b812..55aa692 100644
--- a/target-mips/cpu-qom.h
+++ b/target-mips/cpu-qom.h
@@ -37,6 +37,7 @@
 
 /**
  * MIPSCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A MIPS CPU model.
@@ -46,6 +47,7 @@ typedef struct MIPSCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } MIPSCPUClass;
 
diff --git a/target-mips/cpu.c b/target-mips/cpu.c
index 10ff46d..18895da 100644
--- a/target-mips/cpu.c
+++ b/target-mips/cpu.c
@@ -42,6 +42,17 @@ static void mips_cpu_reset(CPUState *s)
     cpu_state_reset(env);
 }
 
+static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    MIPSCPU *cpu = MIPS_CPU(dev);
+    MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(&cpu->env);
+
+    mcc->parent_realize(dev, errp);
+}
+
 static void mips_cpu_initfn(Object *obj)
 {
     MIPSCPU *cpu = MIPS_CPU(obj);
@@ -54,6 +65,10 @@ static void mips_cpu_class_init(ObjectClass *c, void *data)
 {
     MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
     CPUClass *cc = CPU_CLASS(c);
+    DeviceClass *dc = DEVICE_CLASS(c);
+
+    mcc->parent_realize = dc->realize;
+    dc->realize = mips_cpu_realizefn;
 
     mcc->parent_reset = cc->reset;
     cc->reset = mips_cpu_reset;
diff --git a/target-mips/translate.c b/target-mips/translate.c
index 3b77b53..d7f650e 100644
--- a/target-mips/translate.c
+++ b/target-mips/translate.c
@@ -15916,8 +15916,9 @@ MIPSCPU *cpu_mips_init(const char *cpu_model)
     fpu_init(env, def);
     mvp_init(env, def);
     mips_tcg_init();
-    cpu_reset(CPU(cpu));
-    qemu_init_vcpu(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
commit 746b03b27cac48be5a376d8635ffaf568339ebd7
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 15:27:31 2013 +0100

    target-microblaze: Introduce QOM realizefn for MicroBlazeCPU
    
    Introduce realizefn and set realized = true from cpu_mb_init().
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-microblaze/cpu-qom.h b/target-microblaze/cpu-qom.h
index f75549d..5ea911c 100644
--- a/target-microblaze/cpu-qom.h
+++ b/target-microblaze/cpu-qom.h
@@ -33,6 +33,7 @@
 
 /**
  * MicroBlazeCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A MicroBlaze CPU model.
@@ -42,6 +43,7 @@ typedef struct MicroBlazeCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } MicroBlazeCPUClass;
 
diff --git a/target-microblaze/cpu.c b/target-microblaze/cpu.c
index 39230fd..baae47b 100644
--- a/target-microblaze/cpu.c
+++ b/target-microblaze/cpu.c
@@ -85,6 +85,17 @@ static void mb_cpu_reset(CPUState *s)
 #endif
 }
 
+static void mb_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    MicroBlazeCPU *cpu = MICROBLAZE_CPU(dev);
+    MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_GET_CLASS(dev);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(&cpu->env);
+
+    mcc->parent_realize(dev, errp);
+}
+
 static void mb_cpu_initfn(Object *obj)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(obj);
@@ -106,6 +117,9 @@ static void mb_cpu_class_init(ObjectClass *oc, void *data)
     CPUClass *cc = CPU_CLASS(oc);
     MicroBlazeCPUClass *mcc = MICROBLAZE_CPU_CLASS(oc);
 
+    mcc->parent_realize = dc->realize;
+    dc->realize = mb_cpu_realizefn;
+
     mcc->parent_reset = cc->reset;
     cc->reset = mb_cpu_reset;
 
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index 58ce712..a84856b 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -1970,8 +1970,7 @@ MicroBlazeCPU *cpu_mb_init(const char *cpu_model)
 
     cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU));
 
-    cpu_reset(CPU(cpu));
-    qemu_init_vcpu(&cpu->env);
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     if (tcg_initialized) {
         return cpu;
commit 6d1bbc6273d45520c5ce6475186bfa30d8afb47c
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 15:15:30 2013 +0100

    target-m68k: Introduce QOM realizefn for M68kCPU
    
    Introduce realizefn and set realized = true in cpu_m68k_init().
    
    Split off GDB registration to a new m68k_cpu_init_gdb() so that it can
    be called from the realizefn.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-m68k/cpu-qom.h b/target-m68k/cpu-qom.h
index 170daa7..20e5684 100644
--- a/target-m68k/cpu-qom.h
+++ b/target-m68k/cpu-qom.h
@@ -33,6 +33,7 @@
 
 /**
  * M68kCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A Motorola 68k CPU model.
@@ -42,6 +43,7 @@ typedef struct M68kCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } M68kCPUClass;
 
diff --git a/target-m68k/cpu.c b/target-m68k/cpu.c
index c71f715..e3eaffc 100644
--- a/target-m68k/cpu.c
+++ b/target-m68k/cpu.c
@@ -139,6 +139,19 @@ static const M68kCPUInfo m68k_cpus[] = {
     { .name = "any",   .instance_init = any_cpu_initfn },
 };
 
+static void m68k_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    M68kCPU *cpu = M68K_CPU(dev);
+    M68kCPUClass *mcc = M68K_CPU_GET_CLASS(dev);
+
+    m68k_cpu_init_gdb(cpu);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(&cpu->env);
+
+    mcc->parent_realize(dev, errp);
+}
+
 static void m68k_cpu_initfn(Object *obj)
 {
     M68kCPU *cpu = M68K_CPU(obj);
@@ -158,6 +171,9 @@ static void m68k_cpu_class_init(ObjectClass *c, void *data)
     CPUClass *cc = CPU_CLASS(c);
     DeviceClass *dc = DEVICE_CLASS(c);
 
+    mcc->parent_realize = dc->realize;
+    dc->realize = m68k_cpu_realizefn;
+
     mcc->parent_reset = cc->reset;
     cc->reset = m68k_cpu_reset;
 
diff --git a/target-m68k/cpu.h b/target-m68k/cpu.h
index adaf56c..94937c4 100644
--- a/target-m68k/cpu.h
+++ b/target-m68k/cpu.h
@@ -116,6 +116,7 @@ typedef struct CPUM68KState {
 #include "cpu-qom.h"
 
 void m68k_tcg_init(void);
+void m68k_cpu_init_gdb(M68kCPU *cpu);
 CPUM68KState *cpu_m68k_init(const char *cpu_model);
 int cpu_m68k_exec(CPUM68KState *s);
 void do_interrupt(CPUM68KState *env1);
diff --git a/target-m68k/helper.c b/target-m68k/helper.c
index 5ddcd70..3ae6fa0 100644
--- a/target-m68k/helper.c
+++ b/target-m68k/helper.c
@@ -120,15 +120,21 @@ CPUM68KState *cpu_m68k_init(const char *cpu_model)
     env->cpu_model_str = cpu_model;
 
     register_m68k_insns(env);
+
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
+    return env;
+}
+
+void m68k_cpu_init_gdb(M68kCPU *cpu)
+{
+    CPUM68KState *env = &cpu->env;
+
     if (m68k_feature(env, M68K_FEATURE_CF_FPU)) {
         gdb_register_coprocessor(env, fpu_gdb_get_reg, fpu_gdb_set_reg,
                                  11, "cf-fp.xml", 18);
     }
     /* TODO: Add [E]MAC registers.  */
-
-    cpu_reset(ENV_GET_CPU(env));
-    qemu_init_vcpu(env);
-    return env;
 }
 
 void cpu_m68k_flush_flags(CPUM68KState *env, int cc_op)
commit 9c23169e8cd54b490d55221b6498d42966f964f3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 03:31:27 2013 +0100

    target-lm32: Introduce QOM realizefn for LM32CPU
    
    Introduce a realizefn and set realized = true in cpu_lm32_init().
    
    Also move cpu_reset() call from initfn to realizefn.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-lm32/cpu-qom.h b/target-lm32/cpu-qom.h
index 400cdbd..d7525b3 100644
--- a/target-lm32/cpu-qom.h
+++ b/target-lm32/cpu-qom.h
@@ -34,6 +34,7 @@
 
 /**
  * LM32CPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A LatticeMico32 CPU model.
@@ -43,6 +44,7 @@ typedef struct LM32CPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } LM32CPUClass;
 
diff --git a/target-lm32/cpu.c b/target-lm32/cpu.c
index eca2dca..6a84f51 100644
--- a/target-lm32/cpu.c
+++ b/target-lm32/cpu.c
@@ -42,6 +42,18 @@ static void lm32_cpu_reset(CPUState *s)
     memset(env, 0, offsetof(CPULM32State, breakpoints));
 }
 
+static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    LM32CPU *cpu = LM32_CPU(dev);
+    LM32CPUClass *lcc = LM32_CPU_GET_CLASS(dev);
+
+    cpu_reset(CPU(cpu));
+
+    qemu_init_vcpu(&cpu->env);
+
+    lcc->parent_realize(dev, errp);
+}
+
 static void lm32_cpu_initfn(Object *obj)
 {
     LM32CPU *cpu = LM32_CPU(obj);
@@ -50,14 +62,16 @@ static void lm32_cpu_initfn(Object *obj)
     cpu_exec_init(env);
 
     env->flags = 0;
-
-    cpu_reset(CPU(cpu));
 }
 
 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
 {
     LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    lcc->parent_realize = dc->realize;
+    dc->realize = lm32_cpu_realizefn;
 
     lcc->parent_reset = cc->reset;
     cc->reset = lm32_cpu_reset;
diff --git a/target-lm32/helper.c b/target-lm32/helper.c
index d76ea3f..a6691ad 100644
--- a/target-lm32/helper.c
+++ b/target-lm32/helper.c
@@ -212,13 +212,13 @@ LM32CPU *cpu_lm32_init(const char *cpu_model)
     env->num_wps = def->num_watchpoints;
     env->cfg = cfg_by_def(def);
 
-    qemu_init_vcpu(env);
-
     if (tcg_enabled() && !tcg_initialized) {
         tcg_initialized = 1;
         lm32_translate_init();
     }
 
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
commit ca45f8b0440358ccca63446cf0df05772791b2a1
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 15:41:21 2013 +0100

    target-cris: Introduce QOM realizefn for CRISCPU
    
    Introduce realizefn and set realized = true from cpu_cris_init().
    
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-cris/cpu-qom.h b/target-cris/cpu-qom.h
index 41ab9b2..7ad8398 100644
--- a/target-cris/cpu-qom.h
+++ b/target-cris/cpu-qom.h
@@ -33,6 +33,7 @@
 
 /**
  * CRISCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A CRIS CPU model.
@@ -42,6 +43,7 @@ typedef struct CRISCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } CRISCPUClass;
 
diff --git a/target-cris/cpu.c b/target-cris/cpu.c
index 3f64a57..34c4f75 100644
--- a/target-cris/cpu.c
+++ b/target-cris/cpu.c
@@ -55,6 +55,17 @@ static void cris_cpu_reset(CPUState *s)
 #endif
 }
 
+static void cris_cpu_realizefn(DeviceState *dev, Error **errp)
+{
+    CRISCPU *cpu = CRIS_CPU(dev);
+    CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(dev);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(&cpu->env);
+
+    ccc->parent_realize(dev, errp);
+}
+
 static void cris_cpu_initfn(Object *obj)
 {
     CRISCPU *cpu = CRIS_CPU(obj);
@@ -65,9 +76,13 @@ static void cris_cpu_initfn(Object *obj)
 
 static void cris_cpu_class_init(ObjectClass *oc, void *data)
 {
+    DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
     CRISCPUClass *ccc = CRIS_CPU_CLASS(oc);
 
+    ccc->parent_realize = dc->realize;
+    dc->realize = cris_cpu_realizefn;
+
     ccc->parent_reset = cc->reset;
     cc->reset = cris_cpu_reset;
 }
diff --git a/target-cris/translate.c b/target-cris/translate.c
index 09e6011..25ff490 100644
--- a/target-cris/translate.c
+++ b/target-cris/translate.c
@@ -3558,8 +3558,7 @@ CRISCPU *cpu_cris_init(const char *cpu_model)
 
     env->pregs[PR_VR] = vr_by_name(cpu_model);
 
-    cpu_reset(CPU(cpu));
-    qemu_init_vcpu(env);
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     if (tcg_initialized) {
         return cpu;
commit 4776ce600338e17f75d200d1ad17d4ce9effa57f
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 03:55:14 2013 +0100

    target-ppc: Update PowerPCCPU to QOM realizefn
    
    Adapt ppc_cpu_realize() signature, hook it up to DeviceClass and set
    realized = true in cpu_ppc_init().
    
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-ppc/cpu-qom.h b/target-ppc/cpu-qom.h
index b338f8f..2b82cdb 100644
--- a/target-ppc/cpu-qom.h
+++ b/target-ppc/cpu-qom.h
@@ -40,6 +40,7 @@
 
 /**
  * PowerPCCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A PowerPC CPU model.
@@ -49,6 +50,7 @@ typedef struct PowerPCCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 
     /* TODO inline fields here */
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index 6cebaa1..49eaeac 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -10030,9 +10030,9 @@ static int ppc_fixup_cpu(PowerPCCPU *cpu)
     return 0;
 }
 
-static void ppc_cpu_realize(Object *obj, Error **errp)
+static void ppc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    PowerPCCPU *cpu = POWERPC_CPU(obj);
+    PowerPCCPU *cpu = POWERPC_CPU(dev);
     CPUPPCState *env = &cpu->env;
     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
     ppc_def_t *def = pcc->info;
@@ -10083,6 +10083,8 @@ static void ppc_cpu_realize(Object *obj, Error **errp)
 
     qemu_init_vcpu(env);
 
+    pcc->parent_realize(dev, errp);
+
 #if defined(PPC_DUMP_CPU)
     {
         const char *mmu_model, *excp_model, *bus_model;
@@ -10354,7 +10356,7 @@ PowerPCCPU *cpu_ppc_init(const char *cpu_model)
 
     env->cpu_model_str = cpu_model;
 
-    ppc_cpu_realize(OBJECT(cpu), &err);
+    object_property_set_bool(OBJECT(cpu), true, "realized", &err);
     if (err != NULL) {
         fprintf(stderr, "%s\n", error_get_pretty(err));
         error_free(err);
@@ -10575,6 +10577,10 @@ static void ppc_cpu_class_init(ObjectClass *oc, void *data)
 {
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    pcc->parent_realize = dc->realize;
+    dc->realize = ppc_cpu_realizefn;
 
     pcc->parent_reset = cc->reset;
     cc->reset = ppc_cpu_reset;
commit c296262bc94651a7a43639857d8343470f4129f3
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 14:11:07 2013 +0100

    target-openrisc: Update OpenRISCCPU to QOM realizefn
    
    Update the openrisc_cpu_realize() signature, hook it up to
    DeviceClass::realize and set realized = true in cpu_openrisc_init().
    
    qapi/error.h is now included through qdev and no longer needed.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Cc: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/cpu.c b/target-openrisc/cpu.c
index a7a8de8..d8cc533 100644
--- a/target-openrisc/cpu.c
+++ b/target-openrisc/cpu.c
@@ -62,12 +62,15 @@ static inline void set_feature(OpenRISCCPU *cpu, int feature)
     cpu->env.cpucfgr = cpu->feature;
 }
 
-void openrisc_cpu_realize(Object *obj, Error **errp)
+static void openrisc_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    OpenRISCCPU *cpu = OPENRISC_CPU(obj);
+    OpenRISCCPU *cpu = OPENRISC_CPU(dev);
+    OpenRISCCPUClass *occ = OPENRISC_CPU_GET_CLASS(dev);
 
     qemu_init_vcpu(&cpu->env);
     cpu_reset(CPU(cpu));
+
+    occ->parent_realize(dev, errp);
 }
 
 static void openrisc_cpu_initfn(Object *obj)
@@ -134,6 +137,10 @@ static void openrisc_cpu_class_init(ObjectClass *oc, void *data)
 {
     OpenRISCCPUClass *occ = OPENRISC_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(occ);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    occ->parent_realize = dc->realize;
+    dc->realize = openrisc_cpu_realizefn;
 
     occ->parent_reset = cc->reset;
     cc->reset = openrisc_cpu_reset;
@@ -187,7 +194,7 @@ OpenRISCCPU *cpu_openrisc_init(const char *cpu_model)
     cpu = OPENRISC_CPU(object_new(object_class_get_name(oc)));
     cpu->env.cpu_model_str = cpu_model;
 
-    openrisc_cpu_realize(OBJECT(cpu), NULL);
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     return cpu;
 }
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 3beab45..419f007 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -33,7 +33,6 @@ struct OpenRISCCPU;
 #include "exec/cpu-defs.h"
 #include "fpu/softfloat.h"
 #include "qom/cpu.h"
-#include "qapi/error.h"
 
 #define TYPE_OPENRISC_CPU "or32-cpu"
 
@@ -46,6 +45,7 @@ struct OpenRISCCPU;
 
 /**
  * OpenRISCCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * A OpenRISC CPU model.
@@ -55,6 +55,7 @@ typedef struct OpenRISCCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } OpenRISCCPUClass;
 
@@ -340,7 +341,6 @@ static inline OpenRISCCPU *openrisc_env_get_cpu(CPUOpenRISCState *env)
 #define ENV_GET_CPU(e) CPU(openrisc_env_get_cpu(e))
 
 OpenRISCCPU *cpu_openrisc_init(const char *cpu_model);
-void openrisc_cpu_realize(Object *obj, Error **errp);
 
 void cpu_openrisc_list(FILE *f, fprintf_function cpu_fprintf);
 int cpu_openrisc_exec(CPUOpenRISCState *s);
commit 2b6f294cacd9f4e133a7813d22e1b4e87ac6b2a3
Author: Andreas Färber <afaerber at suse.de>
Date:   Wed Jan 16 03:41:47 2013 +0100

    target-i386: Update X86CPU to QOM realizefn
    
    Adapt the signature of x86_cpu_realize(), hook up to
    DeviceClass::realize and set realized = true in cpu_x86_init().
    
    The QOM realizefn cannot depend on errp being non-NULL as in
    cpu_x86_init(), so use a local Error to preserve error handling behavior
    on APIC initialization errors.
    
    Reviewed-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    [AF: Invoke parent's realizefn]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-i386/cpu-qom.h b/target-i386/cpu-qom.h
index 332916a..48e6b54 100644
--- a/target-i386/cpu-qom.h
+++ b/target-i386/cpu-qom.h
@@ -39,6 +39,7 @@
 
 /**
  * X86CPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * An x86 CPU model or family.
@@ -48,6 +49,7 @@ typedef struct X86CPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } X86CPUClass;
 
@@ -72,8 +74,5 @@ static inline X86CPU *x86_env_get_cpu(CPUX86State *env)
 
 #define ENV_GET_CPU(e) CPU(x86_env_get_cpu(e))
 
-/* TODO Drop once ObjectClass::realize is available */
-void x86_cpu_realize(Object *obj, Error **errp);
-
 
 #endif
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index aab35c7..e2fd626 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2060,10 +2060,14 @@ static void x86_cpu_apic_init(X86CPU *cpu, Error **errp)
 }
 #endif
 
-void x86_cpu_realize(Object *obj, Error **errp)
+static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    X86CPU *cpu = X86_CPU(obj);
+    X86CPU *cpu = X86_CPU(dev);
+    X86CPUClass *xcc = X86_CPU_GET_CLASS(dev);
     CPUX86State *env = &cpu->env;
+#ifndef CONFIG_USER_ONLY
+    Error *local_err = NULL;
+#endif
 
     if (env->cpuid_7_0_ebx_features && env->cpuid_level < 7) {
         env->cpuid_level = 7;
@@ -2105,8 +2109,9 @@ void x86_cpu_realize(Object *obj, Error **errp)
     qemu_register_reset(x86_cpu_machine_reset_cb, cpu);
 
     if (cpu->env.cpuid_features & CPUID_APIC || smp_cpus > 1) {
-        x86_cpu_apic_init(cpu, errp);
-        if (error_is_set(errp)) {
+        x86_cpu_apic_init(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
             return;
         }
     }
@@ -2115,6 +2120,8 @@ void x86_cpu_realize(Object *obj, Error **errp)
     mce_init(cpu);
     qemu_init_vcpu(&cpu->env);
     cpu_reset(CPU(cpu));
+
+    xcc->parent_realize(dev, errp);
 }
 
 /* Enables contiguous-apic-ID mode, for compatibility */
@@ -2200,6 +2207,10 @@ static void x86_cpu_common_class_init(ObjectClass *oc, void *data)
 {
     X86CPUClass *xcc = X86_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    xcc->parent_realize = dc->realize;
+    dc->realize = x86_cpu_realizefn;
 
     xcc->parent_reset = cc->reset;
     cc->reset = x86_cpu_reset;
diff --git a/target-i386/helper.c b/target-i386/helper.c
index d1cb4e2..1a872fa 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -1282,7 +1282,7 @@ X86CPU *cpu_x86_init(const char *cpu_model)
         return NULL;
     }
 
-    x86_cpu_realize(OBJECT(cpu), &error);
+    object_property_set_bool(OBJECT(cpu), true, "realized", &error);
     if (error) {
         error_free(error);
         object_unref(OBJECT(cpu));
commit 149692667f8a46430127ca0555b38965f52177f5
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 10:18:18 2013 +0100

    target-arm: Update ARMCPU to QOM realizefn
    
    Turn arm_cpu_realize() into a QOM realize function, no longer called
    via cpu.h prototype. To maintain the semantics of cpu_init(), set
    realized = true explicitly in cpu_arm_init().
    
    Move GDB coprocessor registration, CPU reset and vCPU initialization
    into the realizefn.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 0f455c4..aff7bf3 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -33,6 +33,7 @@
 
 /**
  * ARMCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * An ARM CPU model.
@@ -42,6 +43,7 @@ typedef struct ARMCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } ARMCPUClass;
 
@@ -107,7 +109,6 @@ static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
 
 #define ENV_GET_CPU(e) CPU(arm_env_get_cpu(e))
 
-void arm_cpu_realize(ARMCPU *cpu);
 void register_cp_regs_for_features(ARMCPU *cpu);
 
 #endif
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index 1c6a628..9915172 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -147,15 +147,12 @@ static void arm_cpu_finalizefn(Object *obj)
     g_hash_table_destroy(cpu->cp_regs);
 }
 
-void arm_cpu_realize(ARMCPU *cpu)
+static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    /* This function is called by cpu_arm_init() because it
-     * needs to do common actions based on feature bits, etc
-     * that have been set by the subclass init functions.
-     * When we have QOM realize support it should become
-     * a true realize function instead.
-     */
+    ARMCPU *cpu = ARM_CPU(dev);
+    ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev);
     CPUARMState *env = &cpu->env;
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V7)) {
         set_feature(env, ARM_FEATURE_VAPA);
@@ -197,6 +194,12 @@ void arm_cpu_realize(ARMCPU *cpu)
     }
 
     register_cp_regs_for_features(cpu);
+    arm_cpu_register_gdb_regs_for_features(cpu);
+
+    cpu_reset(CPU(cpu));
+    qemu_init_vcpu(env);
+
+    acc->parent_realize(dev, errp);
 }
 
 /* CPU models */
@@ -782,6 +785,10 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
     CPUClass *cc = CPU_CLASS(acc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    acc->parent_realize = dc->realize;
+    dc->realize = arm_cpu_realizefn;
 
     acc->parent_reset = cc->reset;
     cc->reset = arm_cpu_reset;
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index ffddfcb..2902ba5 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -234,6 +234,7 @@ typedef struct CPUARMState {
 
 ARMCPU *cpu_arm_init(const char *cpu_model);
 void arm_translate_init(void);
+void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 int cpu_arm_exec(CPUARMState *s);
 void do_interrupt(CPUARMState *);
 void switch_mode(CPUARMState *, int);
diff --git a/target-arm/helper.c b/target-arm/helper.c
index eb7b291..4538a09 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1272,14 +1272,22 @@ ARMCPU *cpu_arm_init(const char *cpu_model)
     cpu = ARM_CPU(object_new(object_class_get_name(oc)));
     env = &cpu->env;
     env->cpu_model_str = cpu_model;
-    arm_cpu_realize(cpu);
+
+    /* TODO this should be set centrally, once possible */
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
 
     if (tcg_enabled() && !inited) {
         inited = 1;
         arm_translate_init();
     }
 
-    cpu_reset(CPU(cpu));
+    return cpu;
+}
+
+void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
+{
+    CPUARMState *env = &cpu->env;
+
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  51, "arm-neon.xml", 0);
@@ -1290,8 +1298,6 @@ ARMCPU *cpu_arm_init(const char *cpu_model)
         gdb_register_coprocessor(env, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  19, "arm-vfp.xml", 0);
     }
-    qemu_init_vcpu(env);
-    return cpu;
 }
 
 /* Sort alphabetically by type name, except for "any". */
commit bd1b282836a7885a13c13f9cc63123fa8e32f02f
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 5 14:01:30 2013 +0100

    target-alpha: Update AlphaCPU to QOM realizefn
    
    Update the alpha_cpu_realize() signature and hook up to
    DeviceClass::realize. Set realized = true in cpu_alpha_init().
    
    qapi/error.h is included through qdev now and no longer needed.
    
    Acked-by: Richard Henderson <rth at twiddle.net>
    [AF: Invoke parent's realizefn]
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/target-alpha/cpu-qom.h b/target-alpha/cpu-qom.h
index 16367d2..c0f6c6d 100644
--- a/target-alpha/cpu-qom.h
+++ b/target-alpha/cpu-qom.h
@@ -34,6 +34,7 @@
 
 /**
  * AlphaCPUClass:
+ * @parent_realize: The parent class' realize handler.
  * @parent_reset: The parent class' reset handler.
  *
  * An Alpha CPU model.
@@ -43,6 +44,7 @@ typedef struct AlphaCPUClass {
     CPUClass parent_class;
     /*< public >*/
 
+    DeviceRealize parent_realize;
     void (*parent_reset)(CPUState *cpu);
 } AlphaCPUClass;
 
diff --git a/target-alpha/cpu.c b/target-alpha/cpu.c
index 0ad69f0..0cdae69 100644
--- a/target-alpha/cpu.c
+++ b/target-alpha/cpu.c
@@ -21,14 +21,16 @@
 
 #include "cpu.h"
 #include "qemu-common.h"
-#include "qapi/error.h"
 
 
-static void alpha_cpu_realize(Object *obj, Error **errp)
+static void alpha_cpu_realizefn(DeviceState *dev, Error **errp)
 {
-    AlphaCPU *cpu = ALPHA_CPU(obj);
+    AlphaCPU *cpu = ALPHA_CPU(dev);
+    AlphaCPUClass *acc = ALPHA_CPU_GET_CLASS(dev);
 
     qemu_init_vcpu(&cpu->env);
+
+    acc->parent_realize(dev, errp);
 }
 
 /* Sort alphabetically by type name. */
@@ -134,7 +136,8 @@ AlphaCPU *cpu_alpha_init(const char *cpu_model)
 
     env->cpu_model_str = cpu_model;
 
-    alpha_cpu_realize(OBJECT(cpu), NULL);
+    object_property_set_bool(OBJECT(cpu), true, "realized", NULL);
+
     return cpu;
 }
 
@@ -250,7 +253,12 @@ static void alpha_cpu_initfn(Object *obj)
 
 static void alpha_cpu_class_init(ObjectClass *oc, void *data)
 {
+    DeviceClass *dc = DEVICE_CLASS(oc);
     CPUClass *cc = CPU_CLASS(oc);
+    AlphaCPUClass *acc = ALPHA_CPU_CLASS(oc);
+
+    acc->parent_realize = dc->realize;
+    dc->realize = alpha_cpu_realizefn;
 
     cc->class_by_name = alpha_cpu_class_by_name;
 }
commit 4f65809994274989bdf51c8605bb974565cb1c9e
Author: Andreas Färber <afaerber at suse.de>
Date:   Sat Jan 19 06:17:06 2013 +0100

    cpu: Prepare QOM realizefn
    
    Overwrite the default implementation with a no-op, no longer
    attempting to call DeviceClass::init.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/qom/cpu.c b/qom/cpu.c
index 8fb538b..870e9ba 100644
--- a/qom/cpu.c
+++ b/qom/cpu.c
@@ -46,6 +46,10 @@ static ObjectClass *cpu_common_class_by_name(const char *cpu_model)
     return NULL;
 }
 
+static void cpu_common_realizefn(DeviceState *dev, Error **errp)
+{
+}
+
 static void cpu_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -53,6 +57,7 @@ static void cpu_class_init(ObjectClass *klass, void *data)
 
     k->class_by_name = cpu_common_class_by_name;
     k->reset = cpu_common_reset;
+    dc->realize = cpu_common_realizefn;
     dc->no_user = 1;
 }
 
commit 453776e5746be23c66df65fadf12e115b7d2dadd
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:43 2013 -0800

    bitops: Remove routines redundant with host-utils
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index b50629b..affcc96 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -24,54 +24,6 @@
 #define BITS_TO_LONGS(nr)	DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
 
 /**
- * bitops_ctzl - count trailing zeroes in word.
- * @word: The word to search
- *
- * Returns -1 if no bit exists.  Note that compared to the C library
- * routine ffsl, this one returns one less.
- */
-static unsigned long bitops_ctzl(unsigned long word)
-{
-#if QEMU_GNUC_PREREQ(3, 4)
-    return __builtin_ffsl(word) - 1;
-#else
-    if (!word) {
-        return -1;
-    }
-
-    if (sizeof(long) == 4) {
-        return ctz32(word);
-    } else if (sizeof(long) == 8) {
-        return ctz64(word);
-    } else {
-        abort();
-    }
-#endif
-}
-
-/**
- * bitops_fls - find last (most-significant) set bit in a long word
- * @word: the word to search
- *
- * Undefined if no set bit exists, so code should check against 0 first.
- */
-static inline unsigned long bitops_flsl(unsigned long word)
-{
-    return BITS_PER_LONG - 1 - clzl(word);
-}
-
-/**
- * cto - count trailing ones in word.
- * @word: The word to search
- *
- * Returns -1 if all bit are set.
- */
-static inline unsigned long bitops_ctol(unsigned long word)
-{
-    return bitops_ctzl(~word);
-}
-
-/**
  * set_bit - Set a bit in memory
  * @nr: the bit to set
  * @addr: the address to start counting from
commit 0f9d8bd386c9b7b17fc68fef36caa81750c39494
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:42 2013 -0800

    bitops: Replace bitops_ctol with ctzl
    
    The is the only remaining user.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/util/bitops.c b/util/bitops.c
index 50b4a81..e72237a 100644
--- a/util/bitops.c
+++ b/util/bitops.c
@@ -109,7 +109,7 @@ found_first:
         return result + size;	/* Nope. */
     }
 found_middle:
-    return result + bitops_ctol(tmp);
+    return result + ctzl(~tmp);
 }
 
 unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
commit 4932398fac273b8ebe5688bc4b79407a7f41edbd
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:41 2013 -0800

    bitops: Inline bitops_flsl
    
    This is the only remaining user.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/util/bitops.c b/util/bitops.c
index 9cd1c3a..50b4a81 100644
--- a/util/bitops.c
+++ b/util/bitops.c
@@ -133,7 +133,7 @@ unsigned long find_last_bit(const unsigned long *addr, unsigned long size)
         tmp = addr[--words];
         if (tmp) {
         found:
-            return words * BITS_PER_LONG + bitops_flsl(tmp);
+            return words * BITS_PER_LONG + BITS_PER_LONG - 1 - clzl(tmp);
         }
     }
 
commit 14e534265aad0796690a5aea429f5bd2877ccff0
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:40 2013 -0800

    target-i386: Inline bitops_flsl
    
    Use clz32 directly.  Which makes slightly more sense given
    that the input is type "int" and not type "long".
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/target-i386/topology.h b/target-i386/topology.h
index 24ed525..07a6c5f 100644
--- a/target-i386/topology.h
+++ b/target-i386/topology.h
@@ -52,10 +52,8 @@ typedef uint32_t apic_id_t;
 static unsigned apicid_bitwidth_for_count(unsigned count)
 {
     g_assert(count >= 1);
-    if (count == 1) {
-        return 0;
-    }
-    return bitops_flsl(count - 1) + 1;
+    count -= 1;
+    return count ? 32 - clz32(count) : 0;
 }
 
 /* Bit width of the SMT_ID (thread ID) field on the APIC ID
commit 0cfa6adc7fd1eba4694515bde6bbfb9ecd892f2f
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:39 2013 -0800

    bitops: Write bitops_flsl in terms of clzl
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index 8b88791..b50629b 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -57,34 +57,7 @@ static unsigned long bitops_ctzl(unsigned long word)
  */
 static inline unsigned long bitops_flsl(unsigned long word)
 {
-	int num = BITS_PER_LONG - 1;
-
-#if LONG_MAX > 0x7FFFFFFF
-	if (!(word & (~0ul << 32))) {
-		num -= 32;
-		word <<= 32;
-	}
-#endif
-	if (!(word & (~0ul << (BITS_PER_LONG-16)))) {
-		num -= 16;
-		word <<= 16;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-8)))) {
-		num -= 8;
-		word <<= 8;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-4)))) {
-		num -= 4;
-		word <<= 4;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-2)))) {
-		num -= 2;
-
-		word <<= 2;
-	}
-	if (!(word & (~0ul << (BITS_PER_LONG-1))))
-		num -= 1;
-	return num;
+    return BITS_PER_LONG - 1 - clzl(word);
 }
 
 /**
commit 5bbf90be97203c472f47da070c0040b464c0460f
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:38 2013 -0800

    memory: Use non-bitops ctzl
    
    A memory size of zero is invalid, and so that edge condition
    does not occur.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/memory.c b/memory.c
index cd7d5e0..92a2196 100644
--- a/memory.c
+++ b/memory.c
@@ -855,7 +855,7 @@ static uint64_t memory_region_dispatch_read1(MemoryRegion *mr,
     }
 
     if (!mr->ops->read) {
-        return mr->ops->old_mmio.read[bitops_ctzl(size)](mr->opaque, addr);
+        return mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
     }
 
     /* FIXME: support unaligned access */
@@ -908,7 +908,7 @@ static void memory_region_dispatch_write(MemoryRegion *mr,
     adjust_endianness(mr, &data, size);
 
     if (!mr->ops->write) {
-        mr->ops->old_mmio.write[bitops_ctzl(size)](mr->opaque, addr, data);
+        mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, data);
         return;
     }
 
commit 265ce4a5ca39fb7f74a803dd61bbd9108ca6cdee
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:37 2013 -0800

    bitops: Use non-bitops ctzl
    
    The use of ctz has already eliminated zero, and thus the difference
    in edge conditions between the two routines is irrelevant.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/util/bitops.c b/util/bitops.c
index 7b853cf..9cd1c3a 100644
--- a/util/bitops.c
+++ b/util/bitops.c
@@ -60,7 +60,7 @@ found_first:
         return result + size;	/* Nope. */
     }
 found_middle:
-    return result + bitops_ctzl(tmp);
+    return result + ctzl(tmp);
 }
 
 /*
commit 18331e7c189507513008a2936f5fe79c3d8b8a08
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:36 2013 -0800

    hbitmap: Use non-bitops ctzl
    
    Both uses of ctz have already eliminated zero, and thus the difference
    in edge conditions between the two routines is irrelevant.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/hbitmap.h b/include/qemu/hbitmap.h
index 250de03..550d7ce 100644
--- a/include/qemu/hbitmap.h
+++ b/include/qemu/hbitmap.h
@@ -16,6 +16,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include "bitops.h"
+#include "host-utils.h"
 
 typedef struct HBitmap HBitmap;
 typedef struct HBitmapIter HBitmapIter;
@@ -170,7 +171,7 @@ static inline int64_t hbitmap_iter_next(HBitmapIter *hbi)
 
     /* The next call will resume work from the next bit.  */
     hbi->cur[HBITMAP_LEVELS - 1] = cur & (cur - 1);
-    item = ((uint64_t)hbi->pos << BITS_PER_LEVEL) + bitops_ctzl(cur);
+    item = ((uint64_t)hbi->pos << BITS_PER_LEVEL) + ctzl(cur);
 
     return item << hbi->granularity;
 }
diff --git a/util/hbitmap.c b/util/hbitmap.c
index a0df5d3..d936831 100644
--- a/util/hbitmap.c
+++ b/util/hbitmap.c
@@ -126,7 +126,8 @@ unsigned long hbitmap_iter_skip_words(HBitmapIter *hbi)
          * The index of this word's least significant set bit provides
          * the low-order bits.
          */
-        pos = (pos << BITS_PER_LEVEL) + bitops_ctzl(cur);
+        assert(cur);
+        pos = (pos << BITS_PER_LEVEL) + ctzl(cur);
         hbi->cur[i] = cur & (cur - 1);
 
         /* Set up next level for iteration.  */
commit 72d81155d0b88ba757c5a972d3fff83027e7a6e7
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:35 2013 -0800

    host-utils: Fix coding style and add comments
    
    Add function comments to the routines, documenting the corner
    cases upon which we are standardizing.  Fix the few instances
    of non-standard coding style.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index d72b72d..f0dd850 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -50,16 +50,19 @@ void muls64(uint64_t *phigh, uint64_t *plow, int64_t a, int64_t b);
 void mulu64(uint64_t *phigh, uint64_t *plow, uint64_t a, uint64_t b);
 #endif
 
-/* Binary search for leading zeros.  */
-
+/**
+ * clz32 - count leading zeros in a 32-bit value.
+ * @val: The value to search
+ *
+ * Returns 32 if the value is zero.  Note that the GCC builtin is
+ * undefined if the value is zero.
+ */
 static inline int clz32(uint32_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
-    if (val)
-        return __builtin_clz(val);
-    else
-        return 32;
+    return val ? __builtin_clz(val) : 32;
 #else
+    /* Binary search for the leading one bit.  */
     int cnt = 0;
 
     if (!(val & 0xFFFF0000U)) {
@@ -89,18 +92,28 @@ static inline int clz32(uint32_t val)
 #endif
 }
 
+/**
+ * clo32 - count leading ones in a 32-bit value.
+ * @val: The value to search
+ *
+ * Returns 32 if the value is -1.
+ */
 static inline int clo32(uint32_t val)
 {
     return clz32(~val);
 }
 
+/**
+ * clz64 - count leading zeros in a 64-bit value.
+ * @val: The value to search
+ *
+ * Returns 64 if the value is zero.  Note that the GCC builtin is
+ * undefined if the value is zero.
+ */
 static inline int clz64(uint64_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
-    if (val)
-        return __builtin_clzll(val);
-    else
-        return 64;
+    return val ? __builtin_clzll(val) : 64;
 #else
     int cnt = 0;
 
@@ -114,19 +127,30 @@ static inline int clz64(uint64_t val)
 #endif
 }
 
+/**
+ * clo64 - count leading ones in a 64-bit value.
+ * @val: The value to search
+ *
+ * Returns 64 if the value is -1.
+ */
 static inline int clo64(uint64_t val)
 {
     return clz64(~val);
 }
 
+/**
+ * ctz32 - count trailing zeros in a 32-bit value.
+ * @val: The value to search
+ *
+ * Returns 32 if the value is zero.  Note that the GCC builtin is
+ * undefined if the value is zero.
+ */
 static inline int ctz32(uint32_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
-    if (val)
-        return __builtin_ctz(val);
-    else
-        return 32;
+    return val ? __builtin_ctz(val) : 32;
 #else
+    /* Binary search for the trailing one bit.  */
     int cnt;
 
     cnt = 0;
@@ -158,18 +182,28 @@ static inline int ctz32(uint32_t val)
 #endif
 }
 
+/**
+ * cto32 - count trailing ones in a 32-bit value.
+ * @val: The value to search
+ *
+ * Returns 32 if the value is -1.
+ */
 static inline int cto32(uint32_t val)
 {
     return ctz32(~val);
 }
 
+/**
+ * ctz64 - count trailing zeros in a 64-bit value.
+ * @val: The value to search
+ *
+ * Returns 64 if the value is zero.  Note that the GCC builtin is
+ * undefined if the value is zero.
+ */
 static inline int ctz64(uint64_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
-    if (val)
-        return __builtin_ctzll(val);
-    else
-        return 64;
+    return val ? __builtin_ctzll(val) : 64;
 #else
     int cnt;
 
@@ -183,30 +217,56 @@ static inline int ctz64(uint64_t val)
 #endif
 }
 
+/**
+ * ctz64 - count trailing ones in a 64-bit value.
+ * @val: The value to search
+ *
+ * Returns 64 if the value is -1.
+ */
 static inline int cto64(uint64_t val)
 {
     return ctz64(~val);
 }
 
+/**
+ * ctpop8 - count the population of one bits in an 8-bit value.
+ * @val: The value to search
+ */
 static inline int ctpop8(uint8_t val)
 {
+#if QEMU_GNUC_PREREQ(3, 4)
+    return __builtin_popcount(val);
+#else
     val = (val & 0x55) + ((val >> 1) & 0x55);
     val = (val & 0x33) + ((val >> 2) & 0x33);
     val = (val & 0x0f) + ((val >> 4) & 0x0f);
 
     return val;
+#endif
 }
 
+/**
+ * ctpop16 - count the population of one bits in a 16-bit value.
+ * @val: The value to search
+ */
 static inline int ctpop16(uint16_t val)
 {
+#if QEMU_GNUC_PREREQ(3, 4)
+    return __builtin_popcount(val);
+#else
     val = (val & 0x5555) + ((val >> 1) & 0x5555);
     val = (val & 0x3333) + ((val >> 2) & 0x3333);
     val = (val & 0x0f0f) + ((val >> 4) & 0x0f0f);
     val = (val & 0x00ff) + ((val >> 8) & 0x00ff);
 
     return val;
+#endif
 }
 
+/**
+ * ctpop32 - count the population of one bits in a 32-bit value.
+ * @val: The value to search
+ */
 static inline int ctpop32(uint32_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
@@ -222,6 +282,10 @@ static inline int ctpop32(uint32_t val)
 #endif
 }
 
+/**
+ * ctpop64 - count the population of one bits in a 64-bit value.
+ * @val: The value to search
+ */
 static inline int ctpop64(uint64_t val)
 {
 #if QEMU_GNUC_PREREQ(3, 4)
commit 0165437302448d210742cc3def362d1de0413621
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Feb 13 17:47:34 2013 -0800

    host-utils: Add host long specific aliases for clz, ctz, ctpop
    
    We will standardize on these names, rather than the similar routines
    currently residing in qemu/bitops.h.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index 81c9a75..d72b72d 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -26,6 +26,7 @@
 #define HOST_UTILS_H 1
 
 #include "qemu/compiler.h"   /* QEMU_GNUC_PREREQ */
+#include <limits.h>
 
 #if defined(__x86_64__)
 #define __HAVE_FAST_MULU64__
@@ -237,4 +238,22 @@ static inline int ctpop64(uint64_t val)
 #endif
 }
 
+/* Host type specific sizes of these routines.  */
+
+#if ULONG_MAX == UINT32_MAX
+# define clzl   clz32
+# define ctzl   ctz32
+# define clol   clo32
+# define ctol   cto32
+# define ctpopl ctpop32
+#elif ULONG_MAX == UINT64_MAX
+# define clzl   clz64
+# define ctzl   ctz64
+# define clol   clo64
+# define ctol   cto64
+# define ctpopl ctpop64
+#else
+# error Unknown sizeof long
+#endif
+
 #endif
commit 38dad9e574746981dfbac52b3bbbd6d894f31d26
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:25 2013 +0000

    qemu-log: Rename CPULogItem, cpu_log_items to QEMULogItem, qemu_log_items
    
    Rename the typedef CPULogItem and the public array cpu_log_items
    to names that better reflect the fact that the qemu_log functionality
    isn't restricted to TCG CPU debug logs any more.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/include/qemu/log.h b/include/qemu/log.h
index 5dcbe11..5a46555 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -135,13 +135,13 @@ static inline void qemu_log_try_set_file(FILE *f)
 }
 
 /* define log items */
-typedef struct CPULogItem {
+typedef struct QEMULogItem {
     int mask;
     const char *name;
     const char *help;
-} CPULogItem;
+} QEMULogItem;
 
-extern const CPULogItem cpu_log_items[];
+extern const QEMULogItem qemu_log_items[];
 
 /* This is the function that actually does the work of
  * changing the log level; it should only be accessed via
diff --git a/monitor.c b/monitor.c
index 6aac4c2..6a0f257 100644
--- a/monitor.c
+++ b/monitor.c
@@ -721,10 +721,10 @@ static void help_cmd(Monitor *mon, const char *name)
     } else {
         help_cmd_dump(mon, mon_cmds, "", name);
         if (name && !strcmp(name, "log")) {
-            const CPULogItem *item;
+            const QEMULogItem *item;
             monitor_printf(mon, "Log items (comma separated):\n");
             monitor_printf(mon, "%-10s %s\n", "none", "remove all logs");
-            for(item = cpu_log_items; item->mask != 0; item++) {
+            for (item = qemu_log_items; item->mask != 0; item++) {
                 monitor_printf(mon, "%-10s %s\n", item->name, item->help);
             }
         }
diff --git a/qemu-log.c b/qemu-log.c
index a96db88..2f47aaf 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -97,7 +97,7 @@ void qemu_set_log_filename(const char *filename)
     qemu_set_log(qemu_loglevel);
 }
 
-const CPULogItem cpu_log_items[] = {
+const QEMULogItem qemu_log_items[] = {
     { CPU_LOG_TB_OUT_ASM, "out_asm",
       "show generated host assembly code for each compiled TB" },
     { CPU_LOG_TB_IN_ASM, "in_asm",
@@ -138,7 +138,7 @@ static int cmp1(const char *s1, int n, const char *s2)
 /* takes a comma separated list of log masks. Return 0 if error. */
 int qemu_str_to_log_mask(const char *str)
 {
-    const CPULogItem *item;
+    const QEMULogItem *item;
     int mask;
     const char *p, *p1;
 
@@ -150,11 +150,11 @@ int qemu_str_to_log_mask(const char *str)
             p1 = p + strlen(p);
         }
         if (cmp1(p,p1-p,"all")) {
-            for (item = cpu_log_items; item->mask != 0; item++) {
+            for (item = qemu_log_items; item->mask != 0; item++) {
                 mask |= item->mask;
             }
         } else {
-            for (item = cpu_log_items; item->mask != 0; item++) {
+            for (item = qemu_log_items; item->mask != 0; item++) {
                 if (cmp1(p, p1 - p, item->name)) {
                     goto found;
                 }
@@ -173,9 +173,9 @@ int qemu_str_to_log_mask(const char *str)
 
 void qemu_print_log_usage(FILE *f)
 {
-    const CPULogItem *item;
+    const QEMULogItem *item;
     fprintf(f, "Log items (comma separated):\n");
-    for (item = cpu_log_items; item->mask != 0; item++) {
+    for (item = qemu_log_items; item->mask != 0; item++) {
         fprintf(f, "%-10s %s\n", item->name, item->help);
     }
 }
commit b946bffab5e0d359accfcc78faead20fd69f26e8
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:24 2013 +0000

    cpus.c: Drop unnecessary set_cpu_log()
    
    The set_cpu_log() function in cpus.c is a fairly simple wrapper
    which is only called from one location. Just inline the code
    into vl.c, since there is no need to indirect it via cpus.c
    and the handling of the error case is more appropriate to vl.c.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/cpus.c b/cpus.c
index 24e6aff..c4b021d 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1175,18 +1175,6 @@ void set_numa_modes(void)
     }
 }
 
-void set_cpu_log(const char *optarg)
-{
-    int mask;
-
-    mask = qemu_str_to_log_mask(optarg);
-    if (!mask) {
-        qemu_print_log_usage(stdout);
-        exit(1);
-    }
-    qemu_set_log(mask);
-}
-
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
 {
     /* XXX: implement xxx_cpu_list for targets that still miss it */
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index 60e44bb..6502488 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -24,7 +24,6 @@ extern int smp_threads;
 #endif
 
 void set_numa_modes(void);
-void set_cpu_log(const char *optarg);
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg);
 
 #endif
diff --git a/vl.c b/vl.c
index f9f4dda..c5b0eea 100644
--- a/vl.c
+++ b/vl.c
@@ -3864,10 +3864,17 @@ int main(int argc, char **argv, char **envp)
      * location or level of logging.
      */
     if (log_mask) {
+        int mask;
         if (log_file) {
             qemu_set_log_filename(log_file);
         }
-        set_cpu_log(log_mask);
+
+        mask = qemu_str_to_log_mask(log_mask);
+        if (!mask) {
+            qemu_print_log_usage(stdout);
+            exit(1);
+        }
+        qemu_set_log(mask);
     }
 
     if (!trace_backend_init(trace_events, trace_file)) {
commit 24537a01910f110fe3e343c13df13e48f7968a9e
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:23 2013 +0000

    qemu-log: Rename the public-facing cpu_set_log function to qemu_set_log
    
    Rename the public-facing function cpu_set_log to qemu_set_log. This
    requires us to rename the internal-only qemu_set_log() to
    do_qemu_set_log().
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 4b12e65..097fbfe 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -870,7 +870,7 @@ int main(int argc, char **argv)
             qemu_print_log_usage(stdout);
             exit(1);
         }
-        cpu_set_log(mask);
+        qemu_set_log(mask);
     }
 
     if (optind >= argc) {
diff --git a/cpus.c b/cpus.c
index 63cfb73..24e6aff 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1184,7 +1184,7 @@ void set_cpu_log(const char *optarg)
         qemu_print_log_usage(stdout);
         exit(1);
     }
-    cpu_set_log(mask);
+    qemu_set_log(mask);
 }
 
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
diff --git a/hw/ppc.c b/hw/ppc.c
index c52e22f..6053bd5 100644
--- a/hw/ppc.c
+++ b/hw/ppc.c
@@ -1189,7 +1189,7 @@ void PPC_debug_write (void *opaque, uint32_t addr, uint32_t val)
         break;
     case 2:
         printf("Set loglevel to %04" PRIx32 "\n", val);
-        cpu_set_log(val | 0x100);
+        qemu_set_log(val | 0x100);
         break;
     }
 }
diff --git a/include/qemu/log.h b/include/qemu/log.h
index 10792ce..5dcbe11 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -143,14 +143,18 @@ typedef struct CPULogItem {
 
 extern const CPULogItem cpu_log_items[];
 
-void qemu_set_log(int log_flags, bool use_own_buffers);
+/* This is the function that actually does the work of
+ * changing the log level; it should only be accessed via
+ * the qemu_set_log() wrapper.
+ */
+void do_qemu_set_log(int log_flags, bool use_own_buffers);
 
-static inline void cpu_set_log(int log_flags)
+static inline void qemu_set_log(int log_flags)
 {
 #ifdef CONFIG_USER_ONLY
-    qemu_set_log(log_flags, true);
+    do_qemu_set_log(log_flags, true);
 #else
-    qemu_set_log(log_flags, false);
+    do_qemu_set_log(log_flags, false);
 #endif
 }
 
diff --git a/linux-user/main.c b/linux-user/main.c
index 862619b..146a468 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3104,7 +3104,7 @@ static void handle_arg_log(const char *arg)
         qemu_print_log_usage(stdout);
         exit(1);
     }
-    cpu_set_log(mask);
+    qemu_set_log(mask);
 }
 
 static void handle_arg_log_filename(const char *arg)
diff --git a/monitor.c b/monitor.c
index 2a55d56..6aac4c2 100644
--- a/monitor.c
+++ b/monitor.c
@@ -981,7 +981,7 @@ static void do_log(Monitor *mon, const QDict *qdict)
             return;
         }
     }
-    cpu_set_log(mask);
+    qemu_set_log(mask);
 }
 
 static void do_singlestep(Monitor *mon, const QDict *qdict)
diff --git a/qemu-log.c b/qemu-log.c
index 10a8581..a96db88 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -54,7 +54,7 @@ void qemu_log_mask(int mask, const char *fmt, ...)
 }
 
 /* enable or disable low levels log */
-void qemu_set_log(int log_flags, bool use_own_buffers)
+void do_qemu_set_log(int log_flags, bool use_own_buffers)
 {
     const char *fname = logfilename ?: DEFAULT_LOGFILENAME;
 
@@ -94,7 +94,7 @@ void qemu_set_log_filename(const char *filename)
         fclose(qemu_logfile);
         qemu_logfile = NULL;
     }
-    cpu_set_log(qemu_loglevel);
+    qemu_set_log(qemu_loglevel);
 }
 
 const CPULogItem cpu_log_items[] = {
diff --git a/target-i386/translate.c b/target-i386/translate.c
index 32d21f5..112c310 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -6854,7 +6854,7 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
 #else
         /* start debug */
         tb_flush(env);
-        cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
+        qemu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
 #endif
         break;
 #endif
diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c
index 1707169..2d561b3 100644
--- a/tcg/tci/tcg-target.c
+++ b/tcg/tci/tcg-target.c
@@ -888,7 +888,7 @@ static void tcg_target_init(TCGContext *s)
 #if defined(CONFIG_DEBUG_TCG_INTERPRETER)
     const char *envval = getenv("DEBUG_TCG");
     if (envval) {
-        cpu_set_log(strtol(envval, NULL, 0));
+        qemu_set_log(strtol(envval, NULL, 0));
     }
 #endif
 
commit 4fde1eba0f98779d4fdb64818071f72bb1672438
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:22 2013 +0000

    qemu-log: Rename cpu_str_to_log_mask to qemu_str_to_log_mask
    
    Rename cpu_str_to_log_mask() to qemu_str_to_log_mask(), since
    the qemu_log functionality is no longer restricted to TCG CPU
    debug logging.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 26604b4..4b12e65 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -865,7 +865,7 @@ int main(int argc, char **argv)
     if (log_mask) {
         int mask;
 
-        mask = cpu_str_to_log_mask(log_mask);
+        mask = qemu_str_to_log_mask(log_mask);
         if (!mask) {
             qemu_print_log_usage(stdout);
             exit(1);
diff --git a/cpus.c b/cpus.c
index 0fdc48c..63cfb73 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1179,7 +1179,7 @@ void set_cpu_log(const char *optarg)
 {
     int mask;
 
-    mask = cpu_str_to_log_mask(optarg);
+    mask = qemu_str_to_log_mask(optarg);
     if (!mask) {
         qemu_print_log_usage(stdout);
         exit(1);
diff --git a/include/qemu/log.h b/include/qemu/log.h
index 59511a3..10792ce 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -155,7 +155,7 @@ static inline void cpu_set_log(int log_flags)
 }
 
 void qemu_set_log_filename(const char *filename);
-int cpu_str_to_log_mask(const char *str);
+int qemu_str_to_log_mask(const char *str);
 
 /* Print a usage message listing all the valid logging categories
  * to the specified FILE*.
diff --git a/linux-user/main.c b/linux-user/main.c
index 00b0125..862619b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3099,7 +3099,7 @@ static void handle_arg_log(const char *arg)
 {
     int mask;
 
-    mask = cpu_str_to_log_mask(arg);
+    mask = qemu_str_to_log_mask(arg);
     if (!mask) {
         qemu_print_log_usage(stdout);
         exit(1);
diff --git a/monitor.c b/monitor.c
index 578a318..2a55d56 100644
--- a/monitor.c
+++ b/monitor.c
@@ -975,7 +975,7 @@ static void do_log(Monitor *mon, const QDict *qdict)
     if (!strcmp(items, "none")) {
         mask = 0;
     } else {
-        mask = cpu_str_to_log_mask(items);
+        mask = qemu_str_to_log_mask(items);
         if (!mask) {
             help_cmd(mon, "log");
             return;
diff --git a/qemu-log.c b/qemu-log.c
index 786d335..10a8581 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -136,7 +136,7 @@ static int cmp1(const char *s1, int n, const char *s2)
 }
 
 /* takes a comma separated list of log masks. Return 0 if error. */
-int cpu_str_to_log_mask(const char *str)
+int qemu_str_to_log_mask(const char *str)
 {
     const CPULogItem *item;
     int mask;
commit 59a6fa6e67d2335d867c66c59d992847e5b62879
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:21 2013 +0000

    qemu-log: Abstract out "print usage message about valid log categories"
    
    Abstract out the "print a human readable list of all the
    valid log categories" functionality which is currently duplicated
    in three separate places. (We leave the monitor.c help_cmd()
    implementation as-is since it wants to send the message to
    the monitor and add its own information.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 76ab359..26604b4 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -864,14 +864,10 @@ int main(int argc, char **argv)
     qemu_set_log_filename(log_file);
     if (log_mask) {
         int mask;
-        const CPULogItem *item;
 
         mask = cpu_str_to_log_mask(log_mask);
         if (!mask) {
-            printf("Log items (comma separated):\n");
-            for (item = cpu_log_items; item->mask != 0; item++) {
-                printf("%-10s %s\n", item->name, item->help);
-            }
+            qemu_print_log_usage(stdout);
             exit(1);
         }
         cpu_set_log(mask);
diff --git a/cpus.c b/cpus.c
index 2155441..0fdc48c 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1178,14 +1178,10 @@ void set_numa_modes(void)
 void set_cpu_log(const char *optarg)
 {
     int mask;
-    const CPULogItem *item;
 
     mask = cpu_str_to_log_mask(optarg);
     if (!mask) {
-        printf("Log items (comma separated):\n");
-        for (item = cpu_log_items; item->mask != 0; item++) {
-            printf("%-10s %s\n", item->name, item->help);
-        }
+        qemu_print_log_usage(stdout);
         exit(1);
     }
     cpu_set_log(mask);
diff --git a/include/qemu/log.h b/include/qemu/log.h
index 4760e04..59511a3 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -157,4 +157,9 @@ static inline void cpu_set_log(int log_flags)
 void qemu_set_log_filename(const char *filename);
 int cpu_str_to_log_mask(const char *str);
 
+/* Print a usage message listing all the valid logging categories
+ * to the specified FILE*.
+ */
+void qemu_print_log_usage(FILE *f);
+
 #endif
diff --git a/linux-user/main.c b/linux-user/main.c
index 4beb5c9..00b0125 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3098,14 +3098,10 @@ static void handle_arg_help(const char *arg)
 static void handle_arg_log(const char *arg)
 {
     int mask;
-    const CPULogItem *item;
 
     mask = cpu_str_to_log_mask(arg);
     if (!mask) {
-        printf("Log items (comma separated):\n");
-        for (item = cpu_log_items; item->mask != 0; item++) {
-            printf("%-10s %s\n", item->name, item->help);
-        }
+        qemu_print_log_usage(stdout);
         exit(1);
     }
     cpu_set_log(mask);
diff --git a/qemu-log.c b/qemu-log.c
index 9a7e567..786d335 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -170,3 +170,12 @@ int cpu_str_to_log_mask(const char *str)
     }
     return mask;
 }
+
+void qemu_print_log_usage(FILE *f)
+{
+    const CPULogItem *item;
+    fprintf(f, "Log items (comma separated):\n");
+    for (item = cpu_log_items; item->mask != 0; item++) {
+        fprintf(f, "%-10s %s\n", item->name, item->help);
+    }
+}
commit 9a7e54242910d26d280589e1f5c7ec8814d02a6b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Feb 11 16:41:20 2013 +0000

    qemu-log: Unify {cpu_set,set_cpu}_log_filename as qemu_set_log_filename
    
    The qemu_log() functionality is no longer specific to TCG CPU debug logs.
    Rename cpu_set_log_filename() to qemu_set_log_filename() and drop the
    pointless wrapper set_cpu_log_filename().
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/bsd-user/main.c b/bsd-user/main.c
index ae24723..76ab359 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -861,7 +861,7 @@ int main(int argc, char **argv)
     }
 
     /* init debug */
-    cpu_set_log_filename(log_file);
+    qemu_set_log_filename(log_file);
     if (log_mask) {
         int mask;
         const CPULogItem *item;
diff --git a/cpus.c b/cpus.c
index 41779eb..2155441 100644
--- a/cpus.c
+++ b/cpus.c
@@ -1191,11 +1191,6 @@ void set_cpu_log(const char *optarg)
     cpu_set_log(mask);
 }
 
-void set_cpu_log_filename(const char *optarg)
-{
-    cpu_set_log_filename(optarg);
-}
-
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg)
 {
     /* XXX: implement xxx_cpu_list for targets that still miss it */
diff --git a/include/qemu/log.h b/include/qemu/log.h
index 58f69cb..4760e04 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -154,7 +154,7 @@ static inline void cpu_set_log(int log_flags)
 #endif
 }
 
-void cpu_set_log_filename(const char *filename);
+void qemu_set_log_filename(const char *filename);
 int cpu_str_to_log_mask(const char *str);
 
 #endif
diff --git a/include/sysemu/cpus.h b/include/sysemu/cpus.h
index f7f6854..60e44bb 100644
--- a/include/sysemu/cpus.h
+++ b/include/sysemu/cpus.h
@@ -25,7 +25,6 @@ extern int smp_threads;
 
 void set_numa_modes(void);
 void set_cpu_log(const char *optarg);
-void set_cpu_log_filename(const char *optarg);
 void list_cpus(FILE *f, fprintf_function cpu_fprintf, const char *optarg);
 
 #endif
diff --git a/linux-user/main.c b/linux-user/main.c
index 7902f3b..4beb5c9 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3113,7 +3113,7 @@ static void handle_arg_log(const char *arg)
 
 static void handle_arg_log_filename(const char *arg)
 {
-    cpu_set_log_filename(arg);
+    qemu_set_log_filename(arg);
 }
 
 static void handle_arg_set_env(const char *arg)
@@ -3480,7 +3480,7 @@ int main(int argc, char **argv, char **envp)
 #endif
 
     /* init debug */
-    cpu_set_log_filename(log_file);
+    qemu_set_log_filename(log_file);
     optind = parse_args(argc, argv);
 
     /* Zero out regs */
diff --git a/monitor.c b/monitor.c
index 20bd19b..578a318 100644
--- a/monitor.c
+++ b/monitor.c
@@ -964,7 +964,7 @@ static int client_migrate_info(Monitor *mon, const QDict *qdict,
 
 static void do_logfile(Monitor *mon, const QDict *qdict)
 {
-    cpu_set_log_filename(qdict_get_str(qdict, "filename"));
+    qemu_set_log_filename(qdict_get_str(qdict, "filename"));
 }
 
 static void do_log(Monitor *mon, const QDict *qdict)
diff --git a/qemu-log.c b/qemu-log.c
index 30c9ab0..9a7e567 100644
--- a/qemu-log.c
+++ b/qemu-log.c
@@ -86,7 +86,7 @@ void qemu_set_log(int log_flags, bool use_own_buffers)
     }
 }
 
-void cpu_set_log_filename(const char *filename)
+void qemu_set_log_filename(const char *filename)
 {
     g_free(logfilename);
     logfilename = g_strdup(filename);
diff --git a/vl.c b/vl.c
index 1355f69..f9f4dda 100644
--- a/vl.c
+++ b/vl.c
@@ -3865,7 +3865,7 @@ int main(int argc, char **argv, char **envp)
      */
     if (log_mask) {
         if (log_file) {
-            set_cpu_log_filename(log_file);
+            qemu_set_log_filename(log_file);
         }
         set_cpu_log(log_mask);
     }
commit 5e5f07e08f7ed8c8eb9b02d9f9c3c79cf95d65ee
Author: Evgeny Voevodin <evgenyvoevodin at gmail.com>
Date:   Fri Feb 1 01:47:23 2013 +0700

    TCG: Move translation block variables to new context inside tcg_ctx: tb_ctx
    
    It's worth to clean-up translation blocks variables and move them
    into one context as was suggested by Swirl.
    Also if we use this context directly inside tcg_ctx, then it
    speeds up code generation a bit.
    
    Signed-off-by: Evgeny Voevodin <evgenyvoevodin at gmail.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/cpu-exec.c b/cpu-exec.c
index 19ebb4a..ff9a884 100644
--- a/cpu-exec.c
+++ b/cpu-exec.c
@@ -23,8 +23,6 @@
 #include "qemu/atomic.h"
 #include "sysemu/qtest.h"
 
-int tb_invalidated_flag;
-
 //#define CONFIG_DEBUG_EXEC
 
 bool qemu_cpu_has_work(CPUState *cpu)
@@ -90,13 +88,13 @@ static TranslationBlock *tb_find_slow(CPUArchState *env,
     tb_page_addr_t phys_pc, phys_page1;
     target_ulong virt_page2;
 
-    tb_invalidated_flag = 0;
+    tcg_ctx.tb_ctx.tb_invalidated_flag = 0;
 
     /* find translated block using physical mappings */
     phys_pc = get_page_addr_code(env, pc);
     phys_page1 = phys_pc & TARGET_PAGE_MASK;
     h = tb_phys_hash_func(phys_pc);
-    ptb1 = &tb_phys_hash[h];
+    ptb1 = &tcg_ctx.tb_ctx.tb_phys_hash[h];
     for(;;) {
         tb = *ptb1;
         if (!tb)
@@ -128,8 +126,8 @@ static TranslationBlock *tb_find_slow(CPUArchState *env,
     /* Move the last found TB to the head of the list */
     if (likely(*ptb1)) {
         *ptb1 = tb->phys_hash_next;
-        tb->phys_hash_next = tb_phys_hash[h];
-        tb_phys_hash[h] = tb;
+        tb->phys_hash_next = tcg_ctx.tb_ctx.tb_phys_hash[h];
+        tcg_ctx.tb_ctx.tb_phys_hash[h] = tb;
     }
     /* we add the TB in the virtual pc hash table */
     env->tb_jmp_cache[tb_jmp_cache_hash_func(pc)] = tb;
@@ -563,16 +561,16 @@ int cpu_exec(CPUArchState *env)
 #endif
                 }
 #endif /* DEBUG_DISAS || CONFIG_DEBUG_EXEC */
-                spin_lock(&tb_lock);
+                spin_lock(&tcg_ctx.tb_ctx.tb_lock);
                 tb = tb_find_fast(env);
                 /* Note: we do it here to avoid a gcc bug on Mac OS X when
                    doing it in tb_find_slow */
-                if (tb_invalidated_flag) {
+                if (tcg_ctx.tb_ctx.tb_invalidated_flag) {
                     /* as some TB could have been invalidated because
                        of memory exceptions while generating the code, we
                        must recompute the hash index here */
                     next_tb = 0;
-                    tb_invalidated_flag = 0;
+                    tcg_ctx.tb_ctx.tb_invalidated_flag = 0;
                 }
 #ifdef CONFIG_DEBUG_EXEC
                 qemu_log_mask(CPU_LOG_EXEC, "Trace %p [" TARGET_FMT_lx "] %s\n",
@@ -585,7 +583,7 @@ int cpu_exec(CPUArchState *env)
                 if (next_tb != 0 && tb->page_addr[1] == -1) {
                     tb_add_jump((TranslationBlock *)(next_tb & ~3), next_tb & 3, tb);
                 }
-                spin_unlock(&tb_lock);
+                spin_unlock(&tcg_ctx.tb_ctx.tb_lock);
 
                 /* cpu_interrupt might be called while translating the
                    TB, but before it is linked into a potentially
diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index d235ef8..f685c28 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -168,6 +168,25 @@ struct TranslationBlock {
     uint32_t icount;
 };
 
+#include "exec/spinlock.h"
+
+typedef struct TBContext TBContext;
+
+struct TBContext {
+
+    TranslationBlock *tbs;
+    TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
+    int nb_tbs;
+    /* any access to the tbs or the page table must use this lock */
+    spinlock_t tb_lock;
+
+    /* statistics */
+    int tb_flush_count;
+    int tb_phys_invalidate_count;
+
+    int tb_invalidated_flag;
+};
+
 static inline unsigned int tb_jmp_cache_hash_page(target_ulong pc)
 {
     target_ulong tmp;
@@ -192,8 +211,6 @@ void tb_free(TranslationBlock *tb);
 void tb_flush(CPUArchState *env);
 void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr);
 
-extern TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
-
 #if defined(USE_DIRECT_JUMP)
 
 #if defined(CONFIG_TCG_INTERPRETER)
@@ -275,12 +292,6 @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
     }
 }
 
-#include "exec/spinlock.h"
-
-extern spinlock_t tb_lock;
-
-extern int tb_invalidated_flag;
-
 /* The return address may point to the start of the next instruction.
    Subtracting one gets us the call instruction itself.  */
 #if defined(CONFIG_TCG_INTERPRETER)
diff --git a/linux-user/main.c b/linux-user/main.c
index 3df8aa2..7902f3b 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -111,7 +111,7 @@ static int pending_cpus;
 /* Make sure everything is in a consistent state for calling fork().  */
 void fork_start(void)
 {
-    pthread_mutex_lock(&tb_lock);
+    pthread_mutex_lock(&tcg_ctx.tb_ctx.tb_lock);
     pthread_mutex_lock(&exclusive_lock);
     mmap_fork_start();
 }
@@ -129,11 +129,11 @@ void fork_end(int child)
         pthread_mutex_init(&cpu_list_mutex, NULL);
         pthread_cond_init(&exclusive_cond, NULL);
         pthread_cond_init(&exclusive_resume, NULL);
-        pthread_mutex_init(&tb_lock, NULL);
+        pthread_mutex_init(&tcg_ctx.tb_ctx.tb_lock, NULL);
         gdbserver_fork(thread_env);
     } else {
         pthread_mutex_unlock(&exclusive_lock);
-        pthread_mutex_unlock(&tb_lock);
+        pthread_mutex_unlock(&tcg_ctx.tb_ctx.tb_lock);
     }
 }
 
diff --git a/tcg/tcg.h b/tcg/tcg.h
index 4086e98..51c8176 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -471,6 +471,8 @@ struct TCGContext {
     size_t code_gen_buffer_max_size;
     uint8_t *code_gen_ptr;
 
+    TBContext tb_ctx;
+
 #if defined(CONFIG_QEMU_LDST_OPTIMIZATION) && defined(CONFIG_SOFTMMU)
     /* labels info for qemu_ld/st IRs
        The labels help to generate TLB miss case codes at the end of TB */
diff --git a/translate-all.c b/translate-all.c
index d666562..efeb247 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -72,13 +72,6 @@
 
 #define SMC_BITMAP_USE_THRESHOLD 10
 
-/* Translation blocks */
-static TranslationBlock *tbs;
-TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
-static int nb_tbs;
-/* any access to the tbs or the page table must use this lock */
-spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
-
 typedef struct PageDesc {
     /* list of TBs intersecting this ram page */
     TranslationBlock *first_tb;
@@ -125,10 +118,6 @@ uintptr_t qemu_host_page_mask;
    The bottom level has pointers to PageDesc.  */
 static void *l1_map[V_L1_SIZE];
 
-/* statistics */
-static int tb_flush_count;
-static int tb_phys_invalidate_count;
-
 /* code generation context */
 TCGContext tcg_ctx;
 
@@ -589,7 +578,8 @@ static inline void code_gen_alloc(size_t tb_size)
         (TCG_MAX_OP_SIZE * OPC_BUF_SIZE);
     tcg_ctx.code_gen_max_blocks = tcg_ctx.code_gen_buffer_size /
             CODE_GEN_AVG_BLOCK_SIZE;
-    tbs = g_malloc(tcg_ctx.code_gen_max_blocks * sizeof(TranslationBlock));
+    tcg_ctx.tb_ctx.tbs =
+            g_malloc(tcg_ctx.code_gen_max_blocks * sizeof(TranslationBlock));
 }
 
 /* Must be called before using the QEMU cpus. 'tb_size' is the size
@@ -620,12 +610,12 @@ static TranslationBlock *tb_alloc(target_ulong pc)
 {
     TranslationBlock *tb;
 
-    if (nb_tbs >= tcg_ctx.code_gen_max_blocks ||
+    if (tcg_ctx.tb_ctx.nb_tbs >= tcg_ctx.code_gen_max_blocks ||
         (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) >=
          tcg_ctx.code_gen_buffer_max_size) {
         return NULL;
     }
-    tb = &tbs[nb_tbs++];
+    tb = &tcg_ctx.tb_ctx.tbs[tcg_ctx.tb_ctx.nb_tbs++];
     tb->pc = pc;
     tb->cflags = 0;
     return tb;
@@ -636,9 +626,10 @@ void tb_free(TranslationBlock *tb)
     /* In practice this is mostly used for single use temporary TB
        Ignore the hard cases and just back up if this TB happens to
        be the last one generated.  */
-    if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
+    if (tcg_ctx.tb_ctx.nb_tbs > 0 &&
+            tb == &tcg_ctx.tb_ctx.tbs[tcg_ctx.tb_ctx.nb_tbs - 1]) {
         tcg_ctx.code_gen_ptr = tb->tc_ptr;
-        nb_tbs--;
+        tcg_ctx.tb_ctx.nb_tbs--;
     }
 }
 
@@ -693,27 +684,28 @@ void tb_flush(CPUArchState *env1)
 #if defined(DEBUG_FLUSH)
     printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
            (unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer),
-           nb_tbs, nb_tbs > 0 ?
+           tcg_ctx.tb_ctx.nb_tbs, tcg_ctx.tb_ctx.nb_tbs > 0 ?
            ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)) /
-           nb_tbs : 0);
+           tcg_ctx.tb_ctx.nb_tbs : 0);
 #endif
     if ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)
         > tcg_ctx.code_gen_buffer_size) {
         cpu_abort(env1, "Internal error: code buffer overflow\n");
     }
-    nb_tbs = 0;
+    tcg_ctx.tb_ctx.nb_tbs = 0;
 
     for (env = first_cpu; env != NULL; env = env->next_cpu) {
         memset(env->tb_jmp_cache, 0, TB_JMP_CACHE_SIZE * sizeof(void *));
     }
 
-    memset(tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof(void *));
+    memset(tcg_ctx.tb_ctx.tb_phys_hash, 0,
+            CODE_GEN_PHYS_HASH_SIZE * sizeof(void *));
     page_flush_tb();
 
     tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer;
     /* XXX: flush processor icache at this point if cache flush is
        expensive */
-    tb_flush_count++;
+    tcg_ctx.tb_ctx.tb_flush_count++;
 }
 
 #ifdef DEBUG_TB_CHECK
@@ -725,7 +717,7 @@ static void tb_invalidate_check(target_ulong address)
 
     address &= TARGET_PAGE_MASK;
     for (i = 0; i < CODE_GEN_PHYS_HASH_SIZE; i++) {
-        for (tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
+        for (tb = tb_ctx.tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
             if (!(address + TARGET_PAGE_SIZE <= tb->pc ||
                   address >= tb->pc + tb->size)) {
                 printf("ERROR invalidate: address=" TARGET_FMT_lx
@@ -743,7 +735,8 @@ static void tb_page_check(void)
     int i, flags1, flags2;
 
     for (i = 0; i < CODE_GEN_PHYS_HASH_SIZE; i++) {
-        for (tb = tb_phys_hash[i]; tb != NULL; tb = tb->phys_hash_next) {
+        for (tb = tcg_ctx.tb_ctx.tb_phys_hash[i]; tb != NULL;
+                tb = tb->phys_hash_next) {
             flags1 = page_get_flags(tb->pc);
             flags2 = page_get_flags(tb->pc + tb->size - 1);
             if ((flags1 & PAGE_WRITE) || (flags2 & PAGE_WRITE)) {
@@ -835,7 +828,7 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
     /* remove the TB from the hash list */
     phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK);
     h = tb_phys_hash_func(phys_pc);
-    tb_hash_remove(&tb_phys_hash[h], tb);
+    tb_hash_remove(&tcg_ctx.tb_ctx.tb_phys_hash[h], tb);
 
     /* remove the TB from the page list */
     if (tb->page_addr[0] != page_addr) {
@@ -849,7 +842,7 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
         invalidate_page_bitmap(p);
     }
 
-    tb_invalidated_flag = 1;
+    tcg_ctx.tb_ctx.tb_invalidated_flag = 1;
 
     /* remove the TB from the hash list */
     h = tb_jmp_cache_hash_func(tb->pc);
@@ -878,7 +871,7 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr)
     }
     tb->jmp_first = (TranslationBlock *)((uintptr_t)tb | 2); /* fail safe */
 
-    tb_phys_invalidate_count++;
+    tcg_ctx.tb_ctx.tb_phys_invalidate_count++;
 }
 
 static inline void set_bits(uint8_t *tab, int start, int len)
@@ -955,7 +948,7 @@ TranslationBlock *tb_gen_code(CPUArchState *env,
         /* cannot fail at this point */
         tb = tb_alloc(pc);
         /* Don't forget to invalidate previous TB info.  */
-        tb_invalidated_flag = 1;
+        tcg_ctx.tb_ctx.tb_invalidated_flag = 1;
     }
     tc_ptr = tcg_ctx.code_gen_ptr;
     tb->tc_ptr = tc_ptr;
@@ -1273,7 +1266,7 @@ static void tb_link_page(TranslationBlock *tb, tb_page_addr_t phys_pc,
     mmap_lock();
     /* add in the physical hash table */
     h = tb_phys_hash_func(phys_pc);
-    ptb = &tb_phys_hash[h];
+    ptb = &tcg_ctx.tb_ctx.tb_phys_hash[h];
     tb->phys_hash_next = *ptb;
     *ptb = tb;
 
@@ -1323,7 +1316,7 @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
     uintptr_t v;
     TranslationBlock *tb;
 
-    if (nb_tbs <= 0) {
+    if (tcg_ctx.tb_ctx.nb_tbs <= 0) {
         return NULL;
     }
     if (tc_ptr < (uintptr_t)tcg_ctx.code_gen_buffer ||
@@ -1332,10 +1325,10 @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
     }
     /* binary search (cf Knuth) */
     m_min = 0;
-    m_max = nb_tbs - 1;
+    m_max = tcg_ctx.tb_ctx.nb_tbs - 1;
     while (m_min <= m_max) {
         m = (m_min + m_max) >> 1;
-        tb = &tbs[m];
+        tb = &tcg_ctx.tb_ctx.tbs[m];
         v = (uintptr_t)tb->tc_ptr;
         if (v == tc_ptr) {
             return tb;
@@ -1345,7 +1338,7 @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
             m_min = m + 1;
         }
     }
-    return &tbs[m_max];
+    return &tcg_ctx.tb_ctx.tbs[m_max];
 }
 
 static void tb_reset_jump_recursive(TranslationBlock *tb);
@@ -1566,8 +1559,8 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
     cross_page = 0;
     direct_jmp_count = 0;
     direct_jmp2_count = 0;
-    for (i = 0; i < nb_tbs; i++) {
-        tb = &tbs[i];
+    for (i = 0; i < tcg_ctx.tb_ctx.nb_tbs; i++) {
+        tb = &tcg_ctx.tb_ctx.tbs[i];
         target_code_size += tb->size;
         if (tb->size > max_target_code_size) {
             max_target_code_size = tb->size;
@@ -1588,27 +1581,32 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
                 tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer,
                 tcg_ctx.code_gen_buffer_max_size);
     cpu_fprintf(f, "TB count            %d/%d\n",
-                nb_tbs, tcg_ctx.code_gen_max_blocks);
+            tcg_ctx.tb_ctx.nb_tbs, tcg_ctx.code_gen_max_blocks);
     cpu_fprintf(f, "TB avg target size  %d max=%d bytes\n",
-                nb_tbs ? target_code_size / nb_tbs : 0,
-                max_target_code_size);
+            tcg_ctx.tb_ctx.nb_tbs ? target_code_size /
+                    tcg_ctx.tb_ctx.nb_tbs : 0,
+            max_target_code_size);
     cpu_fprintf(f, "TB avg host size    %td bytes (expansion ratio: %0.1f)\n",
-                nb_tbs ? (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) /
-                        nb_tbs : 0,
-                target_code_size ?
-                (double) (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) /
-                    target_code_size : 0);
-    cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
-            cross_page,
-            nb_tbs ? (cross_page * 100) / nb_tbs : 0);
+            tcg_ctx.tb_ctx.nb_tbs ? (tcg_ctx.code_gen_ptr -
+                                     tcg_ctx.code_gen_buffer) /
+                                     tcg_ctx.tb_ctx.nb_tbs : 0,
+                target_code_size ? (double) (tcg_ctx.code_gen_ptr -
+                                             tcg_ctx.code_gen_buffer) /
+                                             target_code_size : 0);
+    cpu_fprintf(f, "cross page TB count %d (%d%%)\n", cross_page,
+            tcg_ctx.tb_ctx.nb_tbs ? (cross_page * 100) /
+                                    tcg_ctx.tb_ctx.nb_tbs : 0);
     cpu_fprintf(f, "direct jump count   %d (%d%%) (2 jumps=%d %d%%)\n",
                 direct_jmp_count,
-                nb_tbs ? (direct_jmp_count * 100) / nb_tbs : 0,
+                tcg_ctx.tb_ctx.nb_tbs ? (direct_jmp_count * 100) /
+                        tcg_ctx.tb_ctx.nb_tbs : 0,
                 direct_jmp2_count,
-                nb_tbs ? (direct_jmp2_count * 100) / nb_tbs : 0);
+                tcg_ctx.tb_ctx.nb_tbs ? (direct_jmp2_count * 100) /
+                        tcg_ctx.tb_ctx.nb_tbs : 0);
     cpu_fprintf(f, "\nStatistics:\n");
-    cpu_fprintf(f, "TB flush count      %d\n", tb_flush_count);
-    cpu_fprintf(f, "TB invalidate count %d\n", tb_phys_invalidate_count);
+    cpu_fprintf(f, "TB flush count      %d\n", tcg_ctx.tb_ctx.tb_flush_count);
+    cpu_fprintf(f, "TB invalidate count %d\n",
+            tcg_ctx.tb_ctx.tb_phys_invalidate_count);
     cpu_fprintf(f, "TLB flush count     %d\n", tlb_flush_count);
     tcg_dump_info(f, cpu_fprintf);
 }
commit 0b0d3320db74cde233ee7855ad32a9c121d20eb4
Author: Evgeny Voevodin <evgenyvoevodin at gmail.com>
Date:   Fri Feb 1 01:47:22 2013 +0700

    TCG: Final globals clean-up
    
    Signed-off-by: Evgeny Voevodin <evgenyvoevodin at gmail.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/tcg/tcg.c b/tcg/tcg.c
index 9275e37..c8a843e 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -263,7 +263,7 @@ void tcg_context_init(TCGContext *s)
 void tcg_prologue_init(TCGContext *s)
 {
     /* init global prologue and epilogue */
-    s->code_buf = code_gen_prologue;
+    s->code_buf = s->code_gen_prologue;
     s->code_ptr = s->code_buf;
     tcg_target_qemu_prologue(s);
     flush_icache_range((tcg_target_ulong)s->code_buf,
diff --git a/tcg/tcg.h b/tcg/tcg.h
index a427972..4086e98 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -462,6 +462,15 @@ struct TCGContext {
     uint16_t gen_opc_icount[OPC_BUF_SIZE];
     uint8_t gen_opc_instr_start[OPC_BUF_SIZE];
 
+    /* Code generation */
+    int code_gen_max_blocks;
+    uint8_t *code_gen_prologue;
+    uint8_t *code_gen_buffer;
+    size_t code_gen_buffer_size;
+    /* threshold to flush the translated code buffer */
+    size_t code_gen_buffer_max_size;
+    uint8_t *code_gen_ptr;
+
 #if defined(CONFIG_QEMU_LDST_OPTIMIZATION) && defined(CONFIG_SOFTMMU)
     /* labels info for qemu_ld/st IRs
        The labels help to generate TLB miss case codes at the end of TB */
@@ -658,12 +667,11 @@ TCGv_i64 tcg_const_i64(int64_t val);
 TCGv_i32 tcg_const_local_i32(int32_t val);
 TCGv_i64 tcg_const_local_i64(int64_t val);
 
-extern uint8_t *code_gen_prologue;
-
 /* TCG targets may use a different definition of tcg_qemu_tb_exec. */
 #if !defined(tcg_qemu_tb_exec)
 # define tcg_qemu_tb_exec(env, tb_ptr) \
-    ((tcg_target_ulong (*)(void *, void *))code_gen_prologue)(env, tb_ptr)
+    ((tcg_target_ulong (*)(void *, void *))tcg_ctx.code_gen_prologue)(env, \
+                                                                      tb_ptr)
 #endif
 
 void tcg_register_jit(void *buf, size_t buf_size);
diff --git a/translate-all.c b/translate-all.c
index d367fc4..d666562 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -72,21 +72,13 @@
 
 #define SMC_BITMAP_USE_THRESHOLD 10
 
-/* Code generation and translation blocks */
+/* Translation blocks */
 static TranslationBlock *tbs;
-static int code_gen_max_blocks;
 TranslationBlock *tb_phys_hash[CODE_GEN_PHYS_HASH_SIZE];
 static int nb_tbs;
 /* any access to the tbs or the page table must use this lock */
 spinlock_t tb_lock = SPIN_LOCK_UNLOCKED;
 
-uint8_t *code_gen_prologue;
-static uint8_t *code_gen_buffer;
-static size_t code_gen_buffer_size;
-/* threshold to flush the translated code buffer */
-static size_t code_gen_buffer_max_size;
-static uint8_t *code_gen_ptr;
-
 typedef struct PageDesc {
     /* list of TBs intersecting this ram page */
     TranslationBlock *first_tb;
@@ -514,7 +506,7 @@ static inline size_t size_code_gen_buffer(size_t tb_size)
     if (tb_size > MAX_CODE_GEN_BUFFER_SIZE) {
         tb_size = MAX_CODE_GEN_BUFFER_SIZE;
     }
-    code_gen_buffer_size = tb_size;
+    tcg_ctx.code_gen_buffer_size = tb_size;
     return tb_size;
 }
 
@@ -524,7 +516,7 @@ static uint8_t static_code_gen_buffer[DEFAULT_CODE_GEN_BUFFER_SIZE]
 
 static inline void *alloc_code_gen_buffer(void)
 {
-    map_exec(static_code_gen_buffer, code_gen_buffer_size);
+    map_exec(static_code_gen_buffer, tcg_ctx.code_gen_buffer_size);
     return static_code_gen_buffer;
 }
 #elif defined(USE_MMAP)
@@ -547,8 +539,8 @@ static inline void *alloc_code_gen_buffer(void)
        Leave the choice of exact location with the kernel.  */
     flags |= MAP_32BIT;
     /* Cannot expect to map more than 800MB in low memory.  */
-    if (code_gen_buffer_size > 800u * 1024 * 1024) {
-        code_gen_buffer_size = 800u * 1024 * 1024;
+    if (tcg_ctx.code_gen_buffer_size > 800u * 1024 * 1024) {
+        tcg_ctx.code_gen_buffer_size = 800u * 1024 * 1024;
     }
 # elif defined(__sparc__)
     start = 0x40000000ul;
@@ -556,17 +548,17 @@ static inline void *alloc_code_gen_buffer(void)
     start = 0x90000000ul;
 # endif
 
-    buf = mmap((void *)start, code_gen_buffer_size,
+    buf = mmap((void *)start, tcg_ctx.code_gen_buffer_size,
                PROT_WRITE | PROT_READ | PROT_EXEC, flags, -1, 0);
     return buf == MAP_FAILED ? NULL : buf;
 }
 #else
 static inline void *alloc_code_gen_buffer(void)
 {
-    void *buf = g_malloc(code_gen_buffer_size);
+    void *buf = g_malloc(tcg_ctx.code_gen_buffer_size);
 
     if (buf) {
-        map_exec(buf, code_gen_buffer_size);
+        map_exec(buf, tcg_ctx.code_gen_buffer_size);
     }
     return buf;
 }
@@ -574,27 +566,30 @@ static inline void *alloc_code_gen_buffer(void)
 
 static inline void code_gen_alloc(size_t tb_size)
 {
-    code_gen_buffer_size = size_code_gen_buffer(tb_size);
-    code_gen_buffer = alloc_code_gen_buffer();
-    if (code_gen_buffer == NULL) {
+    tcg_ctx.code_gen_buffer_size = size_code_gen_buffer(tb_size);
+    tcg_ctx.code_gen_buffer = alloc_code_gen_buffer();
+    if (tcg_ctx.code_gen_buffer == NULL) {
         fprintf(stderr, "Could not allocate dynamic translator buffer\n");
         exit(1);
     }
 
-    qemu_madvise(code_gen_buffer, code_gen_buffer_size, QEMU_MADV_HUGEPAGE);
+    qemu_madvise(tcg_ctx.code_gen_buffer, tcg_ctx.code_gen_buffer_size,
+            QEMU_MADV_HUGEPAGE);
 
     /* Steal room for the prologue at the end of the buffer.  This ensures
        (via the MAX_CODE_GEN_BUFFER_SIZE limits above) that direct branches
        from TB's to the prologue are going to be in range.  It also means
        that we don't need to mark (additional) portions of the data segment
        as executable.  */
-    code_gen_prologue = code_gen_buffer + code_gen_buffer_size - 1024;
-    code_gen_buffer_size -= 1024;
+    tcg_ctx.code_gen_prologue = tcg_ctx.code_gen_buffer +
+            tcg_ctx.code_gen_buffer_size - 1024;
+    tcg_ctx.code_gen_buffer_size -= 1024;
 
-    code_gen_buffer_max_size = code_gen_buffer_size -
+    tcg_ctx.code_gen_buffer_max_size = tcg_ctx.code_gen_buffer_size -
         (TCG_MAX_OP_SIZE * OPC_BUF_SIZE);
-    code_gen_max_blocks = code_gen_buffer_size / CODE_GEN_AVG_BLOCK_SIZE;
-    tbs = g_malloc(code_gen_max_blocks * sizeof(TranslationBlock));
+    tcg_ctx.code_gen_max_blocks = tcg_ctx.code_gen_buffer_size /
+            CODE_GEN_AVG_BLOCK_SIZE;
+    tbs = g_malloc(tcg_ctx.code_gen_max_blocks * sizeof(TranslationBlock));
 }
 
 /* Must be called before using the QEMU cpus. 'tb_size' is the size
@@ -604,8 +599,8 @@ void tcg_exec_init(unsigned long tb_size)
 {
     cpu_gen_init();
     code_gen_alloc(tb_size);
-    code_gen_ptr = code_gen_buffer;
-    tcg_register_jit(code_gen_buffer, code_gen_buffer_size);
+    tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer;
+    tcg_register_jit(tcg_ctx.code_gen_buffer, tcg_ctx.code_gen_buffer_size);
     page_init();
 #if !defined(CONFIG_USER_ONLY) || !defined(CONFIG_USE_GUEST_BASE)
     /* There's no guest base to take into account, so go ahead and
@@ -616,7 +611,7 @@ void tcg_exec_init(unsigned long tb_size)
 
 bool tcg_enabled(void)
 {
-    return code_gen_buffer != NULL;
+    return tcg_ctx.code_gen_buffer != NULL;
 }
 
 /* Allocate a new translation block. Flush the translation buffer if
@@ -625,8 +620,9 @@ static TranslationBlock *tb_alloc(target_ulong pc)
 {
     TranslationBlock *tb;
 
-    if (nb_tbs >= code_gen_max_blocks ||
-        (code_gen_ptr - code_gen_buffer) >= code_gen_buffer_max_size) {
+    if (nb_tbs >= tcg_ctx.code_gen_max_blocks ||
+        (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) >=
+         tcg_ctx.code_gen_buffer_max_size) {
         return NULL;
     }
     tb = &tbs[nb_tbs++];
@@ -641,7 +637,7 @@ void tb_free(TranslationBlock *tb)
        Ignore the hard cases and just back up if this TB happens to
        be the last one generated.  */
     if (nb_tbs > 0 && tb == &tbs[nb_tbs - 1]) {
-        code_gen_ptr = tb->tc_ptr;
+        tcg_ctx.code_gen_ptr = tb->tc_ptr;
         nb_tbs--;
     }
 }
@@ -696,12 +692,13 @@ void tb_flush(CPUArchState *env1)
 
 #if defined(DEBUG_FLUSH)
     printf("qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n",
-           (unsigned long)(code_gen_ptr - code_gen_buffer),
+           (unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer),
            nb_tbs, nb_tbs > 0 ?
-           ((unsigned long)(code_gen_ptr - code_gen_buffer)) / nb_tbs : 0);
+           ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)) /
+           nb_tbs : 0);
 #endif
-    if ((unsigned long)(code_gen_ptr - code_gen_buffer)
-        > code_gen_buffer_size) {
+    if ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)
+        > tcg_ctx.code_gen_buffer_size) {
         cpu_abort(env1, "Internal error: code buffer overflow\n");
     }
     nb_tbs = 0;
@@ -713,7 +710,7 @@ void tb_flush(CPUArchState *env1)
     memset(tb_phys_hash, 0, CODE_GEN_PHYS_HASH_SIZE * sizeof(void *));
     page_flush_tb();
 
-    code_gen_ptr = code_gen_buffer;
+    tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer;
     /* XXX: flush processor icache at this point if cache flush is
        expensive */
     tb_flush_count++;
@@ -960,14 +957,14 @@ TranslationBlock *tb_gen_code(CPUArchState *env,
         /* Don't forget to invalidate previous TB info.  */
         tb_invalidated_flag = 1;
     }
-    tc_ptr = code_gen_ptr;
+    tc_ptr = tcg_ctx.code_gen_ptr;
     tb->tc_ptr = tc_ptr;
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
     cpu_gen_code(env, tb, &code_gen_size);
-    code_gen_ptr = (void *)(((uintptr_t)code_gen_ptr + code_gen_size +
-                             CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
+    tcg_ctx.code_gen_ptr = (void *)(((uintptr_t)tcg_ctx.code_gen_ptr +
+            code_gen_size + CODE_GEN_ALIGN - 1) & ~(CODE_GEN_ALIGN - 1));
 
     /* check next page if needed */
     virt_page2 = (pc + tb->size - 1) & TARGET_PAGE_MASK;
@@ -1312,8 +1309,9 @@ bool is_tcg_gen_code(uintptr_t tc_ptr)
 {
     /* This can be called during code generation, code_gen_buffer_max_size
        is used instead of code_gen_ptr for upper boundary checking */
-    return (tc_ptr >= (uintptr_t)code_gen_buffer &&
-            tc_ptr < (uintptr_t)(code_gen_buffer + code_gen_buffer_max_size));
+    return (tc_ptr >= (uintptr_t)tcg_ctx.code_gen_buffer &&
+            tc_ptr < (uintptr_t)(tcg_ctx.code_gen_buffer +
+                    tcg_ctx.code_gen_buffer_max_size));
 }
 #endif
 
@@ -1328,8 +1326,8 @@ static TranslationBlock *tb_find_pc(uintptr_t tc_ptr)
     if (nb_tbs <= 0) {
         return NULL;
     }
-    if (tc_ptr < (uintptr_t)code_gen_buffer ||
-        tc_ptr >= (uintptr_t)code_gen_ptr) {
+    if (tc_ptr < (uintptr_t)tcg_ctx.code_gen_buffer ||
+        tc_ptr >= (uintptr_t)tcg_ctx.code_gen_ptr) {
         return NULL;
     }
     /* binary search (cf Knuth) */
@@ -1587,16 +1585,19 @@ void dump_exec_info(FILE *f, fprintf_function cpu_fprintf)
     /* XXX: avoid using doubles ? */
     cpu_fprintf(f, "Translation buffer state:\n");
     cpu_fprintf(f, "gen code size       %td/%zd\n",
-                code_gen_ptr - code_gen_buffer, code_gen_buffer_max_size);
+                tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer,
+                tcg_ctx.code_gen_buffer_max_size);
     cpu_fprintf(f, "TB count            %d/%d\n",
-                nb_tbs, code_gen_max_blocks);
+                nb_tbs, tcg_ctx.code_gen_max_blocks);
     cpu_fprintf(f, "TB avg target size  %d max=%d bytes\n",
                 nb_tbs ? target_code_size / nb_tbs : 0,
                 max_target_code_size);
     cpu_fprintf(f, "TB avg host size    %td bytes (expansion ratio: %0.1f)\n",
-                nb_tbs ? (code_gen_ptr - code_gen_buffer) / nb_tbs : 0,
-                target_code_size ? (double) (code_gen_ptr - code_gen_buffer)
-                / target_code_size : 0);
+                nb_tbs ? (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) /
+                        nb_tbs : 0,
+                target_code_size ?
+                (double) (tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) /
+                    target_code_size : 0);
     cpu_fprintf(f, "cross page TB count %d (%d%%)\n",
             cross_page,
             nb_tbs ? (cross_page * 100) / nb_tbs : 0);
commit 2742f56d134ba0f5ed7e447afd0b6e2001ffc5c1
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Feb 15 17:40:56 2013 -0600

    Open up 1.5 development tree
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index 88c5fb8..8fe423b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.4.0
+1.4.50
commit 03e94e39ce5259efdbdeefa1f249ddb499d57321
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Feb 15 16:15:40 2013 -0600

    Update VERSION for release
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index a24ba92..88c5fb8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.3.92
+1.4.0
commit 571f65ec20fbcb991d7bce51787248ab9d325e3f
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Thu Feb 14 08:58:49 2013 -0600

    Update VERSION of release
    
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/VERSION b/VERSION
index aa6058d..a24ba92 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.3.91
+1.3.92
commit 71652365c53115d2090d294406ec0bd3b7c63953
Author: Alexander Graf <agraf at suse.de>
Date:   Wed Feb 13 23:58:12 2013 +0100

    Revert "Update OpenBIOS images"
    
    This reverts commit 10442558ab1797bfbb01285b909e34c5cf038f12.
    
    With the updated OpenBIOS image, -M g3beige fails to boot quik.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Message-id: 1360796292-27078-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/pc-bios/README b/pc-bios/README
index bb182dc..eff3de7 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -12,7 +12,7 @@
   1275-1994 (referred to as Open Firmware) compliant firmware.
   The included images for PowerPC (for 32 and 64 bit PPC CPUs),
   Sparc32 and Sparc64 are built from OpenBIOS SVN revision
-  1097.
+  1063.
 
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
diff --git a/pc-bios/openbios-ppc b/pc-bios/openbios-ppc
index c37c258..5311eca 100644
Binary files a/pc-bios/openbios-ppc and b/pc-bios/openbios-ppc differ
diff --git a/pc-bios/openbios-sparc32 b/pc-bios/openbios-sparc32
index 79e816e..6bd8e45 100644
Binary files a/pc-bios/openbios-sparc32 and b/pc-bios/openbios-sparc32 differ
diff --git a/pc-bios/openbios-sparc64 b/pc-bios/openbios-sparc64
index 14624e9..7c06fcc 100644
Binary files a/pc-bios/openbios-sparc64 and b/pc-bios/openbios-sparc64 differ
diff --git a/roms/openbios b/roms/openbios
index a5af2b3..f095c85 160000
--- a/roms/openbios
+++ b/roms/openbios
@@ -1 +1 @@
-Subproject commit a5af2b322e54104f1b095c8c156ffd03bf6ca3e9
+Subproject commit f095c858136896d236931357b8d597f407286f71
commit 9893c80d81587ac25d8ea4a82651371b54e7df35
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Feb 12 11:29:31 2013 +1000

    cadance_uart: Accept input after rx FIFO pop
    
    The device returns false from the can receive function when the FIFO is
    full. This means the device should check for buffered input whenever a byte is
    popped from the FIFO.
    
    Reported-by: Jason Wu <huanyu at xilinx.com>
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Message-id: 1360632571-25638-1-git-send-email-peter.crosthwaite at xilinx.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/cadence_uart.c b/hw/cadence_uart.c
index cf2f53c..5766d38 100644
--- a/hw/cadence_uart.c
+++ b/hw/cadence_uart.c
@@ -343,6 +343,7 @@ static void uart_read_rx_fifo(UartState *s, uint32_t *c)
         if (!s->rx_count) {
             s->r[R_SR] |= UART_SR_INTR_REMPTY;
         }
+        qemu_chr_accept_input(s->chr);
     } else {
         *c = 0;
         s->r[R_SR] |= UART_SR_INTR_REMPTY;
commit 8a8f5840082eb65d140ccfe7b128c92390cce1c3
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Feb 13 09:25:34 2013 +0100

    block/curl: only restrict protocols with libcurl>=7.19.4
    
    The curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, ...) interface was
    introduced in libcurl 7.19.4.  Therefore we cannot protect against
    CVE-2013-0249 when linking against an older libcurl.
    
    This fixes the build failure introduced by
    fb6d1bbd246c7a57ef53d3847ef225cd1349d602.
    
    Reported-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Tested-by: Andreas Färber <andreas.faeber at web.de>
    Message-id: 1360743934-8337-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block/curl.c b/block/curl.c
index f6226b3..98947da 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -309,9 +309,13 @@ static CURLState *curl_init_state(BDRVCURLState *s)
     /* Restrict supported protocols to avoid security issues in the more
      * obscure protocols.  For example, do not allow POP3/SMTP/IMAP see
      * CVE-2013-0249.
+     *
+     * Restricting protocols is only supported from 7.19.4 upwards.
      */
+#if LIBCURL_VERSION_NUM >= 0x071304
     curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS);
     curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS);
+#endif
 
 #ifdef DEBUG_VERBOSE
     curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1);
commit d36b2b904ee921b380fad559cb824a40eb587bcb
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 15:54:16 2013 +0100

    qapi: Flatten away ChardevPort
    
    Simplifies the schema and the code.
    
    QMP command
    
        { "execute" : "chardev-add",
          "arguments" : { "id" : "ser0",
                          "backend" : { "type" : "port",
                                        "data" : { "type": "serial",
                                                   "device":"/dev/ttyS0"} } } }
    
    becomes
    
        { "execute" : "chardev-add",
          "arguments" : { "id" : "ser0",
                          "backend" : { "type" : "serial",
                                        "data" : { "device":"/dev/ttyS0"} } } }
    
    Bonus: nicer error messages.  "unknown chardev port (1)" becomes
    "character device backend type 'parallel' not supported".
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Message-id: 1360767256-610-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index bd289ae..7275b5d 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3095,7 +3095,7 @@
                                    'out' : 'str' } }
 
 ##
-# @ChardevPort:
+# @ChardevHostdev:
 #
 # Configuration info for device chardevs.
 #
@@ -3105,11 +3105,7 @@
 #
 # Since: 1.4
 ##
-{ 'enum': 'ChardevPortKind', 'data': [ 'serial',
-                                       'parallel' ] }
-
-{ 'type': 'ChardevPort', 'data': { 'device' : 'str',
-                                   'type'   : 'ChardevPortKind'} }
+{ 'type': 'ChardevHostdev', 'data': { 'device' : 'str' } }
 
 ##
 # @ChardevSocket:
@@ -3142,7 +3138,8 @@
 { 'type': 'ChardevDummy', 'data': { } }
 
 { 'union': 'ChardevBackend', 'data': { 'file'   : 'ChardevFile',
-                                       'port'   : 'ChardevPort',
+                                       'serial' : 'ChardevHostdev',
+                                       'parallel': 'ChardevHostdev',
                                        'socket' : 'ChardevSocket',
                                        'pty'    : 'ChardevDummy',
                                        'null'   : 'ChardevDummy' } }
diff --git a/qemu-char.c b/qemu-char.c
index 574d3d2..e4b0f53 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3269,15 +3269,17 @@ static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)
     return qemu_chr_open_win_file(out);
 }
 
-static CharDriverState *qmp_chardev_open_port(ChardevPort *port, Error **errp)
+static CharDriverState *qmp_chardev_open_serial(ChardevHostdev *serial,
+                                                Error **errp)
 {
-    switch (port->type) {
-    case CHARDEV_PORT_KIND_SERIAL:
-        return qemu_chr_open_win_path(port->device);
-    default:
-        error_setg(errp, "unknown chardev port (%d)", port->type);
-        return NULL;
-    }
+    return qemu_chr_open_win_path(serial->device);
+}
+
+static CharDriverState *qmp_chardev_open_parallel(ChardevHostdev *parallel,
+                                                  Error **errp)
+{
+    error_setg(errp, "character device backend type 'parallel' not supported");
+    return NULL;
 }
 
 #else /* WIN32 */
@@ -3316,38 +3318,39 @@ static CharDriverState *qmp_chardev_open_file(ChardevFile *file, Error **errp)
     return qemu_chr_open_fd(in, out);
 }
 
-static CharDriverState *qmp_chardev_open_port(ChardevPort *port, Error **errp)
+static CharDriverState *qmp_chardev_open_serial(ChardevHostdev *serial,
+                                                Error **errp)
 {
-    switch (port->type) {
 #ifdef HAVE_CHARDEV_TTY
-    case CHARDEV_PORT_KIND_SERIAL:
-    {
-        int flags, fd;
-        flags = O_RDWR;
-        fd = qmp_chardev_open_file_source(port->device, flags, errp);
-        if (error_is_set(errp)) {
-            return NULL;
-        }
-        socket_set_nonblock(fd);
-        return qemu_chr_open_tty_fd(fd);
+    int fd;
+
+    fd = qmp_chardev_open_file_source(serial->device, O_RDWR, errp);
+    if (error_is_set(errp)) {
+        return NULL;
     }
+    socket_set_nonblock(fd);
+    return qemu_chr_open_tty_fd(fd);
+#else
+    error_setg(errp, "character device backend type 'serial' not supported");
+    return NULL;
 #endif
+}
+
+static CharDriverState *qmp_chardev_open_parallel(ChardevHostdev *parallel,
+                                                  Error **errp)
+{
 #ifdef HAVE_CHARDEV_PARPORT
-    case CHARDEV_PORT_KIND_PARALLEL:
-    {
-        int flags, fd;
-        flags = O_RDWR;
-        fd = qmp_chardev_open_file_source(port->device, flags, errp);
-        if (error_is_set(errp)) {
-            return NULL;
-        }
-        return qemu_chr_open_pp_fd(fd);
-    }
-#endif
-    default:
-        error_setg(errp, "unknown chardev port (%d)", port->type);
+    int fd;
+
+    fd = qmp_chardev_open_file_source(parallel->device, O_RDWR, errp);
+    if (error_is_set(errp)) {
         return NULL;
     }
+    return qemu_chr_open_pp_fd(fd);
+#else
+    error_setg(errp, "character device backend type 'parallel' not supported");
+    return NULL;
+#endif
 }
 
 #endif /* WIN32 */
@@ -3391,8 +3394,11 @@ ChardevReturn *qmp_chardev_add(const char *id, ChardevBackend *backend,
     case CHARDEV_BACKEND_KIND_FILE:
         chr = qmp_chardev_open_file(backend->file, errp);
         break;
-    case CHARDEV_BACKEND_KIND_PORT:
-        chr = qmp_chardev_open_port(backend->port, errp);
+    case CHARDEV_BACKEND_KIND_SERIAL:
+        chr = qmp_chardev_open_serial(backend->serial, errp);
+        break;
+    case CHARDEV_BACKEND_KIND_PARALLEL:
+        chr = qmp_chardev_open_parallel(backend->parallel, errp);
         break;
     case CHARDEV_BACKEND_KIND_SOCKET:
         chr = qmp_chardev_open_socket(backend->socket, errp);
commit d037d6bbbcdda6552254286b6da090ef0dc0d98a
Author: Markus Armbruster <armbru at redhat.com>
Date:   Wed Feb 13 15:54:15 2013 +0100

    chardev: Fix manual page and qemu-doc for -chardev tty
    
    Broken in commit d59044ef.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Message-id: 1360767256-610-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 046bdc0..9d7131a 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1956,7 +1956,7 @@ Connect to a local BrlAPI server. @option{braille} does not take any options.
 @item -chardev tty ,id=@var{id} ,path=@var{path}
 
 @option{tty} is only available on Linux, Sun, FreeBSD, NetBSD, OpenBSD and
-DragonFlyBSD hosts.  It is an alias for -serial.
+DragonFlyBSD hosts.  It is an alias for @option{serial}.
 
 @option{path} specifies the path to the tty. @option{path} is required.
 
commit cc2a90432d9cb7546a2c4360ad7200a2fb3af31a
Author: Andreas Färber <afaerber at suse.de>
Date:   Tue Feb 12 23:16:06 2013 +0100

    net: Avoid NULL function pointer dereference on cleanup
    
    The pSeries machine and some other devices don't supply a cleanup
    callback. Revert part of 1ceef9f27359cbe92ef124bf74de6f792e71f6fb that
    started calling it unconditionally.
    
    Cc: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1360707366-9271-1-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/net/net.c b/net/net.c
index f9e7136..be03a8d 100644
--- a/net/net.c
+++ b/net/net.c
@@ -287,7 +287,9 @@ static void qemu_cleanup_net_client(NetClientState *nc)
 {
     QTAILQ_REMOVE(&net_clients, nc, next);
 
-    nc->info->cleanup(nc);
+    if (nc->info->cleanup) {
+        nc->info->cleanup(nc);
+    }
 }
 
 static void qemu_free_net_client(NetClientState *nc)
commit 91b0a8f33419573c1d741e49559bfb666fd8b1f0
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Thu Feb 7 02:20:51 2013 +0000

    s390: Fix handling of iscs.
    
    There are two ways to express an interruption subclass:
    - As a bitmask, as used in cr6.
    - As a number, as used in the I/O interruption word.
    
    Unfortunately, we have treated to I/O interruption word as if it
    contained the bitmask as well, which went unnoticed so far as
    - (queued-for-next) kvm made the same mistake, and
    - Linux guest kernels don't check the isc value in the I/O interruption
      word for subchannel interrupts.
    
    Make sure that we treat the I/O interruption word correctly.
    
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 3244201..85f6f22 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -87,7 +87,7 @@ static void css_inject_io_interrupt(SubchDev *sch)
                       css_build_subchannel_id(sch),
                       sch->schid,
                       sch->curr_status.pmcw.intparm,
-                      (0x80 >> isc) << 24);
+                      isc << 27);
 }
 
 void css_conditional_io_interrupt(SubchDev *sch)
@@ -111,7 +111,7 @@ void css_conditional_io_interrupt(SubchDev *sch)
                           css_build_subchannel_id(sch),
                           sch->schid,
                           sch->curr_status.pmcw.intparm,
-                          (0x80 >> isc) << 24);
+                          isc << 27);
     }
 }
 
diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h
index 01e59b9..fa8dfe0 100644
--- a/target-s390x/cpu.h
+++ b/target-s390x/cpu.h
@@ -1001,7 +1001,7 @@ static inline void cpu_inject_io(S390CPU *cpu, uint16_t subchannel_id,
                                  uint32_t io_int_parm, uint32_t io_int_word)
 {
     CPUS390XState *env = &cpu->env;
-    int isc = ffs(io_int_word << 2) - 1;
+    int isc = IO_INT_WORD_ISC(io_int_word);
 
     if (env->io_index[isc] == MAX_IO_QUEUE - 1) {
         /* ugh - can't queue anymore. Let's drop. */
diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 9f9088b..7626831 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -628,6 +628,8 @@ static void do_io_interrupt(CPUS390XState *env)
     }
 
     for (isc = 0; isc < ARRAY_SIZE(env->io_index); isc++) {
+        uint64_t isc_bits;
+
         if (env->io_index[isc] < 0) {
             continue;
         }
@@ -637,7 +639,8 @@ static void do_io_interrupt(CPUS390XState *env)
         }
 
         q = &env->io_queue[env->io_index[isc]][isc];
-        if (!(env->cregs[6] & q->word)) {
+        isc_bits = ISC_TO_ISC_BITS(IO_INT_WORD_ISC(q->word));
+        if (!(env->cregs[6] & isc_bits)) {
             disable = 0;
             continue;
         }
diff --git a/target-s390x/ioinst.h b/target-s390x/ioinst.h
index d5a43f4..7bed291 100644
--- a/target-s390x/ioinst.h
+++ b/target-s390x/ioinst.h
@@ -209,6 +209,9 @@ typedef struct IOIntCode {
 #define IOINST_SCHID_SSID(_schid)  ((_schid & 0x00060000) >> 17)
 #define IOINST_SCHID_NR(_schid)    (_schid & 0x0000ffff)
 
+#define IO_INT_WORD_ISC(_int_word) ((_int_word & 0x38000000) >> 24)
+#define ISC_TO_ISC_BITS(_isc)      ((0x80 >> _isc) << 24)
+
 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
                                  int *schid);
 int ioinst_handle_xsch(CPUS390XState *env, uint64_t reg1);
commit bd9a8d852c857fd19c4626acaac1d4979f816f3a
Author: Cornelia Huck <cornelia.huck at de.ibm.com>
Date:   Thu Feb 7 02:20:50 2013 +0000

    s390: Keep I/O interrupts enabled for all iscs.
    
    do_io_interrupt() would stop scanning further iscs if it found
    an I/O interrupt it could inject. This might cause the pending
    interrupt indication for I/O interrupts to be reset although there
    might be queued I/O interrupts for subsequent iscs.
    
    Fix this by reordering the logic: Inject the I/O interrupt immediately
    and continue searching all iscs for queued interrupts.
    
    Signed-off-by: Cornelia Huck <cornelia.huck at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/target-s390x/helper.c b/target-s390x/helper.c
index 043feb2..9f9088b 100644
--- a/target-s390x/helper.c
+++ b/target-s390x/helper.c
@@ -617,7 +617,6 @@ static void do_ext_interrupt(CPUS390XState *env)
 
 static void do_io_interrupt(CPUS390XState *env)
 {
-    uint64_t mask = 0, addr = 0;
     LowCore *lowcore;
     IOIntQueue *q;
     uint8_t isc;
@@ -642,36 +641,39 @@ static void do_io_interrupt(CPUS390XState *env)
             disable = 0;
             continue;
         }
-        found = 1;
-        lowcore = cpu_map_lowcore(env);
+        if (!found) {
+            uint64_t mask, addr;
 
-        lowcore->subchannel_id = cpu_to_be16(q->id);
-        lowcore->subchannel_nr = cpu_to_be16(q->nr);
-        lowcore->io_int_parm = cpu_to_be32(q->parm);
-        lowcore->io_int_word = cpu_to_be32(q->word);
-        lowcore->io_old_psw.mask = cpu_to_be64(get_psw_mask(env));
-        lowcore->io_old_psw.addr = cpu_to_be64(env->psw.addr);
-        mask = be64_to_cpu(lowcore->io_new_psw.mask);
-        addr = be64_to_cpu(lowcore->io_new_psw.addr);
+            found = 1;
+            lowcore = cpu_map_lowcore(env);
 
-        cpu_unmap_lowcore(lowcore);
+            lowcore->subchannel_id = cpu_to_be16(q->id);
+            lowcore->subchannel_nr = cpu_to_be16(q->nr);
+            lowcore->io_int_parm = cpu_to_be32(q->parm);
+            lowcore->io_int_word = cpu_to_be32(q->word);
+            lowcore->io_old_psw.mask = cpu_to_be64(get_psw_mask(env));
+            lowcore->io_old_psw.addr = cpu_to_be64(env->psw.addr);
+            mask = be64_to_cpu(lowcore->io_new_psw.mask);
+            addr = be64_to_cpu(lowcore->io_new_psw.addr);
 
-        env->io_index[isc]--;
+            cpu_unmap_lowcore(lowcore);
+
+            env->io_index[isc]--;
+
+            DPRINTF("%s: %" PRIx64 " %" PRIx64 "\n", __func__,
+                    env->psw.mask, env->psw.addr);
+            load_psw(env, mask, addr);
+        }
         if (env->io_index[isc] >= 0) {
             disable = 0;
         }
-        break;
+        continue;
     }
 
     if (disable) {
         env->pending_int &= ~INTERRUPT_IO;
     }
 
-    if (found) {
-        DPRINTF("%s: %" PRIx64 " %" PRIx64 "\n", __func__,
-                env->psw.mask, env->psw.addr);
-        load_psw(env, mask, addr);
-    }
 }
 
 static void do_mchk_interrupt(CPUS390XState *env)
commit 760794f784f66e262a9ca32821ba202cdf3a3e4b
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Mon Feb 4 22:53:24 2013 +0000

    s390/sclpconsole: prevent char layer callback during initialization
    
    Starting a qemu with an sclp console and pressing a key very early
    can result in
    "qemu-system-s390x: hw/s390x/sclpconsole.c:60: receive_from_chr_layer:
    Assertion `scon->iov' failed."
    
    Lets make sure that the init process is finished, since the iov is
    allocated after CHR_EVENT_OPENED by also checking for scon->iov.
    
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/s390x/sclpconsole.c b/hw/s390x/sclpconsole.c
index adc0ee8..effe511 100644
--- a/hw/s390x/sclpconsole.c
+++ b/hw/s390x/sclpconsole.c
@@ -44,12 +44,9 @@ typedef struct SCLPConsole {
 /* Return number of bytes that fit into iov buffer */
 static int chr_can_read(void *opaque)
 {
-    int can_read;
     SCLPConsole *scon = opaque;
 
-    can_read = SIZE_BUFFER_VT220 - scon->iov_data_len;
-
-    return can_read;
+    return scon->iov ? SIZE_BUFFER_VT220 - scon->iov_data_len : 0;
 }
 
 /* Receive n bytes from character layer, save in iov buffer,
commit 7ce4106c2125eca8f7f61f460456a49074c13e56
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Feb 12 11:17:11 2013 +1000

    xilinx.h: s/xilinx_axiethernetdma()/xilinx_axidma()
    
    This function has nothing to do with ethernet. Its reusable for all DMA clients.
    Dropped the "ethernet" in the name accordingly.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/hw/petalogix_ml605_mmu.c b/hw/petalogix_ml605_mmu.c
index 8fd55a0..82d7183 100644
--- a/hw/petalogix_ml605_mmu.c
+++ b/hw/petalogix_ml605_mmu.c
@@ -140,8 +140,8 @@ petalogix_ml605_init(QEMUMachineInitArgs *args)
     xilinx_axiethernet_init(eth0, &nd_table[0], STREAM_SLAVE(dma),
                                    0x82780000, irq[3], 0x1000, 0x1000);
 
-    xilinx_axiethernetdma_init(dma, STREAM_SLAVE(eth0),
-                               0x84600000, irq[1], irq[0], 100 * 1000000);
+    xilinx_axidma_init(dma, STREAM_SLAVE(eth0), 0x84600000, irq[1], irq[0],
+                       100 * 1000000);
 
     {
         SSIBus *spi;
diff --git a/hw/xilinx.h b/hw/xilinx.h
index d255ca7..09bc2e4 100644
--- a/hw/xilinx.h
+++ b/hw/xilinx.h
@@ -71,9 +71,8 @@ xilinx_axiethernet_init(DeviceState *dev, NICInfo *nd, StreamSlave *peer,
 }
 
 static inline void
-xilinx_axiethernetdma_init(DeviceState *dev, StreamSlave *peer,
-                           hwaddr base, qemu_irq irq,
-                           qemu_irq irq2, int freqhz)
+xilinx_axidma_init(DeviceState *dev, StreamSlave *peer, hwaddr base,
+                   qemu_irq irq, qemu_irq irq2, int freqhz)
 {
     Error *errp = NULL;
 
commit dada5c7e92434df7c0ec152fe9a8f0e3de67b632
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Tue Feb 12 11:17:10 2013 +1000

    xilinx.h: Dont qdev_create from ethernet_create()
    
    Pulled the qdev_create functionality out of xilinx_axiethernet_create() and
    pushed it up to the petalogix_ml605_mmu machine model. This makes the ethernet
    create+init process consistent with the AXI DMA. Renamed function to
    xilinx_axiethernet_init accordingly.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/hw/petalogix_ml605_mmu.c b/hw/petalogix_ml605_mmu.c
index bdfc6ce..8fd55a0 100644
--- a/hw/petalogix_ml605_mmu.c
+++ b/hw/petalogix_ml605_mmu.c
@@ -129,14 +129,16 @@ petalogix_ml605_init(QEMUMachineInitArgs *args)
     xilinx_timer_create(TIMER_BASEADDR, irq[2], 0, 100 * 1000000);
 
     /* axi ethernet and dma initialization. */
+    qemu_check_nic_model(&nd_table[0], "xlnx.axi-ethernet");
+    eth0 = qdev_create(NULL, "xlnx.axi-ethernet");
     dma = qdev_create(NULL, "xlnx.axi-dma");
 
     /* FIXME: attach to the sysbus instead */
     object_property_add_child(container_get(qdev_get_machine(), "/unattached"),
                                   "xilinx-dma", OBJECT(dma), NULL);
 
-    eth0 = xilinx_axiethernet_create(&nd_table[0], STREAM_SLAVE(dma),
-                                     0x82780000, irq[3], 0x1000, 0x1000);
+    xilinx_axiethernet_init(eth0, &nd_table[0], STREAM_SLAVE(dma),
+                                   0x82780000, irq[3], 0x1000, 0x1000);
 
     xilinx_axiethernetdma_init(dma, STREAM_SLAVE(eth0),
                                0x84600000, irq[1], irq[0], 100 * 1000000);
diff --git a/hw/xilinx.h b/hw/xilinx.h
index 725f2f4..d255ca7 100644
--- a/hw/xilinx.h
+++ b/hw/xilinx.h
@@ -53,17 +53,12 @@ xilinx_ethlite_create(NICInfo *nd, hwaddr base, qemu_irq irq,
     return dev;
 }
 
-static inline DeviceState *
-xilinx_axiethernet_create(NICInfo *nd, StreamSlave *peer,
-                          hwaddr base, qemu_irq irq,
-                          int txmem, int rxmem)
+static inline void
+xilinx_axiethernet_init(DeviceState *dev, NICInfo *nd, StreamSlave *peer,
+                        hwaddr base, qemu_irq irq, int txmem, int rxmem)
 {
-    DeviceState *dev;
     Error *errp = NULL;
 
-    qemu_check_nic_model(nd, "xlnx.axi-ethernet");
-
-    dev = qdev_create(NULL, "xlnx.axi-ethernet");
     qdev_set_nic_properties(dev, nd);
     qdev_prop_set_uint32(dev, "rxmem", rxmem);
     qdev_prop_set_uint32(dev, "txmem", txmem);
@@ -73,8 +68,6 @@ xilinx_axiethernet_create(NICInfo *nd, StreamSlave *peer,
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
     sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq);
-
-    return dev;
 }
 
 static inline void
commit 0231ed4f22dd67844d8bbc027eaa5b713cb25ba2
Merge: 6aaa9da 33ccf66
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Tue Feb 12 16:26:52 2013 -0600

    Merge remote-tracking branch 'stefanha/block' into staging
    
    * stefanha/block:
      Revert "block/vpc: Fix size calculation"
      block/raw-posix: detect readonly Linux block devices using BLKROGET

commit 6aaa9dae8059633d52ddcd0622de1a2700fc58a8
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 12 10:37:15 2013 +0100

    block-migration: fix pending() and iterate() return values
    
    The return value of .save_live_pending() is the number of bytes
    remaining.  This is just an estimate because we do not know how many
    blocks will be dirtied by the running guest.
    
    Currently our return value for .save_live_pending() is wrong because it
    includes dirty blocks but not in-flight bdrv_aio_readv() requests or
    unsent blocks.  Crucially, it also doesn't include the bulk phase where
    the entire device is transferred - therefore we risk completing block
    migration before all blocks have been transferred!
    
    The return value of .save_live_iterate() is the number of bytes
    transferred this iteration.  Currently we return whether there are bytes
    remaining, which is incorrect.
    
    Move the bytes remaining calculation into .save_live_pending() and
    really return the number of bytes transferred this iteration in
    .save_live_iterate().
    
    Also fix the %ld format specifier which was used for a uint64_t
    argument.  PRIu64 must be use to avoid warnings on 32-bit hosts.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Message-id: 1360661835-28663-3-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block-migration.c b/block-migration.c
index bcd0039..43ab202 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -539,6 +539,7 @@ static int block_save_setup(QEMUFile *f, void *opaque)
 static int block_save_iterate(QEMUFile *f, void *opaque)
 {
     int ret;
+    int64_t last_ftell = qemu_ftell(f);
 
     DPRINTF("Enter save live iterate submitted %d transferred %d\n",
             block_mig_state.submitted, block_mig_state.transferred);
@@ -582,12 +583,7 @@ static int block_save_iterate(QEMUFile *f, void *opaque)
 
     qemu_put_be64(f, BLK_MIG_FLAG_EOS);
 
-    /* Complete when bulk transfer is done and all dirty blocks have been
-     * transferred.
-     */
-    return block_mig_state.bulk_completed &&
-           block_mig_state.submitted == 0 &&
-           block_mig_state.read_done == 0;
+    return qemu_ftell(f) - last_ftell;
 }
 
 static int block_save_complete(QEMUFile *f, void *opaque)
@@ -629,10 +625,18 @@ static int block_save_complete(QEMUFile *f, void *opaque)
 
 static uint64_t block_save_pending(QEMUFile *f, void *opaque, uint64_t max_size)
 {
+    /* Estimate pending number of bytes to send */
+    uint64_t pending = get_remaining_dirty() +
+                       block_mig_state.submitted * BLOCK_SIZE +
+                       block_mig_state.read_done * BLOCK_SIZE;
+
+    /* Report at least one block pending during bulk phase */
+    if (pending == 0 && !block_mig_state.bulk_completed) {
+        pending = BLOCK_SIZE;
+    }
 
-    DPRINTF("Enter save live pending  %ld\n", get_remaining_dirty());
-
-    return get_remaining_dirty();
+    DPRINTF("Enter save live pending  %" PRIu64 "\n", pending);
+    return pending;
 }
 
 static int block_load(QEMUFile *f, void *opaque, int version_id)
commit ad55ab42d494c5f4ebc5199c5c9db473b7d5fbf9
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 12 10:37:14 2013 +0100

    migration: make qemu_ftell() public and support writable files
    
    Migration .save_live_iterate() functions return the number of bytes
    transferred.  The easiest way of doing this is by calling qemu_ftell(f)
    at the beginning and end of the function to calculate the difference.
    
    Make qemu_ftell() public so that block-migration will be able to use it.
    Also adjust the ftell calculation for writable files where buf_offset
    does not include buf_size.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Juan Quintela <quintela at redhat.com>
    Message-id: 1360661835-28663-2-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/migration/qemu-file.h b/include/migration/qemu-file.h
index 68deefb..46fc11d 100644
--- a/include/migration/qemu-file.h
+++ b/include/migration/qemu-file.h
@@ -81,6 +81,7 @@ QEMUFile *qemu_popen(FILE *popen_file, const char *mode);
 QEMUFile *qemu_popen_cmd(const char *command, const char *mode);
 int qemu_get_fd(QEMUFile *f);
 int qemu_fclose(QEMUFile *f);
+int64_t qemu_ftell(QEMUFile *f);
 void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size);
 void qemu_put_byte(QEMUFile *f, int v);
 
diff --git a/savevm.c b/savevm.c
index 0b6724d..a8a53ef 100644
--- a/savevm.c
+++ b/savevm.c
@@ -673,9 +673,14 @@ int qemu_get_byte(QEMUFile *f)
     return result;
 }
 
-static int64_t qemu_ftell(QEMUFile *f)
+int64_t qemu_ftell(QEMUFile *f)
 {
-    return f->buf_offset - f->buf_size + f->buf_index;
+    /* buf_offset excludes buffer for writing but includes it for reading */
+    if (f->is_write) {
+        return f->buf_offset + f->buf_index;
+    } else {
+        return f->buf_offset - f->buf_size + f->buf_index;
+    }
 }
 
 int qemu_file_rate_limit(QEMUFile *f)
commit 4a0e6714b06453078e02029e1432fab052927691
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 12 14:34:05 2013 +0100

    trace: deal with deprecated glib thread functions
    
    g_thread_create() was deprecated in favor of g_thread_new() and
    g_cond_new() was deprecated in favor of GCond initialization.  If the
    host has glib 2.31 or newer, avoid using the deprecated functions.
    
    This patch solves compiler warnings that are generated when glib's
    deprecated functions are used.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360676045-9204-3-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/trace/simple.c b/trace/simple.c
index 1d5d8e4..375d98f 100644
--- a/trace/simple.c
+++ b/trace/simple.c
@@ -40,8 +40,18 @@
  * records to become available, writes them out, and then waits again.
  */
 static GStaticMutex trace_lock = G_STATIC_MUTEX_INIT;
+
+/* g_cond_new() was deprecated in glib 2.31 but we still need to support it */
+#if GLIB_CHECK_VERSION(2, 31, 0)
+static GCond the_trace_available_cond;
+static GCond the_trace_empty_cond;
+static GCond *trace_available_cond = &the_trace_available_cond;
+static GCond *trace_empty_cond = &the_trace_empty_cond;
+#else
 static GCond *trace_available_cond;
 static GCond *trace_empty_cond;
+#endif
+
 static bool trace_available;
 static bool trace_writeout_enabled;
 
@@ -397,7 +407,13 @@ static GThread *trace_thread_create(GThreadFunc fn)
     sigfillset(&set);
     pthread_sigmask(SIG_SETMASK, &set, &oldset);
 #endif
+
+#if GLIB_CHECK_VERSION(2, 31, 0)
+    thread = g_thread_new("trace-thread", fn, NULL);
+#else
     thread = g_thread_create(fn, NULL, FALSE, NULL);
+#endif
+
 #ifndef _WIN32
     pthread_sigmask(SIG_SETMASK, &oldset, NULL);
 #endif
@@ -418,8 +434,10 @@ bool trace_backend_init(const char *events, const char *file)
 #endif
     }
 
+#if !GLIB_CHECK_VERSION(2, 31, 0)
     trace_available_cond = g_cond_new();
     trace_empty_cond = g_cond_new();
+#endif
 
     thread = trace_thread_create(writeout_thread);
     if (!thread) {
commit 30d940875dcd1adfbfd7fe7ccd3e543408519662
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 12 14:34:04 2013 +0100

    trace: use glib atomic int types
    
    Juan reported that RHEL 6.4 hosts give compiler warnings because we use
    unsigned int while glib prototypes use volatile gint in trace/simple.c.
    
      trace/simple.c:223: error: pointer targets in passing argument 1 of 'g_atomic_int_compare_and_exchange' differ in signedness
    
    These variables are only accessed with glib atomic int functions so
    let's play it by the book and use volatile gint.
    
    Reported-by: Juan Quintela <quintela at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360676045-9204-2-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/trace/simple.c b/trace/simple.c
index 74701e3..1d5d8e4 100644
--- a/trace/simple.c
+++ b/trace/simple.c
@@ -51,9 +51,9 @@ enum {
 };
 
 uint8_t trace_buf[TRACE_BUF_LEN];
-static unsigned int trace_idx;
+static volatile gint trace_idx;
 static unsigned int writeout_idx;
-static int dropped_events;
+static volatile gint dropped_events;
 static FILE *trace_fp;
 static char *trace_file_name;
 
@@ -267,7 +267,7 @@ void trace_record_finish(TraceBufferRecord *rec)
     record.event |= TRACE_RECORD_VALID;
     write_to_buffer(rec->tbuf_idx, &record, sizeof(TraceRecord));
 
-    if ((g_atomic_int_get(&trace_idx) - writeout_idx)
+    if (((unsigned int)g_atomic_int_get(&trace_idx) - writeout_idx)
         > TRACE_BUF_FLUSH_THRESHOLD) {
         flush_trace_file(false);
     }
commit 33ccf6675faa3c56f30399e184064fd126904515
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 12 12:25:15 2013 +0100

    Revert "block/vpc: Fix size calculation"
    
    This reverts commit f880defbb06708d30a38ce9f2667067626acdd38.
    
    Jeff Cody's testing revealed that the interpretation of size differs
    even between VirtualPC and HyperV.  Revert this so there is time to
    consider the impact of any backwards incompatible behavior this change
    creates.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vpc.c b/block/vpc.c
index b4ff564..82229ef 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -34,8 +34,6 @@
 
 #define HEADER_SIZE 512
 
-#define VHD_SECTOR_SIZE 512
-
 //#define CACHE
 
 enum vhd_type {
@@ -206,13 +204,11 @@ static int vpc_open(BlockDriverState *bs, int flags)
     /* Write 'checksum' back to footer, or else will leave it with zero. */
     footer->checksum = be32_to_cpu(checksum);
 
-    /* The visible size of a image in Virtual PC depends on the guest:
-     * QEMU and other emulators report the real size (here in sectors).
-     * All modern operating systems use this real size.
-     * Very old operating systems use CHS values to calculate the total size.
-     * This calculated size is usually smaller than the real size.
-     */
-    bs->total_sectors = be64_to_cpu(footer->size) / VHD_SECTOR_SIZE;
+    // The visible size of a image in Virtual PC depends on the geometry
+    // rather than on the size stored in the footer (the size in the footer
+    // is too large usually)
+    bs->total_sectors = (int64_t)
+        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;
 
     /* Allow a maximum disk size of approximately 2 TB */
     if (bs->total_sectors >= 65535LL * 255 * 255) {
commit da888d37b0b85fc23e4ea55ab8b0c482d4918afb
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Feb 5 12:28:33 2013 +0100

    block/raw-posix: detect readonly Linux block devices using BLKROGET
    
    Linux block devices can be set read-only with "blockdev --setro
    <device>".  The same thing can be done for LVM volumes using "lvchange
    --permission r <volume>".  This read-only setting is independent of
    device node permissions.  Therefore the device can still be opened
    O_RDWR but actual writes will fail.
    
    This results in odd behavior for QEMU.  bdrv_open() is supposed to fail
    if a read-only image is being opened with BDRV_O_RDWR.  By not failing
    for Linux block devices, the guest boots up but every write produces an
    I/O error.
    
    This patch checks whether the block device is read-only so that Linux
    block devices behave like regular files.
    
    Reported-by: Sibiao Luo <sluo at redhat.com>
    Suggested-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 8b6b926..4dfdf98 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1257,9 +1257,43 @@ static int hdev_probe_device(const char *filename)
     return 0;
 }
 
+static int check_hdev_writable(BDRVRawState *s)
+{
+#if defined(BLKROGET)
+    /* Linux block devices can be configured "read-only" using blockdev(8).
+     * This is independent of device node permissions and therefore open(2)
+     * with O_RDWR succeeds.  Actual writes fail with EPERM.
+     *
+     * bdrv_open() is supposed to fail if the disk is read-only.  Explicitly
+     * check for read-only block devices so that Linux block devices behave
+     * properly.
+     */
+    struct stat st;
+    int readonly = 0;
+
+    if (fstat(s->fd, &st)) {
+        return -errno;
+    }
+
+    if (!S_ISBLK(st.st_mode)) {
+        return 0;
+    }
+
+    if (ioctl(s->fd, BLKROGET, &readonly) < 0) {
+        return -errno;
+    }
+
+    if (readonly) {
+        return -EACCES;
+    }
+#endif /* defined(BLKROGET) */
+    return 0;
+}
+
 static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
 {
     BDRVRawState *s = bs->opaque;
+    int ret;
 
 #if defined(__APPLE__) && defined(__MACH__)
     if (strstart(filename, "/dev/cdrom", NULL)) {
@@ -1300,7 +1334,20 @@ static int hdev_open(BlockDriverState *bs, const char *filename, int flags)
     }
 #endif
 
-    return raw_open_common(bs, filename, flags, 0);
+    ret = raw_open_common(bs, filename, flags, 0);
+    if (ret < 0) {
+        return ret;
+    }
+
+    if (flags & BDRV_O_RDWR) {
+        ret = check_hdev_writable(s);
+        if (ret < 0) {
+            raw_close(bs);
+            return ret;
+        }
+    }
+
+    return ret;
 }
 
 #if defined(__linux__)
commit 03ec2f83087de34924489eeae0ea6fe7785cc050
Author: Kuo-Jung Su <dantesu at faraday-tech.com>
Date:   Mon Feb 4 17:56:25 2013 +0800

    hw/m25p80.c: add WRSR(0x01) support
    
    Atmel, SST and Intel/Numonyx serial flash tend to power up
    with the software protection bits set.
    And thus the new m25p80.c in linux kernel would always tries
    to use WREN(0x06) + WRSR(0x01) to turn-off the protection.
    
    The WEL(0x02) of status register is supposed to be cleared after
    WRSR(0x01). There are also some drivers (i.e mine for RTOSes)
    would check the WEL(0x02) in status register to make sure the
    protection is correctly turned off.
    
    Signed-off-by: Kuo-Jung Su <dantesu at faraday-tech.com>
    Cc: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Cc: Peter Maydell <peter.maydell at linaro.org>
    Cc: Edgar E. Iglesias <edgar.iglesias at gmail.com>
    Reviewed-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/hw/m25p80.c b/hw/m25p80.c
index 788c196..461b41c 100644
--- a/hw/m25p80.c
+++ b/hw/m25p80.c
@@ -184,6 +184,7 @@ static const FlashPartInfo known_devices[] = {
 
 typedef enum {
     NOP = 0,
+    WRSR = 0x1,
     WRDI = 0x4,
     RDSR = 0x5,
     WREN = 0x6,
@@ -379,6 +380,11 @@ static void complete_collecting_data(Flash *s)
     case ERASE_SECTOR:
         flash_erase(s, s->cur_addr, s->cmd_in_progress);
         break;
+    case WRSR:
+        if (s->write_enable) {
+            s->write_enable = false;
+        }
+        break;
     default:
         break;
     }
@@ -443,6 +449,15 @@ static void decode_new_cmd(Flash *s, uint32_t value)
         s->state = STATE_COLLECTING_DATA;
         break;
 
+    case WRSR:
+        if (s->write_enable) {
+            s->needed_bytes = 1;
+            s->pos = 0;
+            s->len = 0;
+            s->state = STATE_COLLECTING_DATA;
+        }
+        break;
+
     case WRDI:
         s->write_enable = false;
         break;
commit 58fa4325228f61d58317f48364259b31e9b92d15
Author: Markus Armbruster <armbru at redhat.com>
Date:   Mon Feb 11 18:05:48 2013 +0100

    qapi: Improve chardev-add documentation
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360602348-4727-1-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index 736f881..bd289ae 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -3152,6 +3152,9 @@
 #
 # Return info about the chardev backend just created.
 #
+# @pty: #optional name of the slave pseudoterminal device, present if
+#       and only if a chardev of type 'pty' was created
+#
 # Since: 1.4
 ##
 { 'type' : 'ChardevReturn', 'data': { '*pty' : 'str' } }
@@ -3159,12 +3162,12 @@
 ##
 # @chardev-add:
 #
-# Add a file chardev
+# Add a character device backend
 #
 # @id: the chardev's ID, must be unique
 # @backend: backend type and parameters
 #
-# Returns: chardev info.
+# Returns: ChardevReturn.
 #
 # Since: 1.4
 ##
@@ -3175,7 +3178,7 @@
 ##
 # @chardev-remove:
 #
-# Remove a chardev
+# Remove a character device backend
 #
 # @id: the chardev's ID, must exist and not be in use
 #
commit d7cd369402191814a1bb339a730f3af411e9682f
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Feb 11 17:01:45 2013 +0100

    migration: restrict scope of incoming fd read handler
    
    The incoming migration is processed in a coroutine and uses an fd read
    handler to enter the yielded coroutine when data becomes available.
    
    The read handler was set too broadly, so that spurious coroutine entries
    were be triggered if other coroutine users yielded (like the block
    layer's bdrv_write() function).
    
    Install the fd read only only when yielding for more data to become
    available.  This prevents spurious coroutine entries which break code
    that assumes only a specific set of places can re-enter the coroutine.
    
    This patch fixes crashes in block/raw-posix.c that are triggered with
    "migrate -b" when qiov becomes a dangling pointer due to a spurious
    coroutine entry that frees qiov early.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360598505-5512-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/migration.c b/migration.c
index c4589b1..b1ebb01 100644
--- a/migration.c
+++ b/migration.c
@@ -95,7 +95,6 @@ static void process_incoming_migration_co(void *opaque)
     int ret;
 
     ret = qemu_loadvm_state(f);
-    qemu_set_fd_handler(qemu_get_fd(f), NULL, NULL, NULL);
     qemu_fclose(f);
     if (ret < 0) {
         fprintf(stderr, "load of migration failed\n");
@@ -115,12 +114,6 @@ static void process_incoming_migration_co(void *opaque)
     }
 }
 
-static void enter_migration_coroutine(void *opaque)
-{
-    Coroutine *co = opaque;
-    qemu_coroutine_enter(co, NULL);
-}
-
 void process_incoming_migration(QEMUFile *f)
 {
     Coroutine *co = qemu_coroutine_create(process_incoming_migration_co);
@@ -128,7 +121,6 @@ void process_incoming_migration(QEMUFile *f)
 
     assert(fd != -1);
     socket_set_nonblock(fd);
-    qemu_set_fd_handler(fd, enter_migration_coroutine, NULL, co);
     qemu_coroutine_enter(co, f);
 }
 
diff --git a/savevm.c b/savevm.c
index 4eb29b2..0b6724d 100644
--- a/savevm.c
+++ b/savevm.c
@@ -140,6 +140,34 @@ typedef struct QEMUFileSocket
     QEMUFile *file;
 } QEMUFileSocket;
 
+typedef struct {
+    Coroutine *co;
+    int fd;
+} FDYieldUntilData;
+
+static void fd_coroutine_enter(void *opaque)
+{
+    FDYieldUntilData *data = opaque;
+    qemu_set_fd_handler(data->fd, NULL, NULL, NULL);
+    qemu_coroutine_enter(data->co, NULL);
+}
+
+/**
+ * Yield until a file descriptor becomes readable
+ *
+ * Note that this function clobbers the handlers for the file descriptor.
+ */
+static void coroutine_fn yield_until_fd_readable(int fd)
+{
+    FDYieldUntilData data;
+
+    assert(qemu_in_coroutine());
+    data.co = qemu_coroutine_self();
+    data.fd = fd;
+    qemu_set_fd_handler(fd, fd_coroutine_enter, NULL, &data);
+    qemu_coroutine_yield();
+}
+
 static int socket_get_fd(void *opaque)
 {
     QEMUFileSocket *s = opaque;
@@ -158,8 +186,7 @@ static int socket_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
             break;
         }
         if (socket_error() == EAGAIN) {
-            assert(qemu_in_coroutine());
-            qemu_coroutine_yield();
+            yield_until_fd_readable(s->fd);
         } else if (socket_error() != EINTR) {
             break;
         }
@@ -205,8 +232,7 @@ static int stdio_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
             break;
         }
         if (errno == EAGAIN) {
-            assert(qemu_in_coroutine());
-            qemu_coroutine_yield();
+            yield_until_fd_readable(fileno(fp));
         } else if (errno != EINTR) {
             break;
         }
commit d0bce760e04b1658a3b4ac95be2839ae20fd86db
Author: Andreas Färber <andreas.faerber at web.de>
Date:   Mon Feb 11 17:41:54 2013 +0100

    libi2c-omap: Fix endianness dependency
    
    The libqos driver for omap_i2c currently does not work on Big Endian.
    Introduce helpers for reading from and writing to 16-bit armel registers.
    
    This fixes tmp105-test failures on ppc.
    
    To prepare for a QTest-level endianness solution, poison mem{read,write}
    and always use the helpers. Adopt the expected signatures.
    To avoid an unused variable warning, assert the STAT Single Byte Data
    bit but, due to it not getting cleared, only it being set when len == 1.
    
    Signed-off-by: Andreas Färber <andreas.faerber at web.de>
    Message-id: 1360600914-5448-3-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libi2c-omap.c b/tests/libi2c-omap.c
index 9be57e9..b7b10b5 100644
--- a/tests/libi2c-omap.c
+++ b/tests/libi2c-omap.c
@@ -12,6 +12,7 @@
 #include <string.h>
 
 #include "qemu/osdep.h"
+#include "qemu/bswap.h"
 #include "libqtest.h"
 
 enum OMAPI2CRegisters {
@@ -48,12 +49,35 @@ typedef struct OMAPI2C {
 } OMAPI2C;
 
 
+/* FIXME Use TBD readw qtest API */
+static inline uint16_t readw(uint64_t addr)
+{
+    uint16_t data;
+
+    memread(addr, &data, 2);
+    return le16_to_cpu(data);
+}
+
+/* FIXME Use TBD writew qtest API */
+static inline void writew(uint64_t addr, uint16_t data)
+{
+    data = cpu_to_le16(data);
+    memwrite(addr, &data, 2);
+}
+
+#ifdef __GNUC__
+#undef memread
+#undef memwrite
+#pragma GCC poison memread
+#pragma GCC poison memwrite
+#endif
+
 static void omap_i2c_set_slave_addr(OMAPI2C *s, uint8_t addr)
 {
     uint16_t data = addr;
 
-    memwrite(s->addr + OMAP_I2C_SA, &data, 2);
-    memread(s->addr + OMAP_I2C_SA, &data, 2);
+    writew(s->addr + OMAP_I2C_SA, data);
+    data = readw(s->addr + OMAP_I2C_SA);
     g_assert_cmphex(data, ==, addr);
 }
 
@@ -66,36 +90,38 @@ static void omap_i2c_send(I2CAdapter *i2c, uint8_t addr,
     omap_i2c_set_slave_addr(s, addr);
 
     data = len;
-    memwrite(s->addr + OMAP_I2C_CNT, &data, 2);
+    writew(s->addr + OMAP_I2C_CNT, data);
 
     data = OMAP_I2C_CON_I2C_EN |
            OMAP_I2C_CON_TRX |
            OMAP_I2C_CON_MST |
            OMAP_I2C_CON_STT |
            OMAP_I2C_CON_STP;
-    memwrite(s->addr + OMAP_I2C_CON, &data, 2);
-    memread(s->addr + OMAP_I2C_CON, &data, 2);
+    writew(s->addr + OMAP_I2C_CON, data);
+    data = readw(s->addr + OMAP_I2C_CON);
     g_assert((data & OMAP_I2C_CON_STP) != 0);
 
-    memread(s->addr + OMAP_I2C_STAT, &data, 2);
+    data = readw(s->addr + OMAP_I2C_STAT);
     g_assert((data & OMAP_I2C_STAT_NACK) == 0);
 
     while (len > 1) {
-        memread(s->addr + OMAP_I2C_STAT, &data, 2);
+        data = readw(s->addr + OMAP_I2C_STAT);
         g_assert((data & OMAP_I2C_STAT_XRDY) != 0);
 
-        memwrite(s->addr + OMAP_I2C_DATA, buf, 2);
+        data = buf[0] | ((uint16_t)buf[1] << 8);
+        writew(s->addr + OMAP_I2C_DATA, data);
         buf = (uint8_t *)buf + 2;
         len -= 2;
     }
     if (len == 1) {
-        memread(s->addr + OMAP_I2C_STAT, &data, 2);
+        data = readw(s->addr + OMAP_I2C_STAT);
         g_assert((data & OMAP_I2C_STAT_XRDY) != 0);
 
-        memwrite(s->addr + OMAP_I2C_DATA, buf, 1);
+        data = buf[0];
+        writew(s->addr + OMAP_I2C_DATA, data);
     }
 
-    memread(s->addr + OMAP_I2C_CON, &data, 2);
+    data = readw(s->addr + OMAP_I2C_CON);
     g_assert((data & OMAP_I2C_CON_STP) == 0);
 }
 
@@ -108,42 +134,46 @@ static void omap_i2c_recv(I2CAdapter *i2c, uint8_t addr,
     omap_i2c_set_slave_addr(s, addr);
 
     data = len;
-    memwrite(s->addr + OMAP_I2C_CNT, &data, 2);
+    writew(s->addr + OMAP_I2C_CNT, data);
 
     data = OMAP_I2C_CON_I2C_EN |
            OMAP_I2C_CON_MST |
            OMAP_I2C_CON_STT |
            OMAP_I2C_CON_STP;
-    memwrite(s->addr + OMAP_I2C_CON, &data, 2);
-    memread(s->addr + OMAP_I2C_CON, &data, 2);
+    writew(s->addr + OMAP_I2C_CON, data);
+    data = readw(s->addr + OMAP_I2C_CON);
     g_assert((data & OMAP_I2C_CON_STP) == 0);
 
-    memread(s->addr + OMAP_I2C_STAT, &data, 2);
+    data = readw(s->addr + OMAP_I2C_STAT);
     g_assert((data & OMAP_I2C_STAT_NACK) == 0);
 
-    memread(s->addr + OMAP_I2C_CNT, &data, 2);
+    data = readw(s->addr + OMAP_I2C_CNT);
     g_assert_cmpuint(data, ==, len);
 
     while (len > 0) {
-        memread(s->addr + OMAP_I2C_STAT, &data, 2);
+        data = readw(s->addr + OMAP_I2C_STAT);
         g_assert((data & OMAP_I2C_STAT_RRDY) != 0);
         g_assert((data & OMAP_I2C_STAT_ROVR) == 0);
 
-        memread(s->addr + OMAP_I2C_DATA, &data, 2);
+        data = readw(s->addr + OMAP_I2C_DATA);
+
+        stat = readw(s->addr + OMAP_I2C_STAT);
 
-        memread(s->addr + OMAP_I2C_STAT, &stat, 2);
         if (unlikely(len == 1)) {
-            *buf = data & 0xf;
+            g_assert((stat & OMAP_I2C_STAT_SBD) != 0);
+
+            buf[0] = data & 0xff;
             buf++;
             len--;
         } else {
-            memcpy(buf, &data, 2);
+            buf[0] = data & 0xff;
+            buf[1] = data >> 8;
             buf += 2;
             len -= 2;
         }
     }
 
-    memread(s->addr + OMAP_I2C_CON, &data, 2);
+    data = readw(s->addr + OMAP_I2C_CON);
     g_assert((data & OMAP_I2C_CON_STP) == 0);
 }
 
@@ -159,7 +189,7 @@ I2CAdapter *omap_i2c_create(uint64_t addr)
     i2c->recv = omap_i2c_recv;
 
     /* verify the mmio address by looking for a known signature */
-    memread(addr + OMAP_I2C_REV, &data, 2);
+    data = readw(addr + OMAP_I2C_REV);
     g_assert_cmphex(data, ==, 0x34);
 
     return i2c;
commit 5dd6be069bf832f888005d28cebdec16720dedac
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Feb 11 17:41:53 2013 +0100

    qtest: Use strtoull() for uint64_t
    
    On 32-bit hosts, unsigned long may be uint32_t and uint64_t may be
    unsigned long long. Account for this by always using strtoull().
    We were already using strtoll() for int64_t.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Reviewed-by: Anthony Liguori <aliguori at us.ibm.com>
    Message-id: 1360600914-5448-2-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qtest.c b/qtest.c
index b7a3821..4663a38 100644
--- a/qtest.c
+++ b/qtest.c
@@ -282,8 +282,8 @@ static void qtest_process_command(CharDriverState *chr, gchar **words)
         uint8_t *data;
 
         g_assert(words[1] && words[2]);
-        addr = strtoul(words[1], NULL, 0);
-        len = strtoul(words[2], NULL, 0);
+        addr = strtoull(words[1], NULL, 0);
+        len = strtoull(words[2], NULL, 0);
 
         data = g_malloc(len);
         cpu_physical_memory_read(addr, data, len);
@@ -302,8 +302,8 @@ static void qtest_process_command(CharDriverState *chr, gchar **words)
         size_t data_len;
 
         g_assert(words[1] && words[2] && words[3]);
-        addr = strtoul(words[1], NULL, 0);
-        len = strtoul(words[2], NULL, 0);
+        addr = strtoull(words[1], NULL, 0);
+        len = strtoull(words[2], NULL, 0);
 
         data_len = strlen(words[3]);
         if (data_len < 3) {
commit 84eac31707a8f103cc9a0b38ab62a8832bec1153
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Feb 11 18:35:39 2013 +0100

    libqtest: Fix documentation copy&paste errors
    
    The [qtest_]in[bwl]() functions/macros don't have a value argument.
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1360604139-16797-1-git-send-email-afaerber at suse.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/tests/libqtest.h b/tests/libqtest.h
index c8ade85..110e2ec 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -109,7 +109,6 @@ void qtest_outl(QTestState *s, uint16_t addr, uint32_t value);
  * qtest_inb:
  * @s: QTestState instance to operate on.
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns an 8-bit value from an I/O port.
  */
@@ -119,7 +118,6 @@ uint8_t qtest_inb(QTestState *s, uint16_t addr);
  * qtest_inw:
  * @s: QTestState instance to operate on.
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns a 16-bit value from an I/O port.
  */
@@ -129,7 +127,6 @@ uint16_t qtest_inw(QTestState *s, uint16_t addr);
  * qtest_inl:
  * @s: QTestState instance to operate on.
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns a 32-bit value from an I/O port.
  */
@@ -279,7 +276,6 @@ void qtest_add_func(const char *str, void (*fn));
 /**
  * inb:
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns an 8-bit value from an I/O port.
  */
@@ -288,7 +284,6 @@ void qtest_add_func(const char *str, void (*fn));
 /**
  * inw:
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns a 16-bit value from an I/O port.
  */
@@ -297,7 +292,6 @@ void qtest_add_func(const char *str, void (*fn));
 /**
  * inl:
  * @addr: I/O port to read from.
- * @value: Value being written.
  *
  * Returns a 32-bit value from an I/O port.
  */
commit f880defbb06708d30a38ce9f2667067626acdd38
Author: Stefan Weil <stefan at kiwi.(none)>
Date:   Thu Feb 7 20:26:52 2013 +0100

    block/vpc: Fix size calculation
    
    The size calculated from the CHS values is not the real image (disk) size,
    but usually a smaller value. This is caused by rounding effects.
    
    Only older operating systems use CHS. Such guests won't be able to use
    the whole disk. All modern operating systems use the real size.
    
    This patch fixes https://bugs.launchpad.net/qemu/+bug/1105670/.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Message-id: 1360265212-22037-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block/vpc.c b/block/vpc.c
index 82229ef..b4ff564 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -34,6 +34,8 @@
 
 #define HEADER_SIZE 512
 
+#define VHD_SECTOR_SIZE 512
+
 //#define CACHE
 
 enum vhd_type {
@@ -204,11 +206,13 @@ static int vpc_open(BlockDriverState *bs, int flags)
     /* Write 'checksum' back to footer, or else will leave it with zero. */
     footer->checksum = be32_to_cpu(checksum);
 
-    // The visible size of a image in Virtual PC depends on the geometry
-    // rather than on the size stored in the footer (the size in the footer
-    // is too large usually)
-    bs->total_sectors = (int64_t)
-        be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;
+    /* The visible size of a image in Virtual PC depends on the guest:
+     * QEMU and other emulators report the real size (here in sectors).
+     * All modern operating systems use this real size.
+     * Very old operating systems use CHS values to calculate the total size.
+     * This calculated size is usually smaller than the real size.
+     */
+    bs->total_sectors = be64_to_cpu(footer->size) / VHD_SECTOR_SIZE;
 
     /* Allow a maximum disk size of approximately 2 TB */
     if (bs->total_sectors >= 65535LL * 255 * 255) {
commit 2c5a7f20112615ce13a3434ab90bee1ed8d44ebd
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Sun Feb 10 23:12:46 2013 +0100

    block-migration: fix block_save_iterate() return value
    
    The .save_live_iterate() function returns 0 to continue iterating or 1
    to stop iterating.
    
    Since 16310a3cca7320edb9341c976f7819de0a8c27e0 it only ever returns 0,
    leading to an infinite loop.
    
    Return 1 if we have finished sending dirty blocks.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1360534366-26723-4-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block-migration.c b/block-migration.c
index a91d96b..bcd0039 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -582,7 +582,12 @@ static int block_save_iterate(QEMUFile *f, void *opaque)
 
     qemu_put_be64(f, BLK_MIG_FLAG_EOS);
 
-    return 0;
+    /* Complete when bulk transfer is done and all dirty blocks have been
+     * transferred.
+     */
+    return block_mig_state.bulk_completed &&
+           block_mig_state.submitted == 0 &&
+           block_mig_state.read_done == 0;
 }
 
 static int block_save_complete(QEMUFile *f, void *opaque)
commit 9ee0cb201e6bfe03549a649fd165a85cfed34d05
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Sun Feb 10 23:12:45 2013 +0100

    block-migration: fix blk_mig_save_dirty_block() return value checking
    
    Commit 43be3a25c931a7f61a76fbfc9d35584cbfc5fb58 changed the
    blk_mig_save_dirty_block() return code handling.  The function's doc
    comment says:
    
      /* return value:
       * 0: too much data for max_downtime
       * 1: few enough data for max_downtime
       */
    
    Because of the 1 return value, callers must check for ret < 0 instead of
    just:
    
      if (ret) { ... }
    
    We do not want to bail when 1 is returned, only on error.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360534366-26723-3-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block-migration.c b/block-migration.c
index 573319a..a91d96b 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -569,7 +569,7 @@ static int block_save_iterate(QEMUFile *f, void *opaque)
             }
         }
     }
-    if (ret) {
+    if (ret < 0) {
         blk_mig_cleanup();
         return ret;
     }
@@ -609,7 +609,7 @@ static int block_save_complete(QEMUFile *f, void *opaque)
     } while (ret == 0);
 
     blk_mig_cleanup();
-    if (ret) {
+    if (ret < 0) {
         return ret;
     }
     /* report completion */
commit d5f1f286ef8c7c96614779a40af724d7109175d5
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Sun Feb 10 23:12:44 2013 +0100

    block-migration: improve "Unknown flags" error message
    
    Show the actual flags value and include "block migration" in the error
    message so it's clear where the error is coming from.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Message-id: 1360534366-26723-2-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block-migration.c b/block-migration.c
index 9ac7de6..573319a 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -695,7 +695,7 @@ static int block_load(QEMUFile *f, void *opaque, int version_id)
                    (addr == 100) ? '\n' : '\r');
             fflush(stdout);
         } else if (!(flags & BLK_MIG_FLAG_EOS)) {
-            fprintf(stderr, "Unknown flags\n");
+            fprintf(stderr, "Unknown block migration flags: %#x\n", flags);
             return -EINVAL;
         }
         ret = qemu_file_get_error(f);
commit 49295ebc56a303a60c6ca2ead6f548eae3521150
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:19 2013 +0100

    vl: Exit unsuccessfully on option argument syntax error
    
    We exit successfully after reporting syntax error for argument of
    --sandbox and --add-fd.
    
    We continue undaunted after reporting it for argument of -boot,
    --option-rom and --object.
    
    Change all five to exit unsuccessfully, like the other options.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-7-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/vl.c b/vl.c
index 73122d8..1355f69 100644
--- a/vl.c
+++ b/vl.c
@@ -3135,8 +3135,10 @@ int main(int argc, char **argv, char **envp)
                                 exit(1);
                             }
                         }
-                        qemu_opts_parse(qemu_find_opts("boot-opts"),
-                                        optarg, 0);
+                        if (!qemu_opts_parse(qemu_find_opts("boot-opts"),
+                                             optarg, 0)) {
+                            exit(1);
+                        }
                     }
                 }
                 break;
@@ -3623,6 +3625,9 @@ int main(int argc, char **argv, char **envp)
 		    exit(1);
 		}
                 opts = qemu_opts_parse(qemu_find_opts("option-rom"), optarg, 1);
+                if (!opts) {
+                    exit(1);
+                }
                 option_rom[nb_option_roms].name = qemu_opt_get(opts, "romfile");
                 option_rom[nb_option_roms].bootindex =
                     qemu_opt_get_number(opts, "bootindex", -1);
@@ -3780,14 +3785,14 @@ int main(int argc, char **argv, char **envp)
             case QEMU_OPTION_sandbox:
                 opts = qemu_opts_parse(qemu_find_opts("sandbox"), optarg, 1);
                 if (!opts) {
-                    exit(0);
+                    exit(1);
                 }
                 break;
             case QEMU_OPTION_add_fd:
 #ifndef _WIN32
                 opts = qemu_opts_parse(qemu_find_opts("add-fd"), optarg, 0);
                 if (!opts) {
-                    exit(0);
+                    exit(1);
                 }
 #else
                 error_report("File descriptor passing is disabled on this "
@@ -3797,6 +3802,9 @@ int main(int argc, char **argv, char **envp)
                 break;
             case QEMU_OPTION_object:
                 opts = qemu_opts_parse(qemu_find_opts("object"), optarg, 1);
+                if (!opts) {
+                    exit(1);
+                }
                 break;
             default:
                 os_parse_cmd_args(popt->index, optarg);
commit cfdd1628666f1342925f9c77cbb63b7d6d049dae
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:18 2013 +0100

    vl: Drop redundant "parse error" reports
    
    qemu_opts_parse() reports the error already, and in a much more useful
    way.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-6-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/vl.c b/vl.c
index a8dc73d..73122d8 100644
--- a/vl.c
+++ b/vl.c
@@ -3334,7 +3334,6 @@ int main(int argc, char **argv, char **envp)
                 }
                 opts = qemu_opts_parse(olist, optarg, 1);
                 if (!opts) {
-                    fprintf(stderr, "parse error: %s\n", optarg);
                     exit(1);
                 }
                 break;
@@ -3350,7 +3349,6 @@ int main(int argc, char **argv, char **envp)
                 }
                 opts = qemu_opts_parse(olist, optarg, 1);
                 if (!opts) {
-                    fprintf(stderr, "parse error: %s\n", optarg);
                     exit(1);
                 }
 
@@ -3521,7 +3519,6 @@ int main(int argc, char **argv, char **envp)
                 olist = qemu_find_opts("machine");
                 opts = qemu_opts_parse(olist, optarg, 1);
                 if (!opts) {
-                    fprintf(stderr, "parse error: %s\n", optarg);
                     exit(1);
                 }
                 optarg = qemu_opt_get(opts, "type");
@@ -3755,7 +3752,6 @@ int main(int argc, char **argv, char **envp)
                 }
                 opts = qemu_opts_parse(olist, optarg, 0);
                 if (!opts) {
-                    fprintf(stderr, "parse error: %s\n", optarg);
                     exit(1);
                 }
                 break;
commit 7216ae3d1a11e07192623ad04d450e98bf1f3d10
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:17 2013 +0100

    qemu-option: Disable two helpful messages that got broken recently
    
    commit 8be7e7e4 and commit ec7b2ccb messed up the ordering of error
    message and the helpful explanation that should follow it, like this:
    
        $ qemu-system-x86_64 --nodefaults -S --vnc :0 --chardev null,id=,
        Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.
        qemu-system-x86_64: -chardev null,id=,: Parameter 'id' expects an identifier
    
        $ qemu-system-x86_64 --nodefaults -S --vnc :0 --machine kvm_shadow_mem=dunno
        You may use k, M, G or T suffixes for kilobytes, megabytes, gigabytes and terabytes.
        qemu-system-x86_64: -machine kvm_shadow_mem=dunno: Parameter 'kvm_shadow_mem' expects a size
    
    Pity.  Disable them for now.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-5-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/util/qemu-option.c b/util/qemu-option.c
index c12e724..5a1d03c 100644
--- a/util/qemu-option.c
+++ b/util/qemu-option.c
@@ -231,8 +231,10 @@ static void parse_option_size(const char *name, const char *value,
             break;
         default:
             error_set(errp, QERR_INVALID_PARAMETER_VALUE, name, "a size");
+#if 0 /* conversion from qerror_report() to error_set() broke this: */
             error_printf_unless_qmp("You may use k, M, G or T suffixes for "
                     "kilobytes, megabytes, gigabytes and terabytes.\n");
+#endif
             return;
         }
     } else {
@@ -771,7 +773,9 @@ QemuOpts *qemu_opts_create(QemuOptsList *list, const char *id,
     if (id) {
         if (!id_wellformed(id)) {
             error_set(errp,QERR_INVALID_PARAMETER_VALUE, "id", "an identifier");
+#if 0 /* conversion from qerror_report() to error_set() broke this: */
             error_printf_unless_qmp("Identifiers consist of letters, digits, '-', '.', '_', starting with a letter.\n");
+#endif
             return NULL;
         }
         opts = qemu_opts_find(list, id);
commit 312fd5f29097890179793d8bbb59ab18afbe0ad4
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:16 2013 +0100

    error: Strip trailing '\n' from error string arguments (again)
    
    Commit 6daf194d and be62a2eb got rid of a bunch, but they keep coming
    back.  Tracked down with this Coccinelle semantic patch:
    
        @r@
    	expression err, eno, cls, fmt;
    	position p;
        @@
        (
    	error_report(fmt, ...)@p
        |
    	error_set(err, cls, fmt, ...)@p
        |
    	error_set_errno(err, eno, cls, fmt, ...)@p
        |
    	error_setg(err, fmt, ...)@p
        |
    	error_setg_errno(err, eno, fmt, ...)@p
        )
        @script:python@
    	fmt << r.fmt;
    	p << r.p;
        @@
        if "\\n" in str(fmt):
    	print "%s:%s:%s:%s" % (p[0].file, p[0].line, p[0].column, fmt)
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-4-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block/gluster.c b/block/gluster.c
index 0f2c32a..ccd684d 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -217,7 +217,7 @@ static struct glfs *qemu_gluster_init(GlusterConf *gconf, const char *filename)
     ret = glfs_init(glfs);
     if (ret) {
         error_report("Gluster connection failed for server=%s port=%d "
-             "volume=%s image=%s transport=%s\n", gconf->server, gconf->port,
+             "volume=%s image=%s transport=%s", gconf->server, gconf->port,
              gconf->volname, gconf->image, gconf->transport);
         goto out;
     }
diff --git a/hmp.c b/hmp.c
index 420d48b..2f47a8a 100644
--- a/hmp.c
+++ b/hmp.c
@@ -1365,7 +1365,7 @@ void hmp_chardev_add(Monitor *mon, const QDict *qdict)
 
     opts = qemu_opts_parse(qemu_find_opts("chardev"), args, 1);
     if (opts == NULL) {
-        error_setg(&err, "Parsing chardev args failed\n");
+        error_setg(&err, "Parsing chardev args failed");
     } else {
         qemu_chr_new_from_opts(opts, NULL, &err);
     }
diff --git a/hw/9pfs/virtio-9p-proxy.c b/hw/9pfs/virtio-9p-proxy.c
index d5ad208..54e9875 100644
--- a/hw/9pfs/virtio-9p-proxy.c
+++ b/hw/9pfs/virtio-9p-proxy.c
@@ -521,7 +521,7 @@ static int v9fs_request(V9fsProxy *proxy, int type,
         }
         break;
     default:
-        error_report("Invalid type %d\n", type);
+        error_report("Invalid type %d", type);
         retval = -EINVAL;
         break;
     }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 905dc4a..2f45c8f 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1132,7 +1132,7 @@ PCIINTxRoute pci_device_route_intx_to_irq(PCIDevice *dev, int pin)
     } while (dev);
 
     if (!bus->route_intx_to_irq) {
-        error_report("PCI: Bug - unimplemented PCI INTx routing (%s)\n",
+        error_report("PCI: Bug - unimplemented PCI INTx routing (%s)",
                      object_get_typename(OBJECT(bus->qbus.parent)));
         return (PCIINTxRoute) { PCI_INTX_DISABLED, -1 };
     }
diff --git a/hw/qdev.c b/hw/qdev.c
index 8258757..689cd54 100644
--- a/hw/qdev.c
+++ b/hw/qdev.c
@@ -114,11 +114,11 @@ DeviceState *qdev_create(BusState *bus, const char *name)
     dev = qdev_try_create(bus, name);
     if (!dev) {
         if (bus) {
-            error_report("Unknown device '%s' for bus '%s'\n", name,
+            error_report("Unknown device '%s' for bus '%s'", name,
                          object_get_typename(OBJECT(bus)));
             abort();
         } else {
-            error_report("Unknown device '%s' for default sysbus\n", name);
+            error_report("Unknown device '%s' for default sysbus", name);
             abort();
         }
     }
diff --git a/hw/qxl.c b/hw/qxl.c
index a125e29..2e1c5e2 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -2036,7 +2036,7 @@ static int qxl_init_common(PCIQXLDevice *qxl)
     qxl->ssd.qxl.base.sif = &qxl_interface.base;
     qxl->ssd.qxl.id = qxl->id;
     if (qemu_spice_add_interface(&qxl->ssd.qxl.base) != 0) {
-        error_report("qxl interface %d.%d not supported by spice-server\n",
+        error_report("qxl interface %d.%d not supported by spice-server",
                      SPICE_INTERFACE_QXL_MAJOR, SPICE_INTERFACE_QXL_MINOR);
         return -1;
     }
diff --git a/hw/vfio_pci.c b/hw/vfio_pci.c
index a934f13..ad9ae36 100644
--- a/hw/vfio_pci.c
+++ b/hw/vfio_pci.c
@@ -289,7 +289,7 @@ static void vfio_enable_intx_kvm(VFIODevice *vdev)
 
     /* Get an eventfd for resample/unmask */
     if (event_notifier_init(&vdev->intx.unmask, 0)) {
-        error_report("vfio: Error: event_notifier_init failed eoi\n");
+        error_report("vfio: Error: event_notifier_init failed eoi");
         goto fail;
     }
 
@@ -297,7 +297,7 @@ static void vfio_enable_intx_kvm(VFIODevice *vdev)
     irqfd.resamplefd = event_notifier_get_fd(&vdev->intx.unmask);
 
     if (kvm_vm_ioctl(kvm_state, KVM_IRQFD, &irqfd)) {
-        error_report("vfio: Error: Failed to setup resample irqfd: %m\n");
+        error_report("vfio: Error: Failed to setup resample irqfd: %m");
         goto fail_irqfd;
     }
 
@@ -316,7 +316,7 @@ static void vfio_enable_intx_kvm(VFIODevice *vdev)
     ret = ioctl(vdev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
     g_free(irq_set);
     if (ret) {
-        error_report("vfio: Error: Failed to setup INTx unmask fd: %m\n");
+        error_report("vfio: Error: Failed to setup INTx unmask fd: %m");
         goto fail_vfio;
     }
 
@@ -365,7 +365,7 @@ static void vfio_disable_intx_kvm(VFIODevice *vdev)
 
     /* Tell KVM to stop listening for an INTx irqfd */
     if (kvm_vm_ioctl(kvm_state, KVM_IRQFD, &irqfd)) {
-        error_report("vfio: Error: Failed to disable INTx irqfd: %m\n");
+        error_report("vfio: Error: Failed to disable INTx irqfd: %m");
     }
 
     /* We only need to close the eventfd for VFIO to cleanup the kernel side */
@@ -447,7 +447,7 @@ static int vfio_enable_intx(VFIODevice *vdev)
 
     ret = event_notifier_init(&vdev->intx.interrupt, 0);
     if (ret) {
-        error_report("vfio: Error: event_notifier_init failed\n");
+        error_report("vfio: Error: event_notifier_init failed");
         return ret;
     }
 
@@ -467,7 +467,7 @@ static int vfio_enable_intx(VFIODevice *vdev)
     ret = ioctl(vdev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
     g_free(irq_set);
     if (ret) {
-        error_report("vfio: Error: Failed to setup INTx fd: %m\n");
+        error_report("vfio: Error: Failed to setup INTx fd: %m");
         qemu_set_fd_handler(*pfd, NULL, NULL, vdev);
         event_notifier_cleanup(&vdev->intx.interrupt);
         return -errno;
@@ -526,7 +526,7 @@ static void vfio_msi_interrupt(void *opaque)
     } else if (vdev->interrupt == VFIO_INT_MSI) {
         msi_notify(&vdev->pdev, nr);
     } else {
-        error_report("vfio: MSI interrupt receieved, but not enabled?\n");
+        error_report("vfio: MSI interrupt receieved, but not enabled?");
     }
 }
 
@@ -580,7 +580,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
     msix_vector_use(pdev, nr);
 
     if (event_notifier_init(&vector->interrupt, 0)) {
-        error_report("vfio: Error: event_notifier_init failed\n");
+        error_report("vfio: Error: event_notifier_init failed");
     }
 
     /*
@@ -609,7 +609,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
         vdev->nr_vectors = nr + 1;
         ret = vfio_enable_vectors(vdev, true);
         if (ret) {
-            error_report("vfio: failed to enable vectors, %d\n", ret);
+            error_report("vfio: failed to enable vectors, %d", ret);
         }
     } else {
         int argsz;
@@ -632,7 +632,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
         ret = ioctl(vdev->fd, VFIO_DEVICE_SET_IRQS, irq_set);
         g_free(irq_set);
         if (ret) {
-            error_report("vfio: failed to modify vector, %d\n", ret);
+            error_report("vfio: failed to modify vector, %d", ret);
         }
     }
 
@@ -721,7 +721,7 @@ static void vfio_enable_msix(VFIODevice *vdev)
 
     if (msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,
                                   vfio_msix_vector_release, NULL)) {
-        error_report("vfio: msix_set_vector_notifiers failed\n");
+        error_report("vfio: msix_set_vector_notifiers failed");
     }
 
     DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__, vdev->host.domain,
@@ -746,7 +746,7 @@ retry:
         vector->use = true;
 
         if (event_notifier_init(&vector->interrupt, 0)) {
-            error_report("vfio: Error: event_notifier_init failed\n");
+            error_report("vfio: Error: event_notifier_init failed");
         }
 
         msg = msi_get_message(&vdev->pdev, i);
@@ -767,10 +767,10 @@ retry:
     ret = vfio_enable_vectors(vdev, false);
     if (ret) {
         if (ret < 0) {
-            error_report("vfio: Error: Failed to setup MSI fds: %m\n");
+            error_report("vfio: Error: Failed to setup MSI fds: %m");
         } else if (ret != vdev->nr_vectors) {
             error_report("vfio: Error: Failed to enable %d "
-                         "MSI vectors, retry with %d\n", vdev->nr_vectors, ret);
+                         "MSI vectors, retry with %d", vdev->nr_vectors, ret);
         }
 
         for (i = 0; i < vdev->nr_vectors; i++) {
@@ -891,7 +891,7 @@ static void vfio_bar_write(void *opaque, hwaddr addr,
     }
 
     if (pwrite(bar->fd, &buf, size, bar->fd_offset + addr) != size) {
-        error_report("%s(,0x%"HWADDR_PRIx", 0x%"PRIx64", %d) failed: %m\n",
+        error_report("%s(,0x%"HWADDR_PRIx", 0x%"PRIx64", %d) failed: %m",
                      __func__, addr, data, size);
     }
 
@@ -922,7 +922,7 @@ static uint64_t vfio_bar_read(void *opaque,
     uint64_t data = 0;
 
     if (pread(bar->fd, &buf, size, bar->fd_offset + addr) != size) {
-        error_report("%s(,0x%"HWADDR_PRIx", %d) failed: %m\n",
+        error_report("%s(,0x%"HWADDR_PRIx", %d) failed: %m",
                      __func__, addr, size);
         return (uint64_t)-1;
     }
@@ -979,7 +979,7 @@ static uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
         val = pci_default_read_config(pdev, addr, len);
     } else {
         if (pread(vdev->fd, &val, len, vdev->config_offset + addr) != len) {
-            error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x) failed: %m\n",
+            error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x) failed: %m",
                          __func__, vdev->host.domain, vdev->host.bus,
                          vdev->host.slot, vdev->host.function, addr, len);
             return -errno;
@@ -1021,7 +1021,7 @@ static void vfio_pci_write_config(PCIDevice *pdev, uint32_t addr,
 
     /* Write everything to VFIO, let it filter out what we can't write */
     if (pwrite(vdev->fd, &val_le, len, vdev->config_offset + addr) != len) {
-        error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x, 0x%x) failed: %m\n",
+        error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x, 0x%x) failed: %m",
                      __func__, vdev->host.domain, vdev->host.bus,
                      vdev->host.slot, vdev->host.function, addr, val, len);
     }
@@ -1138,7 +1138,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
 
     if (unlikely((section->offset_within_address_space & ~TARGET_PAGE_MASK) !=
                  (section->offset_within_region & ~TARGET_PAGE_MASK))) {
-        error_report("%s received unaligned region\n", __func__);
+        error_report("%s received unaligned region", __func__);
         return;
     }
 
@@ -1160,7 +1160,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
     ret = vfio_dma_map(container, iova, end - iova, vaddr, section->readonly);
     if (ret) {
         error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", "
-                     "0x%"HWADDR_PRIx", %p) = %d (%m)\n",
+                     "0x%"HWADDR_PRIx", %p) = %d (%m)",
                      container, iova, end - iova, vaddr, ret);
     }
 }
@@ -1182,7 +1182,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
 
     if (unlikely((section->offset_within_address_space & ~TARGET_PAGE_MASK) !=
                  (section->offset_within_region & ~TARGET_PAGE_MASK))) {
-        error_report("%s received unaligned region\n", __func__);
+        error_report("%s received unaligned region", __func__);
         return;
     }
 
@@ -1200,7 +1200,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
     ret = vfio_dma_unmap(container, iova, end - iova);
     if (ret) {
         error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                     "0x%"HWADDR_PRIx") = %d (%m)\n",
+                     "0x%"HWADDR_PRIx") = %d (%m)",
                      container, iova, end - iova, ret);
     }
 }
@@ -1257,7 +1257,7 @@ static int vfio_setup_msi(VFIODevice *vdev, int pos)
         if (ret == -ENOTSUP) {
             return 0;
         }
-        error_report("vfio: msi_init failed\n");
+        error_report("vfio: msi_init failed");
         return ret;
     }
     vdev->msi_cap_size = 0xa + (msi_maskbit ? 0xa : 0) + (msi_64bit ? 0x4 : 0);
@@ -1332,7 +1332,7 @@ static int vfio_setup_msix(VFIODevice *vdev, int pos)
         if (ret == -ENOTSUP) {
             return 0;
         }
-        error_report("vfio: msix_init failed\n");
+        error_report("vfio: msix_init failed");
         return ret;
     }
 
@@ -1448,7 +1448,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
     ret = pread(vdev->fd, &pci_bar, sizeof(pci_bar),
                 vdev->config_offset + PCI_BASE_ADDRESS_0 + (4 * nr));
     if (ret != sizeof(pci_bar)) {
-        error_report("vfio: Failed to read BAR %d (%m)\n", nr);
+        error_report("vfio: Failed to read BAR %d (%m)", nr);
         return;
     }
 
@@ -1471,7 +1471,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
     strncat(name, " mmap", sizeof(name) - strlen(name) - 1);
     if (vfio_mmap_bar(bar, &bar->mem,
                       &bar->mmap_mem, &bar->mmap, size, 0, name)) {
-        error_report("%s unsupported. Performance may be slow\n", name);
+        error_report("%s unsupported. Performance may be slow", name);
     }
 
     if (vdev->msix && vdev->msix->table_bar == nr) {
@@ -1485,7 +1485,7 @@ static void vfio_map_bar(VFIODevice *vdev, int nr)
         /* VFIOMSIXInfo contains another MemoryRegion for this mapping */
         if (vfio_mmap_bar(bar, &bar->mem, &vdev->msix->mmap_mem,
                           &vdev->msix->mmap, size, start, name)) {
-            error_report("%s unsupported. Performance may be slow\n", name);
+            error_report("%s unsupported. Performance may be slow", name);
         }
     }
 }
@@ -1572,7 +1572,7 @@ static int vfio_add_std_cap(VFIODevice *vdev, uint8_t pos)
 
     if (ret < 0) {
         error_report("vfio: %04x:%02x:%02x.%x Error adding PCI capability "
-                     "0x%x[0x%x]@0x%x: %d\n", vdev->host.domain,
+                     "0x%x[0x%x]@0x%x: %d", vdev->host.domain,
                      vdev->host.bus, vdev->host.slot, vdev->host.function,
                      cap_id, size, pos, ret);
         return ret;
@@ -1627,7 +1627,7 @@ static int vfio_load_rom(VFIODevice *vdev)
             if (errno == EINTR || errno == EAGAIN) {
                 continue;
             }
-            error_report("vfio: Error reading device ROM: %m\n");
+            error_report("vfio: Error reading device ROM: %m");
             memory_region_destroy(&vdev->pdev.rom);
             return -errno;
         }
@@ -1657,14 +1657,14 @@ static int vfio_connect_container(VFIOGroup *group)
 
     fd = qemu_open("/dev/vfio/vfio", O_RDWR);
     if (fd < 0) {
-        error_report("vfio: failed to open /dev/vfio/vfio: %m\n");
+        error_report("vfio: failed to open /dev/vfio/vfio: %m");
         return -errno;
     }
 
     ret = ioctl(fd, VFIO_GET_API_VERSION);
     if (ret != VFIO_API_VERSION) {
         error_report("vfio: supported vfio version: %d, "
-                     "reported version: %d\n", VFIO_API_VERSION, ret);
+                     "reported version: %d", VFIO_API_VERSION, ret);
         close(fd);
         return -EINVAL;
     }
@@ -1675,7 +1675,7 @@ static int vfio_connect_container(VFIOGroup *group)
     if (ioctl(fd, VFIO_CHECK_EXTENSION, VFIO_TYPE1_IOMMU)) {
         ret = ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &fd);
         if (ret) {
-            error_report("vfio: failed to set group container: %m\n");
+            error_report("vfio: failed to set group container: %m");
             g_free(container);
             close(fd);
             return -errno;
@@ -1683,7 +1683,7 @@ static int vfio_connect_container(VFIOGroup *group)
 
         ret = ioctl(fd, VFIO_SET_IOMMU, VFIO_TYPE1_IOMMU);
         if (ret) {
-            error_report("vfio: failed to set iommu for container: %m\n");
+            error_report("vfio: failed to set iommu for container: %m");
             g_free(container);
             close(fd);
             return -errno;
@@ -1694,7 +1694,7 @@ static int vfio_connect_container(VFIOGroup *group)
 
         memory_listener_register(&container->iommu_data.listener, &address_space_memory);
     } else {
-        error_report("vfio: No available IOMMU models\n");
+        error_report("vfio: No available IOMMU models");
         g_free(container);
         close(fd);
         return -EINVAL;
@@ -1714,7 +1714,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
     VFIOContainer *container = group->container;
 
     if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
-        error_report("vfio: error disconnecting group %d from container\n",
+        error_report("vfio: error disconnecting group %d from container",
                      group->groupid);
     }
 
@@ -1749,13 +1749,13 @@ static VFIOGroup *vfio_get_group(int groupid)
     snprintf(path, sizeof(path), "/dev/vfio/%d", groupid);
     group->fd = qemu_open(path, O_RDWR);
     if (group->fd < 0) {
-        error_report("vfio: error opening %s: %m\n", path);
+        error_report("vfio: error opening %s: %m", path);
         g_free(group);
         return NULL;
     }
 
     if (ioctl(group->fd, VFIO_GROUP_GET_STATUS, &status)) {
-        error_report("vfio: error getting group status: %m\n");
+        error_report("vfio: error getting group status: %m");
         close(group->fd);
         g_free(group);
         return NULL;
@@ -1764,7 +1764,7 @@ static VFIOGroup *vfio_get_group(int groupid)
     if (!(status.flags & VFIO_GROUP_FLAGS_VIABLE)) {
         error_report("vfio: error, group %d is not viable, please ensure "
                      "all devices within the iommu_group are bound to their "
-                     "vfio bus driver.\n", groupid);
+                     "vfio bus driver.", groupid);
         close(group->fd);
         g_free(group);
         return NULL;
@@ -1774,7 +1774,7 @@ static VFIOGroup *vfio_get_group(int groupid)
     QLIST_INIT(&group->device_list);
 
     if (vfio_connect_container(group)) {
-        error_report("vfio: failed to setup container for group %d\n", groupid);
+        error_report("vfio: failed to setup container for group %d", groupid);
         close(group->fd);
         g_free(group);
         return NULL;
@@ -1820,7 +1820,7 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
     /* Sanity check device */
     ret = ioctl(vdev->fd, VFIO_DEVICE_GET_INFO, &dev_info);
     if (ret) {
-        error_report("vfio: error getting device info: %m\n");
+        error_report("vfio: error getting device info: %m");
         goto error;
     }
 
@@ -1828,23 +1828,23 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
             dev_info.flags, dev_info.num_regions, dev_info.num_irqs);
 
     if (!(dev_info.flags & VFIO_DEVICE_FLAGS_PCI)) {
-        error_report("vfio: Um, this isn't a PCI device\n");
+        error_report("vfio: Um, this isn't a PCI device");
         goto error;
     }
 
     vdev->reset_works = !!(dev_info.flags & VFIO_DEVICE_FLAGS_RESET);
     if (!vdev->reset_works) {
-        error_report("Warning, device %s does not support reset\n", name);
+        error_report("Warning, device %s does not support reset", name);
     }
 
     if (dev_info.num_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
-        error_report("vfio: unexpected number of io regions %u\n",
+        error_report("vfio: unexpected number of io regions %u",
                      dev_info.num_regions);
         goto error;
     }
 
     if (dev_info.num_irqs < VFIO_PCI_MSIX_IRQ_INDEX + 1) {
-        error_report("vfio: unexpected number of irqs %u\n", dev_info.num_irqs);
+        error_report("vfio: unexpected number of irqs %u", dev_info.num_irqs);
         goto error;
     }
 
@@ -1853,7 +1853,7 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 
         ret = ioctl(vdev->fd, VFIO_DEVICE_GET_REGION_INFO, &reg_info);
         if (ret) {
-            error_report("vfio: Error getting region %d info: %m\n", i);
+            error_report("vfio: Error getting region %d info: %m", i);
             goto error;
         }
 
@@ -1873,7 +1873,7 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 
     ret = ioctl(vdev->fd, VFIO_DEVICE_GET_REGION_INFO, &reg_info);
     if (ret) {
-        error_report("vfio: Error getting ROM info: %m\n");
+        error_report("vfio: Error getting ROM info: %m");
         goto error;
     }
 
@@ -1889,7 +1889,7 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 
     ret = ioctl(vdev->fd, VFIO_DEVICE_GET_REGION_INFO, &reg_info);
     if (ret) {
-        error_report("vfio: Error getting config info: %m\n");
+        error_report("vfio: Error getting config info: %m");
         goto error;
     }
 
@@ -1941,7 +1941,7 @@ static int vfio_initfn(PCIDevice *pdev)
              vdev->host.domain, vdev->host.bus, vdev->host.slot,
              vdev->host.function);
     if (stat(path, &st) < 0) {
-        error_report("vfio: error: no such host device: %s\n", path);
+        error_report("vfio: error: no such host device: %s", path);
         return -errno;
     }
 
@@ -1949,7 +1949,7 @@ static int vfio_initfn(PCIDevice *pdev)
 
     len = readlink(path, iommu_group_path, PATH_MAX);
     if (len <= 0) {
-        error_report("vfio: error no iommu_group for device\n");
+        error_report("vfio: error no iommu_group for device");
         return -errno;
     }
 
@@ -1957,7 +1957,7 @@ static int vfio_initfn(PCIDevice *pdev)
     group_name = basename(iommu_group_path);
 
     if (sscanf(group_name, "%d", &groupid) != 1) {
-        error_report("vfio: error reading %s: %m\n", path);
+        error_report("vfio: error reading %s: %m", path);
         return -errno;
     }
 
@@ -1966,7 +1966,7 @@ static int vfio_initfn(PCIDevice *pdev)
 
     group = vfio_get_group(groupid);
     if (!group) {
-        error_report("vfio: failed to get group %d\n", groupid);
+        error_report("vfio: failed to get group %d", groupid);
         return -ENOENT;
     }
 
@@ -1980,7 +1980,7 @@ static int vfio_initfn(PCIDevice *pdev)
             pvdev->host.slot == vdev->host.slot &&
             pvdev->host.function == vdev->host.function) {
 
-            error_report("vfio: error: device %s is already attached\n", path);
+            error_report("vfio: error: device %s is already attached", path);
             vfio_put_group(group);
             return -EBUSY;
         }
@@ -1988,7 +1988,7 @@ static int vfio_initfn(PCIDevice *pdev)
 
     ret = vfio_get_device(group, path, vdev);
     if (ret) {
-        error_report("vfio: failed to get device %s\n", path);
+        error_report("vfio: failed to get device %s", path);
         vfio_put_group(group);
         return ret;
     }
@@ -1999,7 +1999,7 @@ static int vfio_initfn(PCIDevice *pdev)
                 vdev->config_offset);
     if (ret < (int)MIN(pci_config_size(&vdev->pdev), vdev->config_size)) {
         ret = ret < 0 ? -errno : -EFAULT;
-        error_report("vfio: Failed to read device config space\n");
+        error_report("vfio: Failed to read device config space");
         goto out_put;
     }
 
@@ -2086,7 +2086,7 @@ static void vfio_pci_reset(DeviceState *dev)
     if (vdev->reset_works) {
         if (ioctl(vdev->fd, VFIO_DEVICE_RESET)) {
             error_report("vfio: Error unable to reset physical device "
-                         "(%04x:%02x:%02x.%x): %m\n", vdev->host.domain,
+                         "(%04x:%02x:%02x.%x): %m", vdev->host.domain,
                          vdev->host.bus, vdev->host.slot, vdev->host.function);
         }
     }
diff --git a/hw/vhost_net.c b/hw/vhost_net.c
index 8693ac2..d1df0e2 100644
--- a/hw/vhost_net.c
+++ b/hw/vhost_net.c
@@ -214,7 +214,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
     int r, i = 0;
 
     if (!dev->binding->set_guest_notifiers) {
-        error_report("binding does not support guest notifiers\n");
+        error_report("binding does not support guest notifiers");
         r = -ENOSYS;
         goto err;
     }
@@ -231,7 +231,7 @@ int vhost_net_start(VirtIODevice *dev, NetClientState *ncs,
                                           total_queues * 2,
                                           true);
     if (r < 0) {
-        error_report("Error binding guest notifier: %d\n", -r);
+        error_report("Error binding guest notifier: %d", -r);
         goto err;
     }
 
diff --git a/migration.c b/migration.c
index 77c1971..c4589b1 100644
--- a/migration.c
+++ b/migration.c
@@ -85,7 +85,7 @@ void qemu_start_incoming_migration(const char *uri, Error **errp)
         fd_start_incoming_migration(p, errp);
 #endif
     else {
-        error_setg(errp, "unknown migration protocol: %s\n", uri);
+        error_setg(errp, "unknown migration protocol: %s", uri);
     }
 }
 
diff --git a/qemu-char.c b/qemu-char.c
index a3ba021..574d3d2 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -3021,12 +3021,12 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
     int i;
 
     if (qemu_opts_id(opts) == NULL) {
-        error_setg(errp, "chardev: no id specified\n");
+        error_setg(errp, "chardev: no id specified");
         goto err;
     }
 
     if (qemu_opt_get(opts, "backend") == NULL) {
-        error_setg(errp, "chardev: \"%s\" missing backend\n",
+        error_setg(errp, "chardev: \"%s\" missing backend",
                    qemu_opts_id(opts));
         goto err;
     }
@@ -3035,14 +3035,14 @@ CharDriverState *qemu_chr_new_from_opts(QemuOpts *opts,
             break;
     }
     if (i == ARRAY_SIZE(backend_table)) {
-        error_setg(errp, "chardev: backend \"%s\" not found\n",
+        error_setg(errp, "chardev: backend \"%s\" not found",
                    qemu_opt_get(opts, "backend"));
         goto err;
     }
 
     chr = backend_table[i].open(opts);
     if (!chr) {
-        error_setg(errp, "chardev: opening backend \"%s\" failed\n",
+        error_setg(errp, "chardev: opening backend \"%s\" failed",
                    qemu_opt_get(opts, "backend"));
         goto err;
     }
diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 5c108e1..aab35c7 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -1333,7 +1333,7 @@ static void cpu_x86_parse_featurestr(X86CPU *cpu, char *features, Error **errp)
 
                 numvalue = strtoul(val, &err, 0);
                 if (!*val || *err) {
-                    error_setg(errp, "bad numerical value %s\n", val);
+                    error_setg(errp, "bad numerical value %s", val);
                     goto out;
                 }
                 if (numvalue < 0x80000000) {
@@ -1355,7 +1355,7 @@ static void cpu_x86_parse_featurestr(X86CPU *cpu, char *features, Error **errp)
                 tsc_freq = strtosz_suffix_unit(val, &err,
                                                STRTOSZ_DEFSUFFIX_B, 1000);
                 if (tsc_freq < 0 || *err) {
-                    error_setg(errp, "bad numerical value %s\n", val);
+                    error_setg(errp, "bad numerical value %s", val);
                     goto out;
                 }
                 snprintf(num, sizeof(num), "%" PRId64, tsc_freq);
@@ -1364,12 +1364,12 @@ static void cpu_x86_parse_featurestr(X86CPU *cpu, char *features, Error **errp)
                 char *err;
                 numvalue = strtoul(val, &err, 0);
                 if (!*val || *err) {
-                    error_setg(errp, "bad numerical value %s\n", val);
+                    error_setg(errp, "bad numerical value %s", val);
                     goto out;
                 }
                 hyperv_set_spinlock_retries(numvalue);
             } else {
-                error_setg(errp, "unrecognized feature %s\n", featurestr);
+                error_setg(errp, "unrecognized feature %s", featurestr);
                 goto out;
             }
         } else if (!strcmp(featurestr, "check")) {
@@ -1382,7 +1382,7 @@ static void cpu_x86_parse_featurestr(X86CPU *cpu, char *features, Error **errp)
             hyperv_enable_vapic_recommended(true);
         } else {
             error_setg(errp, "feature string `%s' not in format (+feature|"
-                       "-feature|feature=xyz)\n", featurestr);
+                       "-feature|feature=xyz)", featurestr);
             goto out;
         }
         if (error_is_set(errp)) {
diff --git a/target-ppc/translate_init.c b/target-ppc/translate_init.c
index f038850..6cebaa1 100644
--- a/target-ppc/translate_init.c
+++ b/target-ppc/translate_init.c
@@ -9806,7 +9806,7 @@ static void create_ppc_opcodes(PowerPCCPU *cpu, Error **errp)
             ((opc->handler.type2 & def->insns_flags2) != 0)) {
             if (register_insn(env->opcodes, opc) < 0) {
                 error_setg(errp, "ERROR initializing PowerPC instruction "
-                           "0x%02x 0x%02x 0x%02x\n", opc->opc1, opc->opc2,
+                           "0x%02x 0x%02x 0x%02x", opc->opc1, opc->opc2,
                            opc->opc3);
                 return;
             }
diff --git a/ui/console.c b/ui/console.c
index d880ebf..0a68836 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -194,7 +194,7 @@ void qmp_screendump(const char *filename, Error **errp)
     if (consoles[0] && consoles[0]->hw_screen_dump) {
         consoles[0]->hw_screen_dump(consoles[0]->hw, filename, cswitch, errp);
     } else {
-        error_setg(errp, "device doesn't support screendump\n");
+        error_setg(errp, "device doesn't support screendump");
     }
 
     if (cswitch) {
diff --git a/ui/input.c b/ui/input.c
index 259fd18..9abef0c 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -269,7 +269,7 @@ void qmp_send_key(KeyValueList *keys, bool has_hold_time, int64_t hold_time,
         /* key down events */
         keycode = keycode_from_keyvalue(p->value);
         if (keycode < 0x01 || keycode > 0xff) {
-            error_setg(errp, "invalid hex keycode 0x%x\n", keycode);
+            error_setg(errp, "invalid hex keycode 0x%x", keycode);
             free_keycodes();
             return;
         }
diff --git a/util/qemu-config.c b/util/qemu-config.c
index 47c81f7..db6ec03 100644
--- a/util/qemu-config.c
+++ b/util/qemu-config.c
@@ -29,7 +29,7 @@ QemuOptsList *qemu_find_opts(const char *group)
 
     ret = find_list(vm_config_groups, group, &local_err);
     if (error_is_set(&local_err)) {
-        error_report("%s\n", error_get_pretty(local_err));
+        error_report("%s", error_get_pretty(local_err));
         error_free(local_err);
     }
 
@@ -153,7 +153,7 @@ int qemu_config_parse(FILE *fp, QemuOptsList **lists, const char *fname)
             /* group with id */
             list = find_list(lists, group, &local_err);
             if (error_is_set(&local_err)) {
-                error_report("%s\n", error_get_pretty(local_err));
+                error_report("%s", error_get_pretty(local_err));
                 error_free(local_err);
                 goto out;
             }
@@ -164,7 +164,7 @@ int qemu_config_parse(FILE *fp, QemuOptsList **lists, const char *fname)
             /* group without id */
             list = find_list(lists, group, &local_err);
             if (error_is_set(&local_err)) {
-                error_report("%s\n", error_get_pretty(local_err));
+                error_report("%s", error_get_pretty(local_err));
                 error_free(local_err);
                 goto out;
             }
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 3537bf3..1350ccc 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -720,7 +720,7 @@ int unix_connect_opts(QemuOpts *opts, Error **errp,
     int sock, rc;
 
     if (NULL == path) {
-        error_setg(errp, "unix connect: no path specified\n");
+        error_setg(errp, "unix connect: no path specified");
         return -1;
     }
 
@@ -854,7 +854,7 @@ SocketAddress *socket_parse(const char *str, Error **errp)
     addr = g_new(SocketAddress, 1);
     if (strstart(str, "unix:", NULL)) {
         if (str[5] == '\0') {
-            error_setg(errp, "invalid Unix socket address\n");
+            error_setg(errp, "invalid Unix socket address");
             goto fail;
         } else {
             addr->kind = SOCKET_ADDRESS_KIND_UNIX;
@@ -863,7 +863,7 @@ SocketAddress *socket_parse(const char *str, Error **errp)
         }
     } else if (strstart(str, "fd:", NULL)) {
         if (str[3] == '\0') {
-            error_setg(errp, "invalid file descriptor address\n");
+            error_setg(errp, "invalid file descriptor address");
             goto fail;
         } else {
             addr->kind = SOCKET_ADDRESS_KIND_FD;
commit 1a9522cc6ea04968e1169f0195952d0029d5dbb9
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:15 2013 +0100

    error: Clean up abuse of error_report() for help
    
    Use error_printf() instead, so the help gets presented more nicely.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-3-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/vfio_pci.c b/hw/vfio_pci.c
index 66537b7..a934f13 100644
--- a/hw/vfio_pci.c
+++ b/hw/vfio_pci.c
@@ -1806,9 +1806,9 @@ static int vfio_get_device(VFIOGroup *group, const char *name, VFIODevice *vdev)
 
     ret = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
     if (ret < 0) {
-        error_report("vfio: error getting device %s from group %d: %m\n",
+        error_report("vfio: error getting device %s from group %d: %m",
                      name, group->groupid);
-        error_report("Verify all devices in group %d are bound to vfio-pci "
+        error_printf("Verify all devices in group %d are bound to vfio-pci "
                      "or pci-stub and not already in use\n", group->groupid);
         return ret;
     }
commit 474c21349fdde3c477357c2317ca6ad50872827b
Author: Markus Armbruster <armbru at redhat.com>
Date:   Fri Feb 8 21:22:14 2013 +0100

    error: Clean up error strings with embedded newlines
    
    The arguments of error_report() should yield a short error string
    without newlines.
    
    A few places try to print additional help after the error message by
    embedding newlines in the error string.  That's nice, but let's do it
    the right way.
    
    Since I'm touching these lines anyway, drop a stray preposition and
    some tabs.  We don't use tabs for similar messages elsewhere.
    
    Signed-off-by: Markus Armbruster <armbru at redhat.com>
    Message-id: 1360354939-10994-2-git-send-email-armbru at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/kvm/pci-assign.c b/hw/kvm/pci-assign.c
index 896cfe8..da64b5b 100644
--- a/hw/kvm/pci-assign.c
+++ b/hw/kvm/pci-assign.c
@@ -936,8 +936,8 @@ retry:
             /* Retry with host-side MSI. There might be an IRQ conflict and
              * either the kernel or the device doesn't support sharing. */
             error_report("Host-side INTx sharing not supported, "
-                         "using MSI instead.\n"
-                         "Some devices do not to work properly in this mode.");
+                         "using MSI instead");
+            error_printf("Some devices do not work properly in this mode.\n");
             dev->features |= ASSIGNED_DEVICE_PREFER_MSI_MASK;
             goto retry;
         }
@@ -1903,10 +1903,10 @@ static void assigned_dev_load_option_rom(AssignedDevice *dev)
     memset(ptr, 0xff, st.st_size);
 
     if (!fread(ptr, 1, st.st_size, fp)) {
-        error_report("pci-assign: Cannot read from host %s\n"
-                     "\tDevice option ROM contents are probably invalid "
-                     "(check dmesg).\n\tSkip option ROM probe with rombar=0, "
-                     "or load from file with romfile=", rom_file);
+        error_report("pci-assign: Cannot read from host %s", rom_file);
+        error_printf("Device option ROM contents are probably invalid "
+                     "(check dmesg).\nSkip option ROM probe with rombar=0, "
+                     "or load from file with romfile=\n");
         memory_region_destroy(&dev->dev.rom);
         goto close_rom;
     }
commit 2da2e52dce73c5e3a916bcc8e86451ed64f557d8
Merge: 1044255 0184543
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Feb 11 08:10:39 2013 -0600

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Peter Maydell
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      tests/test-string-input-visitor: Handle errors provoked by fuzz test

commit 0184543814354d37eab75132712c3874d71dd776
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Feb 5 20:44:23 2013 +0000

    tests/test-string-input-visitor: Handle errors provoked by fuzz test
    
    It's OK and expected for visitors to return errors when presented with
    the fuzz test's random data. Since the fuzzer doesn't care about
    errors, we pass in NULL rather than an Error**. This fixes a bug in
    the fuzzer where it was passing the same Error** into each visitor,
    with the effect that once one visitor returned an error, each later
    visitor would notice that it had been passed in an Error** representing
    an already set error, and do nothing.
    
    For the case of visit_type_str() we also need to handle the case where
    an error means that the visitor doesn't set our char*. We initialize
    the pointer to NULL so we can safely g_free() it regardless of whether
    the visitor allocated a string for us or not.
    
    This fixes a problem where this test failed the MacOSX malloc()
    consistency checks and might segfault on other platforms [due
    to calling free() on an uninitialized pointer variable when
    visit_type_str() failed.].
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/tests/test-string-input-visitor.c b/tests/test-string-input-visitor.c
index f6b0093..5989f81 100644
--- a/tests/test-string-input-visitor.c
+++ b/tests/test-string-input-visitor.c
@@ -174,7 +174,6 @@ static void test_visitor_in_fuzz(TestInputVisitorData *data,
     double nres;
     char *sres;
     EnumOne eres;
-    Error *errp = NULL;
     Visitor *v;
     unsigned int i;
     char buf[10000];
@@ -193,21 +192,22 @@ static void test_visitor_in_fuzz(TestInputVisitorData *data,
         }
 
         v = visitor_input_test_init(data, buf);
-        visit_type_int(v, &ires, NULL, &errp);
+        visit_type_int(v, &ires, NULL, NULL);
 
         v = visitor_input_test_init(data, buf);
-        visit_type_bool(v, &bres, NULL, &errp);
+        visit_type_bool(v, &bres, NULL, NULL);
         visitor_input_teardown(data, NULL);
 
         v = visitor_input_test_init(data, buf);
-        visit_type_number(v, &nres, NULL, &errp);
+        visit_type_number(v, &nres, NULL, NULL);
 
         v = visitor_input_test_init(data, buf);
-        visit_type_str(v, &sres, NULL, &errp);
+        sres = NULL;
+        visit_type_str(v, &sres, NULL, NULL);
         g_free(sres);
 
         v = visitor_input_test_init(data, buf);
-        visit_type_EnumOne(v, &eres, NULL, &errp);
+        visit_type_EnumOne(v, &eres, NULL, NULL);
         visitor_input_teardown(data, NULL);
     }
 }


More information about the Spice-commits mailing list