[Spice-commits] 108 commits - .gitmodules Makefile Makefile.target block.c block/blkdebug.c block/blkverify.c block/curl.c block/gluster.c block/iscsi.c block/mirror.c block/nbd.c block/qcow.c block/qcow2.c block/raw-posix.c block/raw-win32.c block/rbd.c block/sheepdog.c block/ssh.c block/vvfat.c configure cpus.c default-configs/lm32-softmmu.mak default-configs/pci.mak docs/specs dtc hw/Makefile.objs hw/arm hw/audio hw/block hw/core hw/display hw/dma hw/gpio hw/lm32 hw/microblaze hw/misc hw/net hw/pci-host hw/ppc hw/s390x hw/scsi hw/sparc hw/tpm hw/virtio include/block include/exec include/hw include/qemu include/sysemu kvm-all.c kvm-stub.c linux-user/elfload.c linux-user/syscall.c os-posix.c qemu-char.c qemu-img.c qemu-options.hx qtest.c scripts/kvm target-arm/cpu-qom.h target-arm/cpu.c target-arm/cpu.h target-arm/machine.c target-arm/translate.c target-i386/cpu.h target-i386/kvm.c target-i386/machine.c target-i386/translate.c tests/qemu-iotests trace-events translate-all.c ui/coco a.m ui/input.c vl.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Tue Apr 23 00:16:26 PDT 2013


 .gitmodules                      |    3 
 Makefile                         |   10 
 Makefile.target                  |   10 
 block.c                          |   67 +-
 block/blkdebug.c                 |  113 ++-
 block/blkverify.c                |  113 ++-
 block/curl.c                     |  152 +++-
 block/gluster.c                  |   34 +
 block/iscsi.c                    |   40 +
 block/mirror.c                   |    2 
 block/nbd.c                      |   28 
 block/qcow.c                     |   17 
 block/qcow2.c                    |   17 
 block/raw-posix.c                |   70 +-
 block/raw-win32.c                |   59 +
 block/rbd.c                      |   32 -
 block/sheepdog.c                 |   33 -
 block/ssh.c                      |   13 
 block/vvfat.c                    |  229 +++++--
 configure                        |  185 +++--
 cpus.c                           |    4 
 default-configs/lm32-softmmu.mak |    1 
 default-configs/pci.mak          |    2 
 docs/specs/pci-testdev.txt       |   26 
 docs/specs/vmw_pvscsi-spec.txt   |   92 ++
 dtc                              |    1 
 hw/Makefile.objs                 |    2 
 hw/arm/armv7m.c                  |   12 
 hw/arm/boot.c                    |    4 
 hw/arm/musicpal.c                |    8 
 hw/arm/nseries.c                 |    4 
 hw/arm/omap1.c                   |   12 
 hw/arm/realview.c                |   22 
 hw/arm/versatilepb.c             |   11 
 hw/audio/marvell_88w8618.c       |    3 
 hw/block/fdc.c                   |    1 
 hw/block/m25p80.c                |    1 
 hw/core/Makefile.objs            |    1 
 hw/core/qdev-addr.c              |   78 --
 hw/display/Makefile.objs         |    5 
 hw/display/pxa2xx_lcd.c          |    2 
 hw/display/sm501.c               |    3 
 hw/display/tcx.c                 |    1 
 hw/dma/pxa2xx_dma.c              |    2 
 hw/dma/xilinx_axidma.c           |    5 
 hw/gpio/zaurus.c                 |    2 
 hw/lm32/milkymist-hw.h           |    1 
 hw/microblaze/boot.c             |    2 
 hw/misc/Makefile.objs            |    1 
 hw/misc/macio/mac_dbdma.c        |    8 
 hw/misc/milkymist-pfpu.c         |    4 
 hw/misc/pci-testdev.c            |  325 ++++++++++
 hw/net/mcf_fec.c                 |    4 
 hw/net/milkymist-minimac2.c      |    1 
 hw/pci-host/versatile.c          |  399 +++++++++++-
 hw/ppc/ppc405_boards.c           |    2 
 hw/ppc/virtex_ml507.c            |    2 
 hw/s390x/s390-virtio-bus.c       |   51 +
 hw/s390x/s390-virtio-bus.h       |   16 
 hw/s390x/virtio-ccw.c            |   53 +
 hw/s390x/virtio-ccw.h            |   14 
 hw/scsi/Makefile.objs            |    7 
 hw/scsi/scsi-disk.c              |   19 
 hw/scsi/vhost-scsi.c             |  288 +++++++++
 hw/scsi/virtio-scsi.c            |  212 ++----
 hw/scsi/vmw_pvscsi.c             | 1216 +++++++++++++++++++++++++++++++++++++++
 hw/scsi/vmw_pvscsi.h             |  434 +++++++++++++
 hw/sparc/sun4m.c                 |    1 
 hw/tpm/tpm_passthrough.c         |   74 --
 hw/virtio/Makefile.objs          |    8 
 hw/virtio/vhost.c                |   53 +
 hw/virtio/virtio-balloon.c       |    2 
 hw/virtio/virtio-pci.c           |   65 ++
 hw/virtio/virtio-pci.h           |   18 
 include/block/block.h            |    2 
 include/block/block_int.h        |    3 
 include/exec/cpu-defs.h          |   14 
 include/exec/user/abitypes.h     |   46 +
 include/hw/pci/pci.h             |    2 
 include/hw/qdev-addr.h           |   10 
 include/hw/virtio/vhost-scsi.h   |   73 ++
 include/hw/virtio/vhost.h        |    3 
 include/hw/virtio/virtio-scsi.h  |  135 ++++
 include/hw/virtio/virtio.h       |    2 
 include/hw/xen/xen.h             |    2 
 include/qemu/bswap.h             |    1 
 include/qemu/osdep.h             |    4 
 include/sysemu/kvm.h             |    4 
 include/sysemu/os-posix.h        |    1 
 include/sysemu/os-win32.h        |    5 
 kvm-all.c                        |  133 ++--
 kvm-stub.c                       |   10 
 linux-user/elfload.c             |  175 ++---
 linux-user/syscall.c             |   12 
 os-posix.c                       |   12 
 qemu-char.c                      |  134 ++--
 qemu-img.c                       |    8 
 qemu-options.hx                  |   13 
 qtest.c                          |    6 
 scripts/kvm/vmxcap               |   26 
 target-arm/cpu-qom.h             |    4 
 target-arm/cpu.c                 |    1 
 target-arm/cpu.h                 |    2 
 target-arm/machine.c             |  430 ++++++-------
 target-arm/translate.c           |    1 
 target-i386/cpu.h                |    1 
 target-i386/kvm.c                |   13 
 target-i386/machine.c            |   21 
 target-i386/translate.c          |    1 
 tests/qemu-iotests/051           |    7 
 tests/qemu-iotests/051.out       |   10 
 tests/qemu-iotests/053           |   73 ++
 tests/qemu-iotests/053.out       |   17 
 tests/qemu-iotests/common.filter |    2 
 tests/qemu-iotests/group         |    1 
 trace-events                     |   35 +
 translate-all.c                  |    1 
 ui/cocoa.m                       |    8 
 ui/input.c                       |    8 
 vl.c                             |   34 +
 120 files changed, 5070 insertions(+), 1248 deletions(-)

New commits:
commit 456736710df19c2275192269fe67a3f0b2583835
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Mon Apr 22 17:48:40 2013 +0200

    block: Fix build with tracing enabled
    
    filename was still uninitialised when it's used as a parameter to a
    tracing function, so let's move the initialisation. Also, commit c2ad1b0c
    forgot to add a NULL check, which this patch adds while we're at it.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Tested-by: Andreas Färber <afaerber at suse.de>
    Message-id: 1366645720-11384-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/block.c b/block.c
index 819eb4e..aa9a533 100644
--- a/block.c
+++ b/block.c
@@ -676,7 +676,13 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
     assert(bs->file == NULL);
     assert(options != NULL && bs->options != options);
 
-    trace_bdrv_open_common(bs, filename, flags, drv->format_name);
+    if (file != NULL) {
+        filename = file->filename;
+    } else {
+        filename = qdict_get_try_str(options, "filename");
+    }
+
+    trace_bdrv_open_common(bs, filename ?: "", flags, drv->format_name);
 
     if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv)) {
         return -ENOTSUP;
@@ -698,12 +704,6 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
         bdrv_enable_copy_on_read(bs);
     }
 
-    if (file != NULL) {
-        filename = file->filename;
-    } else {
-        filename = qdict_get_try_str(options, "filename");
-    }
-
     if (filename != NULL) {
         pstrcpy(bs->filename, sizeof(bs->filename), filename);
     } else {
commit 8e36d6ca34243fdc9f48f4bdbe5fca2b19162bfa
Author: Stefan Berger <stefanb at linux.vnet.ibm.com>
Date:   Tue Apr 16 17:08:36 2013 -0400

    tpm: Simplify creation of cancel path
    
    Simplify the creation of the cancel path given the TPM's device path.
    Given the path /dev/tpm0 build the path /sys/class/misc/tpm0/device/cancel.
    
    Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1366146516-23814-1-git-send-email-stefanb at linux.vnet.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/hw/tpm/tpm_passthrough.c b/hw/tpm/tpm_passthrough.c
index 416b9b6..ce74e97 100644
--- a/hw/tpm/tpm_passthrough.c
+++ b/hw/tpm/tpm_passthrough.c
@@ -352,45 +352,17 @@ static int tpm_passthrough_test_tpmdev(int fd)
 }
 
 /*
- * Check whether the given base path, e.g.,  /sys/class/misc/tpm0/device,
- * is the sysfs directory of a TPM. A TPM sysfs directory should be uniquely
- * recognizable by the file entries 'pcrs' and 'cancel'.
- * Upon success 'true' is returned and the basebath buffer has '/cancel'
- * appended.
- */
-static bool tpm_passthrough_check_sysfs_cancel(char *basepath, size_t bufsz)
-{
-    char path[PATH_MAX];
-    struct stat statbuf;
-
-    snprintf(path, sizeof(path), "%s/pcrs", basepath);
-    if (stat(path, &statbuf) == -1 || !S_ISREG(statbuf.st_mode)) {
-        return false;
-    }
-
-    snprintf(path, sizeof(path), "%s/cancel", basepath);
-    if (stat(path, &statbuf) == -1 || !S_ISREG(statbuf.st_mode)) {
-        return false;
-    }
-
-    strncpy(basepath, path, bufsz);
-
-    return true;
-}
-
-/*
  * Unless path or file descriptor set has been provided by user,
  * determine the sysfs cancel file following kernel documentation
  * in Documentation/ABI/stable/sysfs-class-tpm.
+ * From /dev/tpm0 create /sys/class/misc/tpm0/device/cancel
  */
 static int tpm_passthrough_open_sysfs_cancel(TPMBackend *tb)
 {
+    TPMPassthruState *tpm_pt = TPM_PASSTHROUGH(tb);
     int fd = -1;
-    unsigned int idx;
-    DIR *pnp_dir;
+    char *dev;
     char path[PATH_MAX];
-    struct dirent entry, *result;
-    int len;
 
     if (tb->cancel_path) {
         fd = qemu_open(tb->cancel_path, O_WRONLY);
@@ -401,34 +373,22 @@ static int tpm_passthrough_open_sysfs_cancel(TPMBackend *tb)
         return fd;
     }
 
-    snprintf(path, sizeof(path), "/sys/class/misc");
-    pnp_dir = opendir(path);
-    if (pnp_dir != NULL) {
-        while (readdir_r(pnp_dir, &entry, &result) == 0 &&
-               result != NULL) {
-            /*
-             * only allow /sys/class/misc/tpm%u type of paths
-             */
-            if (sscanf(entry.d_name, "tpm%u%n", &idx, &len) < 1 ||
-                len <= strlen("tpm") ||
-                len != strlen(entry.d_name)) {
-                continue;
-            }
-
-            snprintf(path, sizeof(path), "/sys/class/misc/%s/device",
-                     entry.d_name);
-            if (!tpm_passthrough_check_sysfs_cancel(path, sizeof(path))) {
-                continue;
-            }
-
+    dev = strrchr(tpm_pt->tpm_dev, '/');
+    if (dev) {
+        dev++;
+        if (snprintf(path, sizeof(path), "/sys/class/misc/%s/device/cancel",
+                     dev) < sizeof(path)) {
             fd = qemu_open(path, O_WRONLY);
-            break;
+            if (fd >= 0) {
+                tb->cancel_path = g_strdup(path);
+            } else {
+                error_report("tpm_passthrough: Could not open TPM cancel "
+                             "path %s : %s", path, strerror(errno));
+            }
         }
-        closedir(pnp_dir);
-    }
-
-    if (fd >= 0) {
-        tb->cancel_path = g_strdup(path);
+    } else {
+       error_report("tpm_passthrough: Bad TPM device path %s",
+                    tpm_pt->tpm_dev);
     }
 
     return fd;
commit 56863d4f19c854acc5ebf5f5c1b590eb8164851a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Sun Apr 21 14:30:03 2013 +0100

    qtest: Handle addresses and values for {in, out}[bwl] as unsigned
    
    Handle the addresses and values for {in,out}[bwl] as unsigned (ie
    with strtoul), as per the protocol specification comment. This fixes
    a test failure in test_i440fx_defaults on 32-bit hosts where the test
    tries to write 0x80000000 and qtest was instead writing 0x7fffffff.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Message-id: 1366551003-16649-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qtest.c b/qtest.c
index 3bba3e5..07a9612 100644
--- a/qtest.c
+++ b/qtest.c
@@ -271,8 +271,8 @@ static void qtest_process_command(CharDriverState *chr, gchar **words)
         uint32_t value;
 
         g_assert(words[1] && words[2]);
-        addr = strtol(words[1], NULL, 0);
-        value = strtol(words[2], NULL, 0);
+        addr = strtoul(words[1], NULL, 0);
+        value = strtoul(words[2], NULL, 0);
 
         if (words[0][3] == 'b') {
             cpu_outb(addr, value);
@@ -290,7 +290,7 @@ static void qtest_process_command(CharDriverState *chr, gchar **words)
         uint32_t value = -1U;
 
         g_assert(words[1]);
-        addr = strtol(words[1], NULL, 0);
+        addr = strtoul(words[1], NULL, 0);
 
         if (words[0][2] == 'b') {
             value = cpu_inb(addr);
commit 888a6bc63c94ef34026399117ebf6a1fa0e7a29a
Author: Satoru Moriya <satoru.moriya at hds.com>
Date:   Fri Apr 19 16:42:06 2013 +0200

    Add option to mlock qemu and guest memory
    
    In certain scenario, latency induced by paging is significant and
    memory locking is needed. Also, in the scenario with untrusted
    guests, latency improvement due to mlock is desired.
    
    This patch introduces a following new option to mlock guest and
    qemu memory:
    
    -realtime mlock=on|off
    
    Signed-off-by: Satoru Moriya <satoru.moriya at hds.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1366382526-26146-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
index 7f198e4..25d0b2a 100644
--- a/include/sysemu/os-posix.h
+++ b/include/sysemu/os-posix.h
@@ -31,6 +31,7 @@ void os_set_proc_name(const char *s);
 void os_setup_signal_handling(void);
 void os_daemonize(void);
 void os_setup_post(void);
+int os_mlock(void);
 
 typedef struct timeval qemu_timeval;
 #define qemu_gettimeofday(tp) gettimeofday(tp, NULL)
diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
index 71f5fa0..bf8523a 100644
--- a/include/sysemu/os-win32.h
+++ b/include/sysemu/os-win32.h
@@ -106,4 +106,9 @@ static inline bool is_daemonized(void)
     return false;
 }
 
+static inline int os_mlock(void)
+{
+    return -ENOSYS;
+}
+
 #endif
diff --git a/os-posix.c b/os-posix.c
index 5c64518..d39261d 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -363,3 +363,15 @@ bool is_daemonized(void)
 {
     return daemonize;
 }
+
+int os_mlock(void)
+{
+    int ret = 0;
+
+    ret = mlockall(MCL_CURRENT | MCL_FUTURE);
+    if (ret < 0) {
+        perror("mlockall");
+    }
+
+    return ret;
+}
diff --git a/qemu-options.hx b/qemu-options.hx
index 5c115d1..e86cc24 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2583,6 +2583,19 @@ STEXI
 Do not start CPU at startup (you must type 'c' in the monitor).
 ETEXI
 
+DEF("realtime", HAS_ARG, QEMU_OPTION_realtime,
+    "-realtime [mlock=on|off]\n"
+    "                run qemu with realtime features\n"
+    "                mlock=on|off controls mlock support (default: on)\n",
+    QEMU_ARCH_ALL)
+STEXI
+ at item -realtime mlock=on|off
+ at findex -realtime
+Run qemu with realtime features.
+mlocking qemu and guest memory can be enabled via @option{mlock=on}
+(enabled by default).
+ETEXI
+
 DEF("gdb", HAS_ARG, QEMU_OPTION_gdb, \
     "-gdb dev        wait for gdb connection on 'dev'\n", QEMU_ARCH_ALL)
 STEXI
diff --git a/vl.c b/vl.c
index 2ef00d8..6caa5f4 100644
--- a/vl.c
+++ b/vl.c
@@ -521,6 +521,18 @@ static QemuOptsList qemu_tpmdev_opts = {
     },
 };
 
+static QemuOptsList qemu_realtime_opts = {
+    .name = "realtime",
+    .head = QTAILQ_HEAD_INITIALIZER(qemu_realtime_opts.head),
+    .desc = {
+        {
+            .name = "mlock",
+            .type = QEMU_OPT_BOOL,
+        },
+        { /* end of list */ }
+    },
+};
+
 const char *qemu_get_vm_name(void)
 {
     return qemu_name;
@@ -1420,6 +1432,20 @@ static void smp_parse(const char *optarg)
         max_cpus = smp_cpus;
 }
 
+static void configure_realtime(QemuOpts *opts)
+{
+    bool enable_mlock;
+
+    enable_mlock = qemu_opt_get_bool(opts, "mlock", true);
+
+    if (enable_mlock) {
+        if (os_mlock() < 0) {
+            fprintf(stderr, "qemu: locking memory failed\n");
+            exit(1);
+        }
+    }
+}
+
 /***********************************************************/
 /* USB devices */
 
@@ -2862,6 +2888,7 @@ int main(int argc, char **argv, char **envp)
     qemu_add_opts(&qemu_add_fd_opts);
     qemu_add_opts(&qemu_object_opts);
     qemu_add_opts(&qemu_tpmdev_opts);
+    qemu_add_opts(&qemu_realtime_opts);
 
     runstate_init();
 
@@ -3835,6 +3862,13 @@ int main(int argc, char **argv, char **envp)
                     exit(1);
                 }
                 break;
+            case QEMU_OPTION_realtime:
+                opts = qemu_opts_parse(qemu_find_opts("realtime"), optarg, 0);
+                if (!opts) {
+                    exit(1);
+                }
+                configure_realtime(opts);
+                break;
             default:
                 os_parse_cmd_args(popt->index, optarg);
             }
commit 2b316774f60291f57ca9ecb6a9f0712c532cae34
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 17:32:09 2013 +0200

    qemu-char: do not operate on sources from finalize callbacks
    
    Due to a glib bug, the finalize callback is called with the GMainContext
    lock held.  Thus, any operation on the context from the callback will
    cause recursive locking and a deadlock.  This happens, for example,
    when a client disconnects from a socket chardev.
    
    The fix for this is somewhat ugly, because we need to forego polymorphism
    and implement our own function to destroy IOWatchPoll sources.  The
    right thing to do here would be child sources, but we support older
    glib versions that do not have them.  Not coincidentially, glib developers
    found and fixed the deadlock as part of implementing child sources.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Tested-by: Sander Eikelenboom <linux at eikelenboom.it>
    Message-id: 1366385529-10329-5-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index 6e897da..f29f9b1 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -643,12 +643,18 @@ static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
 
 static void io_watch_poll_finalize(GSource *source)
 {
+    /* Due to a glib bug, removing the last reference to a source
+     * inside a finalize callback causes recursive locking (and a
+     * deadlock).  This is not a problem inside other callbacks,
+     * including dispatch callbacks, so we call io_remove_watch_poll
+     * to remove this source.  At this point, iwp->src must
+     * be NULL, or we would leak it.
+     *
+     * This would be solved much more elegantly by child sources,
+     * but we support older glib versions that do not have them.
+     */
     IOWatchPoll *iwp = io_watch_poll_from_source(source);
-    if (iwp->src) {
-        g_source_destroy(iwp->src);
-        g_source_unref(iwp->src);
-        iwp->src = NULL;
-    }
+    assert(iwp->src == NULL);
 }
 
 static GSourceFuncs io_watch_poll_funcs = {
@@ -679,6 +685,25 @@ static guint io_add_watch_poll(GIOChannel *channel,
     return tag;
 }
 
+static void io_remove_watch_poll(guint tag)
+{
+    GSource *source;
+    IOWatchPoll *iwp;
+
+    g_return_if_fail (tag > 0);
+
+    source = g_main_context_find_source_by_id(NULL, tag);
+    g_return_if_fail (source != NULL);
+
+    iwp = io_watch_poll_from_source(source);
+    if (iwp->src) {
+        g_source_destroy(iwp->src);
+        g_source_unref(iwp->src);
+        iwp->src = NULL;
+    }
+    g_source_destroy(&iwp->parent);
+}
+
 #ifndef _WIN32
 static GIOChannel *io_channel_from_fd(int fd)
 {
@@ -788,7 +813,7 @@ static gboolean fd_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
                                      len, &bytes_read, NULL);
     if (status == G_IO_STATUS_EOF) {
         if (s->fd_in_tag) {
-            g_source_remove(s->fd_in_tag);
+            io_remove_watch_poll(s->fd_in_tag);
             s->fd_in_tag = 0;
         }
         qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
@@ -821,7 +846,7 @@ static void fd_chr_update_read_handler(CharDriverState *chr)
     FDCharDriver *s = chr->opaque;
 
     if (s->fd_in_tag) {
-        g_source_remove(s->fd_in_tag);
+        io_remove_watch_poll(s->fd_in_tag);
         s->fd_in_tag = 0;
     }
 
@@ -835,7 +860,7 @@ static void fd_chr_close(struct CharDriverState *chr)
     FDCharDriver *s = chr->opaque;
 
     if (s->fd_in_tag) {
-        g_source_remove(s->fd_in_tag);
+        io_remove_watch_poll(s->fd_in_tag);
         s->fd_in_tag = 0;
     }
 
@@ -1145,7 +1170,7 @@ static void pty_chr_state(CharDriverState *chr, int connected)
 
     if (!connected) {
         if (s->fd_tag) {
-            g_source_remove(s->fd_tag);
+            io_remove_watch_poll(s->fd_tag);
             s->fd_tag = 0;
         }
         s->connected = 0;
@@ -1173,7 +1198,7 @@ static void pty_chr_close(struct CharDriverState *chr)
     int fd;
 
     if (s->fd_tag) {
-        g_source_remove(s->fd_tag);
+        io_remove_watch_poll(s->fd_tag);
         s->fd_tag = 0;
     }
     fd = g_io_channel_unix_get_fd(s->fd);
@@ -2252,7 +2277,7 @@ static gboolean udp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
     s->bufptr = s->bufcnt;
     if (status != G_IO_STATUS_NORMAL) {
         if (s->tag) {
-            g_source_remove(s->tag);
+            io_remove_watch_poll(s->tag);
             s->tag = 0;
         }
         return FALSE;
@@ -2273,7 +2298,7 @@ static void udp_chr_update_read_handler(CharDriverState *chr)
     NetCharDriver *s = chr->opaque;
 
     if (s->tag) {
-        g_source_remove(s->tag);
+        io_remove_watch_poll(s->tag);
         s->tag = 0;
     }
 
@@ -2286,7 +2311,7 @@ static void udp_chr_close(CharDriverState *chr)
 {
     NetCharDriver *s = chr->opaque;
     if (s->tag) {
-        g_source_remove(s->tag);
+        io_remove_watch_poll(s->tag);
         s->tag = 0;
     }
     if (s->chan) {
@@ -2520,7 +2545,7 @@ static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
             s->listen_tag = g_io_add_watch(s->listen_chan, G_IO_IN, tcp_chr_accept, chr);
         }
         if (s->tag) {
-            g_source_remove(s->tag);
+            io_remove_watch_poll(s->tag);
             s->tag = 0;
         }
         g_io_channel_unref(s->chan);
@@ -2635,7 +2660,7 @@ static void tcp_chr_close(CharDriverState *chr)
     TCPCharDriver *s = chr->opaque;
     if (s->fd >= 0) {
         if (s->tag) {
-            g_source_remove(s->tag);
+            io_remove_watch_poll(s->tag);
             s->tag = 0;
         }
         if (s->chan) {
commit cdbf6e165988ab9d7c01da03b9e27bb8ac0c76aa
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 17:32:08 2013 +0200

    qemu-char: correct return value from chr_read functions
    
    Even if a CharDriverState's source is blocked by the front-end,
    it must not be dropped. The IOWatchPoll that wraps it will take
    care of adding and removing it to the main loop.  Only remove
    the source when the channel is closed; and in that case, make sure
    that the wrapping IOWatchPoll is removed too.
    
    These should just be theoretical bugs.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1366385529-10329-4-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index d14888d..6e897da 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -781,12 +781,16 @@ static gboolean fd_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
         len = s->max_size;
     }
     if (len == 0) {
-        return FALSE;
+        return TRUE;
     }
 
     status = g_io_channel_read_chars(chan, (gchar *)buf,
                                      len, &bytes_read, NULL);
     if (status == G_IO_STATUS_EOF) {
+        if (s->fd_in_tag) {
+            g_source_remove(s->fd_in_tag);
+            s->fd_in_tag = 0;
+        }
         qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
         return FALSE;
     }
@@ -1105,8 +1109,9 @@ static gboolean pty_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
     len = sizeof(buf);
     if (len > s->read_bytes)
         len = s->read_bytes;
-    if (len == 0)
-        return FALSE;
+    if (len == 0) {
+        return TRUE;
+    }
     status = g_io_channel_read_chars(s->fd, (gchar *)buf, len, &size, NULL);
     if (status != G_IO_STATUS_NORMAL) {
         pty_chr_state(chr, 0);
@@ -2238,13 +2243,18 @@ static gboolean udp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
     gsize bytes_read = 0;
     GIOStatus status;
 
-    if (s->max_size == 0)
-        return FALSE;
+    if (s->max_size == 0) {
+        return TRUE;
+    }
     status = g_io_channel_read_chars(s->chan, (gchar *)s->buf, sizeof(s->buf),
                                      &bytes_read, NULL);
     s->bufcnt = bytes_read;
     s->bufptr = s->bufcnt;
     if (status != G_IO_STATUS_NORMAL) {
+        if (s->tag) {
+            g_source_remove(s->tag);
+            s->tag = 0;
+        }
         return FALSE;
     }
 
@@ -2497,7 +2507,7 @@ static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
     int len, size;
 
     if (!s->connected || s->max_size <= 0) {
-        return FALSE;
+        return TRUE;
     }
     len = sizeof(buf);
     if (len > s->max_size)
commit 85a67692d04e15a6b7d5a0e2b9d573d8bffbe108
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 17:32:07 2013 +0200

    qemu-char: simplify pty polling
    
    There is no need to use a timer and pty_chr_read to detect a connected
    pty.  It is simpler to just call g_poll periodically and check for POLLHUP.
    It is done once per second, and only if the pty is disconnected, so it
    is cheap enough.
    
    Tested with "-monitor pty" and "-serial mon:pty", both of which work
    correctly and do not freeze QEMU.  (How to test ptys?  "socat -,raw,echo=0
    /dev/pts/4,raw").
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1366385529-10329-3-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index 552a498..d14888d 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -1028,7 +1028,6 @@ typedef struct {
     GIOChannel *fd;
     guint fd_tag;
     int connected;
-    int polling;
     int read_bytes;
     guint timer_tag;
 } PtyCharDriver;
@@ -1044,12 +1043,6 @@ static gboolean pty_chr_timer(gpointer opaque)
     if (s->connected) {
         goto out;
     }
-    if (s->polling) {
-        /* If we arrive here without polling being cleared due
-         * read returning -EIO, then we are (re-)connected */
-        pty_chr_state(chr, 1);
-        goto out;
-    }
 
     /* Next poll ... */
     pty_chr_update_read_handler(chr);
@@ -1128,22 +1121,17 @@ static gboolean pty_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
 static void pty_chr_update_read_handler(CharDriverState *chr)
 {
     PtyCharDriver *s = chr->opaque;
+    GPollFD pfd;
 
-    if (s->fd_tag) {
-        g_source_remove(s->fd_tag);
+    pfd.fd = g_io_channel_unix_get_fd(s->fd);
+    pfd.events = G_IO_OUT;
+    pfd.revents = 0;
+    g_poll(&pfd, 1, 0);
+    if (pfd.revents & G_IO_HUP) {
+        pty_chr_state(chr, 0);
+    } else {
+        pty_chr_state(chr, 1);
     }
-
-    s->fd_tag = io_add_watch_poll(s->fd, pty_chr_read_poll, pty_chr_read, chr);
-    s->polling = 1;
-    /*
-     * Short timeout here: just need wait long enougth that qemu makes
-     * it through the poll loop once.  When reconnected we want a
-     * short timeout so we notice it almost instantly.  Otherwise
-     * read() gives us -EIO instantly, making pty_chr_state() reset the
-     * timeout to the normal (much longer) poll interval before the
-     * timer triggers.
-     */
-    pty_chr_rearm_timer(chr, 10);
 }
 
 static void pty_chr_state(CharDriverState *chr, int connected)
@@ -1156,15 +1144,20 @@ static void pty_chr_state(CharDriverState *chr, int connected)
             s->fd_tag = 0;
         }
         s->connected = 0;
-        s->polling = 0;
         /* (re-)connect poll interval for idle guests: once per second.
          * We check more frequently in case the guests sends data to
          * the virtual device linked to our pty. */
         pty_chr_rearm_timer(chr, 1000);
     } else {
-        if (!s->connected)
+        if (s->timer_tag) {
+            g_source_remove(s->timer_tag);
+            s->timer_tag = 0;
+        }
+        if (!s->connected) {
             qemu_chr_be_generic_open(chr);
-        s->connected = 1;
+            s->connected = 1;
+            s->fd_tag = io_add_watch_poll(s->fd, pty_chr_read_poll, pty_chr_read, chr);
+        }
     }
 }
 
commit 910b63682ea72f34307b8797c4cc81a1f2a0c47f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 17:32:06 2013 +0200

    qemu-char: use consistent idiom for removing sources
    
    Always check that the source is active, and zero the tag afterwards.
    
    The occurrence in pty_chr_state will trigger with the next patch, the
    others are just theoretical.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1366385529-10329-2-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/qemu-char.c b/qemu-char.c
index 728ed9b..552a498 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -644,9 +644,11 @@ static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
 static void io_watch_poll_finalize(GSource *source)
 {
     IOWatchPoll *iwp = io_watch_poll_from_source(source);
-    g_source_destroy(iwp->src);
-    g_source_unref(iwp->src);
-    iwp->src = NULL;
+    if (iwp->src) {
+        g_source_destroy(iwp->src);
+        g_source_unref(iwp->src);
+        iwp->src = NULL;
+    }
 }
 
 static GSourceFuncs io_watch_poll_funcs = {
@@ -816,6 +818,7 @@ static void fd_chr_update_read_handler(CharDriverState *chr)
 
     if (s->fd_in_tag) {
         g_source_remove(s->fd_in_tag);
+        s->fd_in_tag = 0;
     }
 
     if (s->fd_in) {
@@ -1148,8 +1151,10 @@ static void pty_chr_state(CharDriverState *chr, int connected)
     PtyCharDriver *s = chr->opaque;
 
     if (!connected) {
-        g_source_remove(s->fd_tag);
-        s->fd_tag = 0;
+        if (s->fd_tag) {
+            g_source_remove(s->fd_tag);
+            s->fd_tag = 0;
+        }
         s->connected = 0;
         s->polling = 0;
         /* (re-)connect poll interval for idle guests: once per second.
@@ -1171,12 +1176,14 @@ static void pty_chr_close(struct CharDriverState *chr)
 
     if (s->fd_tag) {
         g_source_remove(s->fd_tag);
+        s->fd_tag = 0;
     }
     fd = g_io_channel_unix_get_fd(s->fd);
     g_io_channel_unref(s->fd);
     close(fd);
     if (s->timer_tag) {
         g_source_remove(s->timer_tag);
+        s->timer_tag = 0;
     }
     g_free(s);
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
@@ -2277,6 +2284,7 @@ static void udp_chr_close(CharDriverState *chr)
     NetCharDriver *s = chr->opaque;
     if (s->tag) {
         g_source_remove(s->tag);
+        s->tag = 0;
     }
     if (s->chan) {
         g_io_channel_unref(s->chan);
@@ -2508,8 +2516,10 @@ static gboolean tcp_chr_read(GIOChannel *chan, GIOCondition cond, void *opaque)
         if (s->listen_chan) {
             s->listen_tag = g_io_add_watch(s->listen_chan, G_IO_IN, tcp_chr_accept, chr);
         }
-        g_source_remove(s->tag);
-        s->tag = 0;
+        if (s->tag) {
+            g_source_remove(s->tag);
+            s->tag = 0;
+        }
         g_io_channel_unref(s->chan);
         s->chan = NULL;
         closesocket(s->fd);
@@ -2570,8 +2580,10 @@ static int tcp_chr_add_client(CharDriverState *chr, int fd)
         socket_set_nodelay(fd);
     s->fd = fd;
     s->chan = io_channel_from_socket(fd);
-    g_source_remove(s->listen_tag);
-    s->listen_tag = 0;
+    if (s->listen_tag) {
+        g_source_remove(s->listen_tag);
+        s->listen_tag = 0;
+    }
     tcp_chr_connect(chr);
 
     return 0;
@@ -2621,6 +2633,7 @@ static void tcp_chr_close(CharDriverState *chr)
     if (s->fd >= 0) {
         if (s->tag) {
             g_source_remove(s->tag);
+            s->tag = 0;
         }
         if (s->chan) {
             g_io_channel_unref(s->chan);
@@ -2630,6 +2643,7 @@ static void tcp_chr_close(CharDriverState *chr)
     if (s->listen_fd >= 0) {
         if (s->listen_tag) {
             g_source_remove(s->listen_tag);
+            s->listen_tag = 0;
         }
         if (s->listen_chan) {
             g_io_channel_unref(s->listen_chan);
commit 0aa09897571c55292703b7a099d7ea79baa09950
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Mon Apr 22 17:42:50 2013 +1000

    translate-all: fix compiler warning and linked error
    
    The code did use profile_getclock() but did not include
    include/qemu/timer.h where this function is defined. The patch fixes this.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Message-id: 1366616571-4321-1-git-send-email-aik at ozlabs.ru
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

diff --git a/translate-all.c b/translate-all.c
index 08dd038..d04a116 100644
--- a/translate-all.c
+++ b/translate-all.c
@@ -58,6 +58,7 @@
 
 #include "exec/cputlb.h"
 #include "translate-all.h"
+#include "qemu/timer.h"
 
 //#define DEBUG_TB_INVALIDATE
 //#define DEBUG_FLUSH
commit f1ab7a5acf08dcc11638b22660ed87d5f6d633c2
Merge: 2569073 7da94ca
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Apr 22 08:08:22 2013 -0500

    Merge remote-tracking branch 'kwolf/for-anthony' into staging
    
    # By Kevin Wolf (16) and Stefan Hajnoczi (4)
    # Via Kevin Wolf
    * kwolf/for-anthony:
      qemu-iotests: add 053 unaligned compressed image size test
      block: Allow overriding backing.file.filename
      block: Remove filename parameter from .bdrv_file_open()
      vvfat: Use bdrv_open options instead of filename
      sheepdog: Use bdrv_open options instead of filename
      rbd: Use bdrv_open options instead of filename
      iscsi: Use bdrv_open options instead of filename
      gluster: Use bdrv_open options instead of filename
      curl: Use bdrv_open options instead of filename
      blkverify: Use bdrv_open options instead of filename
      blkdebug: Use bdrv_open options instead of filename
      raw-win32: Use bdrv_open options instead of filename
      raw-posix: Use bdrv_open options instead of filename
      block: Enable filename option
      block: Add driver-specific options for backing files
      block: Fail gracefully when using a format driver on protocol level
      qemu-iotests: Fix _filter_qemu
      qemu-img: do not zero-pad the compressed write buffer
      qcow: allow sub-cluster compressed write to last cluster
      qcow2: allow sub-cluster compressed write to last cluster
    
    Message-id: 1366630294-18984-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 25690739f1f067b6d8b2e616d87b1d976db0db92
Merge: 6165daa 97ebbab
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Apr 22 08:05:14 2013 -0500

    Merge remote-tracking branch 'bonzini/nbd-next' into staging
    
    # By Stefan Hajnoczi
    # Via Paolo Bonzini
    * bonzini/nbd-next:
      nbd: set TCP_NODELAY
      nbd: use TCP_CORK in nbd_co_send_request()
      nbd: unlock mutex in nbd_co_send_request() error path
    
    Message-id: 1366381830-11267-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 6165daa4c8431d9d60382352864b46f34dd61ab4
Merge: d639498 d6e5191
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Apr 22 08:05:05 2013 -0500

    Merge remote-tracking branch 'bonzini/scsi-next' into staging
    
    # By Paolo Bonzini (5) and others
    # Via Paolo Bonzini
    * bonzini/scsi-next:
      vhost-scsi-s390: new device supporting the tcm_vhost Linux kernel module
      vhost-scsi-ccw: new device supporting the tcm_vhost Linux kernel module
      vhost-scsi-pci: new device supporting the tcm_vhost Linux kernel module
      vhost-scsi: new device supporting the tcm_vhost Linux kernel module
      virtio: simplify Makefile conditionals
      virtio-scsi: create VirtIOSCSICommon
      vhost: Add vhost_commit callback for SeaBIOS ROM region re-mapping
      scsi: VMWare PVSCSI paravirtual device implementation
      scsi: avoid assertion failure on VERIFY command
    
    Message-id: 1366381460-6041-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit d639498852773a6019cf1b970dd8dc2f3791c45b
Merge: 68c0aa6 dcc6cef
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Mon Apr 22 08:04:21 2013 -0500

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Amos Kong (1) and Luiz Capitulino (1)
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      virtio-balloon: fix integer overflow in BALLOON_CHANGE QMP event
      monitor: fix the wrong order of releasing keys
    
    Message-id: 1366375833-995-1-git-send-email-lcapitulino at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 7da94ca741e01a80afd65e107cc2cee160d1b2d2
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Apr 16 11:14:23 2013 +0200

    qemu-iotests: add 053 unaligned compressed image size test
    
    Test that qemu-img convert -c works when input image length is not a
    multiple of the cluster size.
    
    Previously an error message would be produced:
    
      qemu-img: error while compressing sector 0: Input/output error
    
    Now that qcow2 and qcow handle this case the test passes successfully.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/053 b/tests/qemu-iotests/053
new file mode 100755
index 0000000..bc56992
--- /dev/null
+++ b/tests/qemu-iotests/053
@@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Test qemu-img convert when image length is not a multiple of cluster size
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# creator
+owner=stefanha at redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+
+_cleanup()
+{
+	rm -f $TEST_IMG.orig
+	_cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+
+_supported_fmt qcow2 qcow
+_supported_proto file
+_supported_os Linux
+
+echo
+echo "== Creating single sector image =="
+
+_make_test_img 512
+$QEMU_IO -c "write -P0xa 0 512" $TEST_IMG | _filter_qemu_io
+mv $TEST_IMG $TEST_IMG.orig
+
+echo
+echo "== Converting the image, compressed =="
+
+$QEMU_IMG convert -c -O $IMGFMT $TEST_IMG.orig $TEST_IMG
+_check_test_img
+
+echo
+echo "== Checking compressed image virtual disk size =="
+
+_img_info | grep '^virtual size:'
+
+echo
+echo "== Verifying the compressed image =="
+
+$QEMU_IO -c "read -P0xa 0 512" $TEST_IMG | _filter_qemu_io
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
+
diff --git a/tests/qemu-iotests/053.out b/tests/qemu-iotests/053.out
new file mode 100644
index 0000000..16464e6
--- /dev/null
+++ b/tests/qemu-iotests/053.out
@@ -0,0 +1,17 @@
+QA output created by 053
+
+== Creating single sector image ==
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=512 
+wrote 512/512 bytes at offset 0
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== Converting the image, compressed ==
+No errors were found on the image.
+
+== Checking compressed image virtual disk size ==
+virtual size: 512 (512 bytes)
+
+== Verifying the compressed image ==
+read 512/512 bytes at offset 0
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index 324bacb..68eabda 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -59,3 +59,4 @@
 050 rw auto backing quick
 051 rw auto
 052 rw auto backing
+053 rw auto
commit 1cb6f506444ddf00bb163e5ffa28ab1051b65642
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 20:27:07 2013 +0200

    block: Allow overriding backing.file.filename
    
    If a filename is passed in the driver-specific options from the command
    line, the backing file path from the image is ignored now.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index 6e07f45..819eb4e 100644
--- a/block.c
+++ b/block.c
@@ -889,7 +889,9 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options)
     }
 
     bs->open_flags &= ~BDRV_O_NO_BACKING;
-    if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
+    if (qdict_haskey(options, "file.filename")) {
+        backing_filename[0] = '\0';
+    } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
         QDECREF(options);
         return 0;
     }
commit 56d1b4d21d444619302d3f1291a133b1c2b9b072
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 20:02:37 2013 +0200

    block: Remove filename parameter from .bdrv_file_open()
    
    It is unused now in all block drivers.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index e3464d6..6e07f45 100644
--- a/block.c
+++ b/block.c
@@ -722,7 +722,7 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
     if (drv->bdrv_file_open) {
         assert(file == NULL);
         assert(drv->bdrv_parse_filename || filename != NULL);
-        ret = drv->bdrv_file_open(bs, filename, options, open_flags);
+        ret = drv->bdrv_file_open(bs, options, open_flags);
     } else {
         if (file == NULL) {
             qerror_report(ERROR_CLASS_GENERIC_ERROR, "Can't use '%s' as a "
@@ -826,6 +826,7 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
             ret = -EINVAL;
             goto fail;
         }
+        qdict_del(options, "filename");
     } else if (!drv->bdrv_parse_filename && !filename) {
         qerror_report(ERROR_CLASS_GENERIC_ERROR,
                       "The '%s' block driver requires a file name",
@@ -839,11 +840,6 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
         goto fail;
     }
 
-    /* TODO Remove once all protocols know the filename option */
-    if (qdict_haskey(options, "filename")) {
-        qdict_del(options, "filename");
-    }
-
     /* Check if any unknown options were used */
     if (qdict_size(options) != 0) {
         const QDictEntry *entry = qdict_first(options);
diff --git a/block/blkdebug.c b/block/blkdebug.c
index 3d03fcb..71f99e4 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -346,8 +346,7 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int blkdebug_open(BlockDriverState *bs, const char *dummy,
-                         QDict *options, int flags)
+static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVBlkdebugState *s = bs->opaque;
     QemuOpts *opts;
diff --git a/block/blkverify.c b/block/blkverify.c
index d63158f..1d58cc3 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -116,8 +116,7 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int blkverify_open(BlockDriverState *bs, const char *dummy,
-                          QDict *options, int flags)
+static int blkverify_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVBlkverifyState *s = bs->opaque;
     QemuOpts *opts;
diff --git a/block/curl.c b/block/curl.c
index 61bc3db..b8935fd 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -395,8 +395,7 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int curl_open(BlockDriverState *bs, const char *dummy,
-                     QDict *options, int flags)
+static int curl_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVCURLState *s = bs->opaque;
     CURLState *state = NULL;
diff --git a/block/gluster.c b/block/gluster.c
index 3796da8..91acde2 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -296,8 +296,8 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int qemu_gluster_open(BlockDriverState *bs, const char *dummy,
-    QDict *options, int bdrv_flags)
+static int qemu_gluster_open(BlockDriverState *bs,  QDict *options,
+                             int bdrv_flags)
 {
     BDRVGlusterState *s = bs->opaque;
     int open_flags = O_BINARY;
diff --git a/block/iscsi.c b/block/iscsi.c
index 907beba..f7199c1 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1021,8 +1021,7 @@ static QemuOptsList runtime_opts = {
  * We support iscsi url's on the form
  * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
  */
-static int iscsi_open(BlockDriverState *bs, const char *dummy,
-                      QDict *options, int flags)
+static int iscsi_open(BlockDriverState *bs, QDict *options, int flags)
 {
     IscsiLun *iscsilun = bs->opaque;
     struct iscsi_context *iscsi = NULL;
@@ -1237,7 +1236,7 @@ static int iscsi_create(const char *filename, QEMUOptionParameter *options)
 
     bs_options = qdict_new();
     qdict_put(bs_options, "filename", qstring_from_str(filename));
-    ret = iscsi_open(&bs, NULL, bs_options, 0);
+    ret = iscsi_open(&bs, bs_options, 0);
     QDECREF(bs_options);
 
     if (ret != 0) {
diff --git a/block/nbd.c b/block/nbd.c
index eff683c..61b7c9b 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -441,8 +441,7 @@ static void nbd_teardown_connection(BlockDriverState *bs)
     closesocket(s->sock);
 }
 
-static int nbd_open(BlockDriverState *bs, const char* filename,
-                    QDict *options, int flags)
+static int nbd_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVNBDState *s = bs->opaque;
     int result;
diff --git a/block/raw-posix.c b/block/raw-posix.c
index afd5385..c0ccf27 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -335,8 +335,7 @@ fail:
     return ret;
 }
 
-static int raw_open(BlockDriverState *bs, const char *filename,
-                    QDict *options, int flags)
+static int raw_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
 
@@ -1325,8 +1324,7 @@ static int check_hdev_writable(BDRVRawState *s)
     return 0;
 }
 
-static int hdev_open(BlockDriverState *bs, const char *dummy,
-                     QDict *options, int flags)
+static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
@@ -1565,8 +1563,7 @@ static BlockDriver bdrv_host_device = {
 };
 
 #ifdef __linux__
-static int floppy_open(BlockDriverState *bs, const char *filename,
-                       QDict *options, int flags)
+static int floppy_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
@@ -1688,8 +1685,7 @@ static BlockDriver bdrv_host_floppy = {
     .bdrv_eject         = floppy_eject,
 };
 
-static int cdrom_open(BlockDriverState *bs, const char *filename,
-                      QDict *options, int flags)
+static int cdrom_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
 
@@ -1797,8 +1793,7 @@ static BlockDriver bdrv_host_cdrom = {
 #endif /* __linux__ */
 
 #if defined (__FreeBSD__) || defined(__FreeBSD_kernel__)
-static int cdrom_open(BlockDriverState *bs, const char *filename,
-                      QDict *options, int flags)
+static int cdrom_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
diff --git a/block/raw-win32.c b/block/raw-win32.c
index be33cc1..7c03b6d 100644
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -234,8 +234,7 @@ static QemuOptsList raw_runtime_opts = {
     },
 };
 
-static int raw_open(BlockDriverState *bs, const char *unused,
-                    QDict *options, int flags)
+static int raw_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int access_flags;
@@ -531,8 +530,7 @@ static int hdev_probe_device(const char *filename)
     return 0;
 }
 
-static int hdev_open(BlockDriverState *bs, const char *dummy,
-                     QDict *options, int flags)
+static int hdev_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int access_flags, create_flags;
diff --git a/block/rbd.c b/block/rbd.c
index 0d68145..1826411 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -455,8 +455,7 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int qemu_rbd_open(BlockDriverState *bs, const char *dummy,
-                         QDict *options, int flags)
+static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVRBDState *s = bs->opaque;
     char pool[RBD_MAX_POOL_NAME_SIZE];
diff --git a/block/sheepdog.c b/block/sheepdog.c
index e224c51..20b5d06 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1140,8 +1140,7 @@ static QemuOptsList runtime_opts = {
     },
 };
 
-static int sd_open(BlockDriverState *bs, const char *dummy,
-                   QDict *options, int flags)
+static int sd_open(BlockDriverState *bs, QDict *options, int flags)
 {
     int ret, fd;
     uint32_t vid = 0;
diff --git a/block/ssh.c b/block/ssh.c
index 93a8b53..246a70d 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -608,8 +608,7 @@ static int connect_to_ssh(BDRVSSHState *s, QDict *options,
     return ret;
 }
 
-static int ssh_file_open(BlockDriverState *bs, const char *filename,
-                         QDict *options, int bdrv_flags)
+static int ssh_file_open(BlockDriverState *bs, QDict *options, int bdrv_flags)
 {
     BDRVSSHState *s = bs->opaque;
     int ret;
diff --git a/block/vvfat.c b/block/vvfat.c
index f4c06b9..87b0279 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -1065,8 +1065,7 @@ static void vvfat_parse_filename(const char *filename, QDict *options,
     qdict_put(options, "rw", qbool_from_int(rw));
 }
 
-static int vvfat_open(BlockDriverState *bs, const char* dummy,
-                      QDict *options, int flags)
+static int vvfat_open(BlockDriverState *bs, QDict *options, int flags)
 {
     BDRVVVFATState *s = bs->opaque;
     int cyls, heads, secs;
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 458cde3..6078dd3 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -87,8 +87,7 @@ struct BlockDriver {
     void (*bdrv_reopen_abort)(BDRVReopenState *reopen_state);
 
     int (*bdrv_open)(BlockDriverState *bs, QDict *options, int flags);
-    int (*bdrv_file_open)(BlockDriverState *bs, const char *filename,
-                          QDict *options, int flags);
+    int (*bdrv_file_open)(BlockDriverState *bs, QDict *options, int flags);
     int (*bdrv_read)(BlockDriverState *bs, int64_t sector_num,
                      uint8_t *buf, int nb_sectors);
     int (*bdrv_write)(BlockDriverState *bs, int64_t sector_num,
commit 7ad9be64e8ac17811ff358279ef7193cc623da1a
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 19:42:04 2013 +0200

    vvfat: Use bdrv_open options instead of filename
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/vvfat.c b/block/vvfat.c
index ef74c30..f4c06b9 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -1,4 +1,4 @@
-/* vim:set shiftwidth=4 ts=8: */
+/* vim:set shiftwidth=4 ts=4: */
 /*
  * QEMU Block driver for virtual VFAT (shadows a local directory)
  *
@@ -28,6 +28,8 @@
 #include "block/block_int.h"
 #include "qemu/module.h"
 #include "migration/migration.h"
+#include "qapi/qmp/qint.h"
+#include "qapi/qmp/qbool.h"
 
 #ifndef S_IWGRP
 #define S_IWGRP 0
@@ -988,11 +990,91 @@ static void vvfat_rebind(BlockDriverState *bs)
     s->bs = bs;
 }
 
-static int vvfat_open(BlockDriverState *bs, const char* dirname,
+static QemuOptsList runtime_opts = {
+    .name = "vvfat",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "dir",
+            .type = QEMU_OPT_STRING,
+            .help = "Host directory to map to the vvfat device",
+        },
+        {
+            .name = "fat-type",
+            .type = QEMU_OPT_NUMBER,
+            .help = "FAT type (12, 16 or 32)",
+        },
+        {
+            .name = "floppy",
+            .type = QEMU_OPT_BOOL,
+            .help = "Create a floppy rather than a hard disk image",
+        },
+        {
+            .name = "rw",
+            .type = QEMU_OPT_BOOL,
+            .help = "Make the image writable",
+        },
+        { /* end of list */ }
+    },
+};
+
+static void vvfat_parse_filename(const char *filename, QDict *options,
+                                 Error **errp)
+{
+    int fat_type = 0;
+    bool floppy = false;
+    bool rw = false;
+    int i;
+
+    if (!strstart(filename, "fat:", NULL)) {
+        error_setg(errp, "File name string must start with 'fat:'");
+        return;
+    }
+
+    /* Parse options */
+    if (strstr(filename, ":32:")) {
+        fat_type = 32;
+    } else if (strstr(filename, ":16:")) {
+        fat_type = 16;
+    } else if (strstr(filename, ":12:")) {
+        fat_type = 12;
+    }
+
+    if (strstr(filename, ":floppy:")) {
+        floppy = true;
+    }
+
+    if (strstr(filename, ":rw:")) {
+        rw = true;
+    }
+
+    /* Get the directory name without options */
+    i = strrchr(filename, ':') - filename;
+    assert(i >= 3);
+    if (filename[i - 2] == ':' && qemu_isalpha(filename[i - 1])) {
+        /* workaround for DOS drive names */
+        filename += i - 1;
+    } else {
+        filename += i + 1;
+    }
+
+    /* Fill in the options QDict */
+    qdict_put(options, "dir", qstring_from_str(filename));
+    qdict_put(options, "fat-type", qint_from_int(fat_type));
+    qdict_put(options, "floppy", qbool_from_int(floppy));
+    qdict_put(options, "rw", qbool_from_int(rw));
+}
+
+static int vvfat_open(BlockDriverState *bs, const char* dummy,
                       QDict *options, int flags)
 {
     BDRVVVFATState *s = bs->opaque;
-    int i, cyls, heads, secs;
+    int cyls, heads, secs;
+    bool floppy;
+    const char *dirname;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    int ret;
 
 #ifdef DEBUG
     vvv = s;
@@ -1003,6 +1085,65 @@ DLOG(if (stderr == NULL) {
     setbuf(stderr, NULL);
 })
 
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    dirname = qemu_opt_get(opts, "dir");
+    if (!dirname) {
+        qerror_report(ERROR_CLASS_GENERIC_ERROR, "vvfat block driver requires "
+                      "a 'dir' option");
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    s->fat_type = qemu_opt_get_number(opts, "fat-type", 0);
+    floppy = qemu_opt_get_bool(opts, "floppy", false);
+
+    if (floppy) {
+        /* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
+        if (!s->fat_type) {
+            s->fat_type = 12;
+            secs = 36;
+            s->sectors_per_cluster = 2;
+        } else {
+            secs = s->fat_type == 12 ? 18 : 36;
+            s->sectors_per_cluster = 1;
+        }
+        s->first_sectors_number = 1;
+        cyls = 80;
+        heads = 2;
+    } else {
+        /* 32MB or 504MB disk*/
+        if (!s->fat_type) {
+            s->fat_type = 16;
+        }
+        cyls = s->fat_type == 12 ? 64 : 1024;
+        heads = 16;
+        secs = 63;
+    }
+
+    switch (s->fat_type) {
+    case 32:
+	    fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. "
+                "You are welcome to do so!\n");
+        break;
+    case 16:
+    case 12:
+        break;
+    default:
+        qerror_report(ERROR_CLASS_GENERIC_ERROR, "Valid FAT types are only "
+                      "12, 16 and 32");
+        ret = -EINVAL;
+        goto fail;
+    }
+
+
     s->bs = bs;
 
     /* LATER TODO: if FAT32, adjust */
@@ -1018,63 +1159,24 @@ DLOG(if (stderr == NULL) {
     s->fat2 = NULL;
     s->downcase_short_names = 1;
 
-    if (!strstart(dirname, "fat:", NULL))
-	return -1;
-
-    if (strstr(dirname, ":32:")) {
-	fprintf(stderr, "Big fat greek warning: FAT32 has not been tested. You are welcome to do so!\n");
-	s->fat_type = 32;
-    } else if (strstr(dirname, ":16:")) {
-	s->fat_type = 16;
-    } else if (strstr(dirname, ":12:")) {
-	s->fat_type = 12;
-    }
-
-    if (strstr(dirname, ":floppy:")) {
-	/* 1.44MB or 2.88MB floppy.  2.88MB can be FAT12 (default) or FAT16. */
-	if (!s->fat_type) {
-	    s->fat_type = 12;
-            secs = 36;
-	    s->sectors_per_cluster=2;
-	} else {
-            secs = s->fat_type == 12 ? 18 : 36;
-	    s->sectors_per_cluster=1;
-	}
-	s->first_sectors_number = 1;
-        cyls = 80;
-        heads = 2;
-    } else {
-	/* 32MB or 504MB disk*/
-	if (!s->fat_type) {
-	    s->fat_type = 16;
-	}
-        cyls = s->fat_type == 12 ? 64 : 1024;
-        heads = 16;
-        secs = 63;
-    }
     fprintf(stderr, "vvfat %s chs %d,%d,%d\n",
             dirname, cyls, heads, secs);
 
     s->sector_count = cyls * heads * secs - (s->first_sectors_number - 1);
 
-    if (strstr(dirname, ":rw:")) {
-	if (enable_write_target(s))
-	    return -1;
-	bs->read_only = 0;
+    if (qemu_opt_get_bool(opts, "rw", false)) {
+        if (enable_write_target(s)) {
+            ret = -EIO;
+            goto fail;
+        }
+        bs->read_only = 0;
     }
 
-    i = strrchr(dirname, ':') - dirname;
-    assert(i >= 3);
-    if (dirname[i-2] == ':' && qemu_isalpha(dirname[i-1]))
-	/* workaround for DOS drive names */
-	dirname += i-1;
-    else
-	dirname += i+1;
-
     bs->total_sectors = cyls * heads * secs;
 
     if (init_directories(s, dirname, heads, secs)) {
-	return -1;
+        ret = -EIO;
+        goto fail;
     }
 
     s->sector_count = s->faked_sectors + s->sectors_per_cluster*s->cluster_count;
@@ -1094,7 +1196,10 @@ DLOG(if (stderr == NULL) {
         migrate_add_blocker(s->migration_blocker);
     }
 
-    return 0;
+    ret = 0;
+fail:
+    qemu_opts_del(opts);
+    return ret;
 }
 
 static inline void vvfat_close_current_file(BDRVVVFATState *s)
@@ -2866,15 +2971,18 @@ static void vvfat_close(BlockDriverState *bs)
 }
 
 static BlockDriver bdrv_vvfat = {
-    .format_name	= "vvfat",
-    .instance_size	= sizeof(BDRVVVFATState),
-    .bdrv_file_open	= vvfat_open,
-    .bdrv_rebind	= vvfat_rebind,
-    .bdrv_read          = vvfat_co_read,
-    .bdrv_write         = vvfat_co_write,
-    .bdrv_close		= vvfat_close,
-    .bdrv_co_is_allocated = vvfat_co_is_allocated,
-    .protocol_name	= "fat",
+    .format_name            = "vvfat",
+    .protocol_name          = "fat",
+    .instance_size          = sizeof(BDRVVVFATState),
+
+    .bdrv_parse_filename    = vvfat_parse_filename,
+    .bdrv_file_open         = vvfat_open,
+    .bdrv_close             = vvfat_close,
+    .bdrv_rebind            = vvfat_rebind,
+
+    .bdrv_read              = vvfat_co_read,
+    .bdrv_write             = vvfat_co_write,
+    .bdrv_co_is_allocated   = vvfat_co_is_allocated,
 };
 
 static void bdrv_vvfat_init(void)
commit c8c96350e0127c1d3d55c5f16978f1f5201c52e8
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 18:10:49 2013 +0200

    sheepdog: Use bdrv_open options instead of filename
    
    This is only to convert the internal interface that is used for passing
    the "filename" to be parsed, but converting to actual fine grained
    options is left for another day, as it doesn't look trivial.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/sheepdog.c b/block/sheepdog.c
index 1c5b532..e224c51 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -1126,7 +1126,21 @@ static int write_object(int fd, char *buf, uint64_t oid, int copies,
                              create, cache_flags);
 }
 
-static int sd_open(BlockDriverState *bs, const char *filename,
+/* TODO Convert to fine grained options */
+static QemuOptsList runtime_opts = {
+    .name = "sheepdog",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "URL to the sheepdog image",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int sd_open(BlockDriverState *bs, const char *dummy,
                    QDict *options, int flags)
 {
     int ret, fd;
@@ -1135,6 +1149,20 @@ static int sd_open(BlockDriverState *bs, const char *filename,
     char vdi[SD_MAX_VDI_LEN], tag[SD_MAX_VDI_TAG_LEN];
     uint32_t snapid;
     char *buf = NULL;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
+
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto out;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
 
     QLIST_INIT(&s->inflight_aio_head);
     QLIST_INIT(&s->pending_aio_head);
@@ -1199,6 +1227,7 @@ static int sd_open(BlockDriverState *bs, const char *filename,
     bs->total_sectors = s->inode.vdi_size / SECTOR_SIZE;
     pstrcpy(s->name, sizeof(s->name), vdi);
     qemu_co_mutex_init(&s->lock);
+    qemu_opts_del(opts);
     g_free(buf);
     return 0;
 out:
@@ -1206,6 +1235,7 @@ out:
     if (s->fd >= 0) {
         closesocket(s->fd);
     }
+    qemu_opts_del(opts);
     g_free(buf);
     return ret;
 }
commit a9ccedc3daa06723821663c6b3b02c1760035bb9
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 18:05:35 2013 +0200

    rbd: Use bdrv_open options instead of filename
    
    This is only to convert the internal interface that is used for passing
    the "filename" to be parsed, but converting to actual fine grained
    options is left for another day, as it doesn't look trivial.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/rbd.c b/block/rbd.c
index 141b488..0d68145 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -441,7 +441,21 @@ static int qemu_rbd_aio_flush_cb(void *opaque)
     return (s->qemu_aio_count > 0);
 }
 
-static int qemu_rbd_open(BlockDriverState *bs, const char *filename,
+/* TODO Convert to fine grained options */
+static QemuOptsList runtime_opts = {
+    .name = "rbd",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "Specification of the rbd image",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int qemu_rbd_open(BlockDriverState *bs, const char *dummy,
                          QDict *options, int flags)
 {
     BDRVRBDState *s = bs->opaque;
@@ -450,8 +464,23 @@ static int qemu_rbd_open(BlockDriverState *bs, const char *filename,
     char conf[RBD_MAX_CONF_SIZE];
     char clientname_buf[RBD_MAX_CONF_SIZE];
     char *clientname;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
     int r;
 
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        qemu_opts_del(opts);
+        return -EINVAL;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
+    qemu_opts_del(opts);
+
     if (qemu_rbd_parsename(filename, pool, sizeof(pool),
                            snap_buf, sizeof(snap_buf),
                            s->name, sizeof(s->name),
commit 60beb3412dfa9a6341338c93d0ef44312a9c4f66
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 17:59:59 2013 +0200

    iscsi: Use bdrv_open options instead of filename
    
    This is only to convert the internal interface that is used for passing
    the "filename" to be parsed, but converting to actual fine grained
    options is left for another day, as it doesn't look trivial.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/iscsi.c b/block/iscsi.c
index 92d6eae..907beba 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -1003,11 +1003,25 @@ out:
     return ret;
 }
 
+/* TODO Convert to fine grained options */
+static QemuOptsList runtime_opts = {
+    .name = "iscsi",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "URL to the iscsi image",
+        },
+        { /* end of list */ }
+    },
+};
+
 /*
  * We support iscsi url's on the form
  * iscsi://[<username>%<password>@]<host>[:<port>]/<targetname>/<lun>
  */
-static int iscsi_open(BlockDriverState *bs, const char *filename,
+static int iscsi_open(BlockDriverState *bs, const char *dummy,
                       QDict *options, int flags)
 {
     IscsiLun *iscsilun = bs->opaque;
@@ -1016,6 +1030,9 @@ static int iscsi_open(BlockDriverState *bs, const char *filename,
     struct scsi_task *task = NULL;
     struct scsi_inquiry_standard *inq = NULL;
     char *initiator_name = NULL;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
     int ret;
 
     if ((BDRV_SECTOR_SIZE % 512) != 0) {
@@ -1025,6 +1042,18 @@ static int iscsi_open(BlockDriverState *bs, const char *filename,
         return -EINVAL;
     }
 
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto out;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
+
+
     iscsi_url = iscsi_parse_full_url(iscsi, filename);
     if (iscsi_url == NULL) {
         error_report("Failed to parse URL : %s", filename);
@@ -1126,6 +1155,7 @@ static int iscsi_open(BlockDriverState *bs, const char *filename,
 #endif
 
 out:
+    qemu_opts_del(opts);
     if (initiator_name != NULL) {
         g_free(initiator_name);
     }
@@ -1190,6 +1220,7 @@ static int iscsi_create(const char *filename, QEMUOptionParameter *options)
     int64_t total_size = 0;
     BlockDriverState bs;
     IscsiLun *iscsilun = NULL;
+    QDict *bs_options;
 
     memset(&bs, 0, sizeof(BlockDriverState));
 
@@ -1204,7 +1235,11 @@ static int iscsi_create(const char *filename, QEMUOptionParameter *options)
     bs.opaque = g_malloc0(sizeof(struct IscsiLun));
     iscsilun = bs.opaque;
 
-    ret = iscsi_open(&bs, filename, NULL, 0);
+    bs_options = qdict_new();
+    qdict_put(bs_options, "filename", qstring_from_str(filename));
+    ret = iscsi_open(&bs, NULL, bs_options, 0);
+    QDECREF(bs_options);
+
     if (ret != 0) {
         goto out;
     }
commit b489477653702ae2beb919084644a6c8b0b72c36
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Fri Apr 12 17:50:16 2013 +0200

    gluster: Use bdrv_open options instead of filename
    
    This is only to convert the internal interface that is used for passing
    the "filename" to be parsed, but converting to actual fine grained
    options is left for another day, as it doesn't look trivial.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/gluster.c b/block/gluster.c
index 9ccd4d4..3796da8 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -282,13 +282,42 @@ static int qemu_gluster_aio_flush_cb(void *opaque)
     return (s->qemu_aio_count > 0);
 }
 
-static int qemu_gluster_open(BlockDriverState *bs, const char *filename,
+/* TODO Convert to fine grained options */
+static QemuOptsList runtime_opts = {
+    .name = "gluster",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "URL to the gluster image",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int qemu_gluster_open(BlockDriverState *bs, const char *dummy,
     QDict *options, int bdrv_flags)
 {
     BDRVGlusterState *s = bs->opaque;
     int open_flags = O_BINARY;
     int ret = 0;
     GlusterConf *gconf = g_malloc0(sizeof(GlusterConf));
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
+
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto out;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
+
 
     s->glfs = qemu_gluster_init(gconf, filename);
     if (!s->glfs) {
@@ -322,6 +351,7 @@ static int qemu_gluster_open(BlockDriverState *bs, const char *filename,
         qemu_gluster_aio_event_reader, NULL, qemu_gluster_aio_flush_cb, s);
 
 out:
+    qemu_opts_del(opts);
     qemu_gluster_gconf_free(gconf);
     if (!ret) {
         return ret;
commit 8e6d58cd5b695045dd4a203176d2a57138e7f02a
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Apr 10 15:31:33 2013 +0200

    curl: Use bdrv_open options instead of filename
    
    As a bonus, going through the QemuOpts QEMU_OPT_SIZE parser for the
    readahead option gives us proper error reporting that the previous use
    of atoi() lacked.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/curl.c b/block/curl.c
index 186e3b0..61bc3db 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -335,12 +335,9 @@ static void curl_clean_state(CURLState *s)
     s->in_use = 0;
 }
 
-static int curl_open(BlockDriverState *bs, const char *filename,
-                     QDict *options, int flags)
+static void curl_parse_filename(const char *filename, QDict *options,
+                                Error **errp)
 {
-    BDRVCURLState *s = bs->opaque;
-    CURLState *state = NULL;
-    double d;
 
     #define RA_OPTSTR ":readahead="
     char *file;
@@ -348,19 +345,17 @@ static int curl_open(BlockDriverState *bs, const char *filename,
     const char *ra_val;
     int parse_state = 0;
 
-    static int inited = 0;
-
     file = g_strdup(filename);
-    s->readahead_size = READ_AHEAD_SIZE;
 
     /* Parse a trailing ":readahead=#:" param, if present. */
     ra = file + strlen(file) - 1;
     while (ra >= file) {
         if (parse_state == 0) {
-            if (*ra == ':')
+            if (*ra == ':') {
                 parse_state++;
-            else
+            } else {
                 break;
+            }
         } else if (parse_state == 1) {
             if (*ra > '9' || *ra < '0') {
                 char *opt_start = ra - strlen(RA_OPTSTR) + 1;
@@ -369,29 +364,78 @@ static int curl_open(BlockDriverState *bs, const char *filename,
                     ra_val = ra + 1;
                     ra -= strlen(RA_OPTSTR) - 1;
                     *ra = '\0';
-                    s->readahead_size = atoi(ra_val);
-                    break;
-                } else {
-                    break;
+                    qdict_put(options, "readahead", qstring_from_str(ra_val));
                 }
+                break;
             }
         }
         ra--;
     }
 
+    qdict_put(options, "url", qstring_from_str(file));
+
+    g_free(file);
+}
+
+static QemuOptsList runtime_opts = {
+    .name = "curl",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "url",
+            .type = QEMU_OPT_STRING,
+            .help = "URL to open",
+        },
+        {
+            .name = "readahead",
+            .type = QEMU_OPT_SIZE,
+            .help = "Readahead size",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int curl_open(BlockDriverState *bs, const char *dummy,
+                     QDict *options, int flags)
+{
+    BDRVCURLState *s = bs->opaque;
+    CURLState *state = NULL;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *file;
+    double d;
+
+    static int inited = 0;
+
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        goto out_noclean;
+    }
+
+    s->readahead_size = qemu_opt_get_size(opts, "readahead", READ_AHEAD_SIZE);
     if ((s->readahead_size & 0x1ff) != 0) {
         fprintf(stderr, "HTTP_READAHEAD_SIZE %zd is not a multiple of 512\n",
                 s->readahead_size);
         goto out_noclean;
     }
 
+    file = qemu_opt_get(opts, "url");
+    if (file == NULL) {
+        qerror_report(ERROR_CLASS_GENERIC_ERROR, "curl block driver requires "
+                      "an 'url' option");
+        goto out_noclean;
+    }
+
     if (!inited) {
         curl_global_init(CURL_GLOBAL_ALL);
         inited = 1;
     }
 
     DPRINTF("CURL: Opening %s\n", file);
-    s->url = file;
+    s->url = g_strdup(file);
     state = curl_init_state(s);
     if (!state)
         goto out_noclean;
@@ -423,6 +467,7 @@ static int curl_open(BlockDriverState *bs, const char *filename,
     curl_multi_setopt( s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb ); 
     curl_multi_do(s);
 
+    qemu_opts_del(opts);
     return 0;
 
 out:
@@ -430,7 +475,8 @@ out:
     curl_easy_cleanup(state->curl);
     state->curl = NULL;
 out_noclean:
-    g_free(file);
+    g_free(s->url);
+    qemu_opts_del(opts);
     return -EINVAL;
 }
 
@@ -568,63 +614,68 @@ static int64_t curl_getlength(BlockDriverState *bs)
 }
 
 static BlockDriver bdrv_http = {
-    .format_name     = "http",
-    .protocol_name   = "http",
+    .format_name            = "http",
+    .protocol_name          = "http",
 
-    .instance_size   = sizeof(BDRVCURLState),
-    .bdrv_file_open  = curl_open,
-    .bdrv_close      = curl_close,
-    .bdrv_getlength  = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,
 
-    .bdrv_aio_readv  = curl_aio_readv,
+    .bdrv_aio_readv         = curl_aio_readv,
 };
 
 static BlockDriver bdrv_https = {
-    .format_name     = "https",
-    .protocol_name   = "https",
+    .format_name            = "https",
+    .protocol_name          = "https",
 
-    .instance_size   = sizeof(BDRVCURLState),
-    .bdrv_file_open  = curl_open,
-    .bdrv_close      = curl_close,
-    .bdrv_getlength  = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,
 
-    .bdrv_aio_readv  = curl_aio_readv,
+    .bdrv_aio_readv         = curl_aio_readv,
 };
 
 static BlockDriver bdrv_ftp = {
-    .format_name     = "ftp",
-    .protocol_name   = "ftp",
+    .format_name            = "ftp",
+    .protocol_name          = "ftp",
 
-    .instance_size   = sizeof(BDRVCURLState),
-    .bdrv_file_open  = curl_open,
-    .bdrv_close      = curl_close,
-    .bdrv_getlength  = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,
 
-    .bdrv_aio_readv  = curl_aio_readv,
+    .bdrv_aio_readv         = curl_aio_readv,
 };
 
 static BlockDriver bdrv_ftps = {
-    .format_name     = "ftps",
-    .protocol_name   = "ftps",
+    .format_name            = "ftps",
+    .protocol_name          = "ftps",
 
-    .instance_size   = sizeof(BDRVCURLState),
-    .bdrv_file_open  = curl_open,
-    .bdrv_close      = curl_close,
-    .bdrv_getlength  = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,
 
-    .bdrv_aio_readv  = curl_aio_readv,
+    .bdrv_aio_readv         = curl_aio_readv,
 };
 
 static BlockDriver bdrv_tftp = {
-    .format_name     = "tftp",
-    .protocol_name   = "tftp",
+    .format_name            = "tftp",
+    .protocol_name          = "tftp",
 
-    .instance_size   = sizeof(BDRVCURLState),
-    .bdrv_file_open  = curl_open,
-    .bdrv_close      = curl_close,
-    .bdrv_getlength  = curl_getlength,
+    .instance_size          = sizeof(BDRVCURLState),
+    .bdrv_parse_filename    = curl_parse_filename,
+    .bdrv_file_open         = curl_open,
+    .bdrv_close             = curl_close,
+    .bdrv_getlength         = curl_getlength,
 
-    .bdrv_aio_readv  = curl_aio_readv,
+    .bdrv_aio_readv         = curl_aio_readv,
 };
 
 static void curl_block_init(void)
commit 16c790926b0dda0535187a82d1b00fde19580571
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Apr 10 14:40:28 2013 +0200

    blkverify: Use bdrv_open options instead of filename
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/blkverify.c b/block/blkverify.c
index 59e3b05..d63158f 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -69,44 +69,101 @@ static void GCC_FMT_ATTR(2, 3) blkverify_err(BlkverifyAIOCB *acb,
 }
 
 /* Valid blkverify filenames look like blkverify:path/to/raw_image:path/to/image */
-static int blkverify_open(BlockDriverState *bs, const char *filename,
-                          QDict *options, int flags)
+static void blkverify_parse_filename(const char *filename, QDict *options,
+                                     Error **errp)
 {
-    BDRVBlkverifyState *s = bs->opaque;
-    int ret;
-    char *raw, *c;
+    const char *c;
+    QString *raw_path;
+
 
     /* Parse the blkverify: prefix */
-    if (strncmp(filename, "blkverify:", strlen("blkverify:"))) {
-        return -EINVAL;
+    if (!strstart(filename, "blkverify:", &filename)) {
+        error_setg(errp, "File name string must start with 'blkverify:'");
+        return;
     }
-    filename += strlen("blkverify:");
 
     /* Parse the raw image filename */
     c = strchr(filename, ':');
     if (c == NULL) {
-        return -EINVAL;
+        error_setg(errp, "blkverify requires raw copy and original image path");
+        return;
+    }
+
+    /* TODO Implement option pass-through and set raw.filename here */
+    raw_path = qstring_from_substr(filename, 0, c - filename - 1);
+    qdict_put(options, "x-raw", raw_path);
+
+    /* TODO Allow multi-level nesting and set file.filename here */
+    filename = c + 1;
+    qdict_put(options, "x-image", qstring_from_str(filename));
+}
+
+static QemuOptsList runtime_opts = {
+    .name = "blkverify",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "x-raw",
+            .type = QEMU_OPT_STRING,
+            .help = "[internal use only, will be removed]",
+        },
+        {
+            .name = "x-image",
+            .type = QEMU_OPT_STRING,
+            .help = "[internal use only, will be removed]",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int blkverify_open(BlockDriverState *bs, const char *dummy,
+                          QDict *options, int flags)
+{
+    BDRVBlkverifyState *s = bs->opaque;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename, *raw;
+    int ret;
+
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    /* Parse the raw image filename */
+    raw = qemu_opt_get(opts, "x-raw");
+    if (raw == NULL) {
+        ret = -EINVAL;
+        goto fail;
     }
 
-    raw = g_strdup(filename);
-    raw[c - filename] = '\0';
     ret = bdrv_file_open(&bs->file, raw, NULL, flags);
-    g_free(raw);
     if (ret < 0) {
-        return ret;
+        goto fail;
     }
-    filename = c + 1;
 
     /* Open the test file */
+    filename = qemu_opt_get(opts, "x-image");
+    if (filename == NULL) {
+        ret = -EINVAL;
+        goto fail;
+    }
+
     s->test_file = bdrv_new("");
     ret = bdrv_open(s->test_file, filename, NULL, flags, NULL);
     if (ret < 0) {
         bdrv_delete(s->test_file);
         s->test_file = NULL;
-        return ret;
+        goto fail;
     }
 
-    return 0;
+    ret = 0;
+fail:
+    return ret;
 }
 
 static void blkverify_close(BlockDriverState *bs)
@@ -344,19 +401,18 @@ static BlockDriverAIOCB *blkverify_aio_flush(BlockDriverState *bs,
 }
 
 static BlockDriver bdrv_blkverify = {
-    .format_name        = "blkverify",
-    .protocol_name      = "blkverify",
-
-    .instance_size      = sizeof(BDRVBlkverifyState),
-
-    .bdrv_getlength     = blkverify_getlength,
-
-    .bdrv_file_open     = blkverify_open,
-    .bdrv_close         = blkverify_close,
-
-    .bdrv_aio_readv     = blkverify_aio_readv,
-    .bdrv_aio_writev    = blkverify_aio_writev,
-    .bdrv_aio_flush     = blkverify_aio_flush,
+    .format_name            = "blkverify",
+    .protocol_name          = "blkverify",
+    .instance_size          = sizeof(BDRVBlkverifyState),
+
+    .bdrv_parse_filename    = blkverify_parse_filename,
+    .bdrv_file_open         = blkverify_open,
+    .bdrv_close             = blkverify_close,
+    .bdrv_getlength         = blkverify_getlength,
+
+    .bdrv_aio_readv         = blkverify_aio_readv,
+    .bdrv_aio_writev        = blkverify_aio_writev,
+    .bdrv_aio_flush         = blkverify_aio_flush,
 };
 
 static void bdrv_blkverify_init(void)
commit f468121290c2f632cb91f7b5e8184101e1ee0ab6
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Apr 10 13:37:33 2013 +0200

    blkdebug: Use bdrv_open options instead of filename
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/blkdebug.c b/block/blkdebug.c
index 37cfbc7..3d03fcb 100644
--- a/block/blkdebug.c
+++ b/block/blkdebug.c
@@ -273,11 +273,6 @@ static int read_config(BDRVBlkdebugState *s, const char *filename)
     int ret;
     struct add_rule_data d;
 
-    /* Allow usage without config file */
-    if (!*filename) {
-        return 0;
-    }
-
     f = fopen(filename, "r");
     if (f == NULL) {
         return -errno;
@@ -304,44 +299,99 @@ fail:
 }
 
 /* Valid blkdebug filenames look like blkdebug:path/to/config:path/to/image */
-static int blkdebug_open(BlockDriverState *bs, const char *filename,
-                         QDict *options, int flags)
+static void blkdebug_parse_filename(const char *filename, QDict *options,
+                                    Error **errp)
 {
-    BDRVBlkdebugState *s = bs->opaque;
-    int ret;
-    char *config, *c;
+    const char *c;
 
     /* Parse the blkdebug: prefix */
-    if (strncmp(filename, "blkdebug:", strlen("blkdebug:"))) {
-        return -EINVAL;
+    if (!strstart(filename, "blkdebug:", &filename)) {
+        error_setg(errp, "File name string must start with 'blkdebug:'");
+        return;
     }
-    filename += strlen("blkdebug:");
 
-    /* Read rules from config file */
+    /* Parse config file path */
     c = strchr(filename, ':');
     if (c == NULL) {
-        return -EINVAL;
+        error_setg(errp, "blkdebug requires both config file and image path");
+        return;
     }
 
-    config = g_strdup(filename);
-    config[c - filename] = '\0';
-    ret = read_config(s, config);
-    g_free(config);
-    if (ret < 0) {
-        return ret;
+    if (c != filename) {
+        QString *config_path;
+        config_path = qstring_from_substr(filename, 0, c - filename - 1);
+        qdict_put(options, "config", config_path);
     }
+
+    /* TODO Allow multi-level nesting and set file.filename here */
     filename = c + 1;
+    qdict_put(options, "x-image", qstring_from_str(filename));
+}
+
+static QemuOptsList runtime_opts = {
+    .name = "blkdebug",
+    .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+    .desc = {
+        {
+            .name = "config",
+            .type = QEMU_OPT_STRING,
+            .help = "Path to the configuration file",
+        },
+        {
+            .name = "x-image",
+            .type = QEMU_OPT_STRING,
+            .help = "[internal use only, will be removed]",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int blkdebug_open(BlockDriverState *bs, const char *dummy,
+                         QDict *options, int flags)
+{
+    BDRVBlkdebugState *s = bs->opaque;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename, *config;
+    int ret;
+
+    opts = qemu_opts_create_nofail(&runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    /* Read rules from config file */
+    config = qemu_opt_get(opts, "config");
+    if (config) {
+        ret = read_config(s, config);
+        if (ret < 0) {
+            goto fail;
+        }
+    }
 
     /* Set initial state */
     s->state = 1;
 
     /* Open the backing file */
+    filename = qemu_opt_get(opts, "x-image");
+    if (filename == NULL) {
+        ret = -EINVAL;
+        goto fail;
+    }
+
     ret = bdrv_file_open(&bs->file, filename, NULL, flags);
     if (ret < 0) {
-        return ret;
+        goto fail;
     }
 
-    return 0;
+    ret = 0;
+fail:
+    qemu_opts_del(opts);
+    return ret;
 }
 
 static void error_callback_bh(void *opaque)
@@ -569,17 +619,17 @@ static int64_t blkdebug_getlength(BlockDriverState *bs)
 }
 
 static BlockDriver bdrv_blkdebug = {
-    .format_name        = "blkdebug",
-    .protocol_name      = "blkdebug",
-
-    .instance_size      = sizeof(BDRVBlkdebugState),
+    .format_name            = "blkdebug",
+    .protocol_name          = "blkdebug",
+    .instance_size          = sizeof(BDRVBlkdebugState),
 
-    .bdrv_file_open     = blkdebug_open,
-    .bdrv_close         = blkdebug_close,
-    .bdrv_getlength     = blkdebug_getlength,
+    .bdrv_parse_filename    = blkdebug_parse_filename,
+    .bdrv_file_open         = blkdebug_open,
+    .bdrv_close             = blkdebug_close,
+    .bdrv_getlength         = blkdebug_getlength,
 
-    .bdrv_aio_readv     = blkdebug_aio_readv,
-    .bdrv_aio_writev    = blkdebug_aio_writev,
+    .bdrv_aio_readv         = blkdebug_aio_readv,
+    .bdrv_aio_writev        = blkdebug_aio_writev,
 
     .bdrv_debug_event           = blkdebug_debug_event,
     .bdrv_debug_breakpoint      = blkdebug_debug_breakpoint,
commit 8a79380b8ef1b02d2abd705dd026a18863b09020
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Apr 10 11:34:56 2013 +0200

    raw-win32: Use bdrv_open options instead of filename
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/raw-win32.c b/block/raw-win32.c
index ece2f1a..be33cc1 100644
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -221,21 +221,50 @@ static void raw_parse_flags(int flags, int *access_flags, DWORD *overlapped)
     }
 }
 
-static int raw_open(BlockDriverState *bs, const char *filename,
+static QemuOptsList raw_runtime_opts = {
+    .name = "raw",
+    .head = QTAILQ_HEAD_INITIALIZER(raw_runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "File name of the image",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int raw_open(BlockDriverState *bs, const char *unused,
                     QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int access_flags;
     DWORD overlapped;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
+    int ret;
 
     s->type = FTYPE_FILE;
 
+    opts = qemu_opts_create_nofail(&raw_runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
+
     raw_parse_flags(flags, &access_flags, &overlapped);
-    
+
     if ((flags & BDRV_O_NATIVE_AIO) && aio == NULL) {
         aio = win32_aio_init();
         if (aio == NULL) {
-            return -EINVAL;
+            ret = -EINVAL;
+            goto fail;
         }
     }
 
@@ -245,20 +274,27 @@ static int raw_open(BlockDriverState *bs, const char *filename,
     if (s->hfile == INVALID_HANDLE_VALUE) {
         int err = GetLastError();
 
-        if (err == ERROR_ACCESS_DENIED)
-            return -EACCES;
-        return -EINVAL;
+        if (err == ERROR_ACCESS_DENIED) {
+            ret = -EACCES;
+        } else {
+            ret = -EINVAL;
+        }
+        goto fail;
     }
 
     if (flags & BDRV_O_NATIVE_AIO) {
-        int ret = win32_aio_attach(aio, s->hfile);
+        ret = win32_aio_attach(aio, s->hfile);
         if (ret < 0) {
             CloseHandle(s->hfile);
-            return ret;
+            goto fail;
         }
         s->aio = aio;
     }
-    return 0;
+
+    ret = 0;
+fail:
+    qemu_opts_del(opts);
+    return ret;
 }
 
 static BlockDriverAIOCB *raw_aio_readv(BlockDriverState *bs,
@@ -495,13 +531,14 @@ static int hdev_probe_device(const char *filename)
     return 0;
 }
 
-static int hdev_open(BlockDriverState *bs, const char *filename,
+static int hdev_open(BlockDriverState *bs, const char *dummy,
                      QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int access_flags, create_flags;
     DWORD overlapped;
     char device_name[64];
+    const char *filename = qdict_get_str(options, "filename");
 
     if (strstart(filename, "/dev/cdrom", NULL)) {
         if (find_cdrom(device_name, sizeof(device_name)) < 0)
commit c66a615723914405e4307e5f13a28fd6b910150e
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 2 10:47:40 2013 +0200

    raw-posix: Use bdrv_open options instead of filename
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index 99ac869..afd5385 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -262,15 +262,42 @@ error:
 }
 #endif
 
-static int raw_open_common(BlockDriverState *bs, const char *filename,
+static QemuOptsList raw_runtime_opts = {
+    .name = "raw",
+    .head = QTAILQ_HEAD_INITIALIZER(raw_runtime_opts.head),
+    .desc = {
+        {
+            .name = "filename",
+            .type = QEMU_OPT_STRING,
+            .help = "File name of the image",
+        },
+        { /* end of list */ }
+    },
+};
+
+static int raw_open_common(BlockDriverState *bs, QDict *options,
                            int bdrv_flags, int open_flags)
 {
     BDRVRawState *s = bs->opaque;
+    QemuOpts *opts;
+    Error *local_err = NULL;
+    const char *filename;
     int fd, ret;
 
+    opts = qemu_opts_create_nofail(&raw_runtime_opts);
+    qemu_opts_absorb_qdict(opts, options, &local_err);
+    if (error_is_set(&local_err)) {
+        qerror_report_err(local_err);
+        error_free(local_err);
+        ret = -EINVAL;
+        goto fail;
+    }
+
+    filename = qemu_opt_get(opts, "filename");
+
     ret = raw_normalize_devicepath(&filename);
     if (ret != 0) {
-        return ret;
+        goto fail;
     }
 
     s->open_flags = open_flags;
@@ -280,16 +307,18 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
     fd = qemu_open(filename, s->open_flags, 0644);
     if (fd < 0) {
         ret = -errno;
-        if (ret == -EROFS)
+        if (ret == -EROFS) {
             ret = -EACCES;
-        return ret;
+        }
+        goto fail;
     }
     s->fd = fd;
 
 #ifdef CONFIG_LINUX_AIO
     if (raw_set_aio(&s->aio_ctx, &s->use_aio, bdrv_flags)) {
         qemu_close(fd);
-        return -errno;
+        ret = -errno;
+        goto fail;
     }
 #endif
 
@@ -300,7 +329,10 @@ static int raw_open_common(BlockDriverState *bs, const char *filename,
     }
 #endif
 
-    return 0;
+    ret = 0;
+fail:
+    qemu_opts_del(opts);
+    return ret;
 }
 
 static int raw_open(BlockDriverState *bs, const char *filename,
@@ -309,7 +341,7 @@ static int raw_open(BlockDriverState *bs, const char *filename,
     BDRVRawState *s = bs->opaque;
 
     s->type = FTYPE_FILE;
-    return raw_open_common(bs, filename, flags, 0);
+    return raw_open_common(bs, options, flags, 0);
 }
 
 static int raw_reopen_prepare(BDRVReopenState *state,
@@ -1293,11 +1325,12 @@ static int check_hdev_writable(BDRVRawState *s)
     return 0;
 }
 
-static int hdev_open(BlockDriverState *bs, const char *filename,
+static int hdev_open(BlockDriverState *bs, const char *dummy,
                      QDict *options, int flags)
 {
     BDRVRawState *s = bs->opaque;
     int ret;
+    const char *filename = qdict_get_str(options, "filename");
 
 #if defined(__APPLE__) && defined(__MACH__)
     if (strstart(filename, "/dev/cdrom", NULL)) {
@@ -1338,7 +1371,7 @@ static int hdev_open(BlockDriverState *bs, const char *filename,
     }
 #endif
 
-    ret = raw_open_common(bs, filename, flags, 0);
+    ret = raw_open_common(bs, options, flags, 0);
     if (ret < 0) {
         return ret;
     }
@@ -1541,7 +1574,7 @@ static int floppy_open(BlockDriverState *bs, const char *filename,
     s->type = FTYPE_FD;
 
     /* open will not fail even if no floppy is inserted, so add O_NONBLOCK */
-    ret = raw_open_common(bs, filename, flags, O_NONBLOCK);
+    ret = raw_open_common(bs, options, flags, O_NONBLOCK);
     if (ret)
         return ret;
 
@@ -1663,7 +1696,7 @@ static int cdrom_open(BlockDriverState *bs, const char *filename,
     s->type = FTYPE_CD;
 
     /* open will not fail even if no CD is inserted, so add O_NONBLOCK */
-    return raw_open_common(bs, filename, flags, O_NONBLOCK);
+    return raw_open_common(bs, options, flags, O_NONBLOCK);
 }
 
 static int cdrom_probe_device(const char *filename)
@@ -1772,7 +1805,7 @@ static int cdrom_open(BlockDriverState *bs, const char *filename,
 
     s->type = FTYPE_CD;
 
-    ret = raw_open_common(bs, filename, flags, 0);
+    ret = raw_open_common(bs, options, flags, 0);
     if (ret)
         return ret;
 
commit 035fccdf7993a5b9a40f9dec22a663d4d6edb36b
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 9 14:34:19 2013 +0200

    block: Enable filename option
    
    This allows using the file.filename option instead of the string that
    comes from -drive file=... and is passed around as a separate parameter.
    The goal is to get rid of this parameter and use the options QDict more
    consistently.
    
    With this option you can access not only the top-level image, but
    specify a filename for the backing file (currently only if no backing
    file exists, but we'll allow overriding it later)
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index f717e1a..e3464d6 100644
--- a/block.c
+++ b/block.c
@@ -667,10 +667,10 @@ static int bdrv_open_flags(BlockDriverState *bs, int flags)
  * Removes all processed options from *options.
  */
 static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
-    const char *filename, QDict *options,
-    int flags, BlockDriver *drv)
+    QDict *options, int flags, BlockDriver *drv)
 {
     int ret, open_flags;
+    const char *filename;
 
     assert(drv != NULL);
     assert(bs->file == NULL);
@@ -698,6 +698,12 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
         bdrv_enable_copy_on_read(bs);
     }
 
+    if (file != NULL) {
+        filename = file->filename;
+    } else {
+        filename = qdict_get_try_str(options, "filename");
+    }
+
     if (filename != NULL) {
         pstrcpy(bs->filename, sizeof(bs->filename), filename);
     } else {
@@ -780,6 +786,18 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
     bs->options = options;
     options = qdict_clone_shallow(options);
 
+    /* Fetch the file name from the options QDict if necessary */
+    if (!filename) {
+        filename = qdict_get_try_str(options, "filename");
+    } else if (filename && !qdict_haskey(options, "filename")) {
+        qdict_put(options, "filename", qstring_from_str(filename));
+    } else {
+        qerror_report(ERROR_CLASS_GENERIC_ERROR, "Can't specify 'file' and "
+                      "'filename' options at the same time");
+        ret = -EINVAL;
+        goto fail;
+    }
+
     /* Find the right block driver */
     drvname = qdict_get_try_str(options, "driver");
     if (drvname) {
@@ -816,11 +834,16 @@ int bdrv_file_open(BlockDriverState **pbs, const char *filename,
         goto fail;
     }
 
-    ret = bdrv_open_common(bs, NULL, filename, options, flags, drv);
+    ret = bdrv_open_common(bs, NULL, options, flags, drv);
     if (ret < 0) {
         goto fail;
     }
 
+    /* TODO Remove once all protocols know the filename option */
+    if (qdict_haskey(options, "filename")) {
+        qdict_del(options, "filename");
+    }
+
     /* Check if any unknown options were used */
     if (qdict_size(options) != 0) {
         const QDictEntry *entry = qdict_first(options);
@@ -1031,7 +1054,7 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
     }
 
     /* Open the image */
-    ret = bdrv_open_common(bs, file, filename, options, flags, drv);
+    ret = bdrv_open_common(bs, file, options, flags, drv);
     if (ret < 0) {
         goto unlink_and_fail;
     }
commit 31ca6d077c24b7aaa322d8930e3e5debbdb4a047
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Thu Mar 28 15:29:24 2013 +0100

    block: Add driver-specific options for backing files
    
    Options starting in "backing." are passed to the backing file now. If
    you don't need to specify the filename for the backing file, you can add
    it on the command line instead of in the image file:
    
    $ qemu-nbd -t /tmp/test.img
    $ qemu-img create -f qcow2 empty.qcow2 1G
    $ qemu-system-x86_64 -drive file=empty.qcow2,backing.file.driver=nbd,\
        backing.file.host=localhost
    
    Note that this doesn't override the backing filename from the image. If
    the image has one, this will fail because NBD doesn't want the options
    and a filename at the same time.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/block.c b/block.c
index bea47c4..f717e1a 100644
--- a/block.c
+++ b/block.c
@@ -845,18 +845,33 @@ fail:
     return ret;
 }
 
-int bdrv_open_backing_file(BlockDriverState *bs)
+/*
+ * Opens the backing file for a BlockDriverState if not yet open
+ *
+ * options is a QDict of options to pass to the block drivers, or NULL for an
+ * empty set of options. The reference to the QDict is transferred to this
+ * function (even on failure), so if the caller intends to reuse the dictionary,
+ * it needs to use QINCREF() before calling bdrv_file_open.
+ */
+int bdrv_open_backing_file(BlockDriverState *bs, QDict *options)
 {
     char backing_filename[PATH_MAX];
     int back_flags, ret;
     BlockDriver *back_drv = NULL;
 
     if (bs->backing_hd != NULL) {
+        QDECREF(options);
         return 0;
     }
 
+    /* NULL means an empty set of options */
+    if (options == NULL) {
+        options = qdict_new();
+    }
+
     bs->open_flags &= ~BDRV_O_NO_BACKING;
-    if (bs->backing_file[0] == '\0') {
+    if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
+        QDECREF(options);
         return 0;
     }
 
@@ -871,7 +886,8 @@ int bdrv_open_backing_file(BlockDriverState *bs)
     /* backing files always opened read-only */
     back_flags = bs->open_flags & ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT);
 
-    ret = bdrv_open(bs->backing_hd, backing_filename, NULL,
+    ret = bdrv_open(bs->backing_hd,
+                    *backing_filename ? backing_filename : NULL, options,
                     back_flags, back_drv);
     if (ret < 0) {
         bdrv_delete(bs->backing_hd);
@@ -1027,7 +1043,10 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
 
     /* If there is a backing file, use it */
     if ((flags & BDRV_O_NO_BACKING) == 0) {
-        ret = bdrv_open_backing_file(bs);
+        QDict *backing_options;
+
+        extract_subqdict(options, &backing_options, "backing.");
+        ret = bdrv_open_backing_file(bs, backing_options);
         if (ret < 0) {
             goto close_and_fail;
         }
diff --git a/block/mirror.c b/block/mirror.c
index a62ad86..8b07dec 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -507,7 +507,7 @@ static void mirror_complete(BlockJob *job, Error **errp)
     MirrorBlockJob *s = container_of(job, MirrorBlockJob, common);
     int ret;
 
-    ret = bdrv_open_backing_file(s->target);
+    ret = bdrv_open_backing_file(s->target, NULL);
     if (ret < 0) {
         char backing_filename[PATH_MAX];
         bdrv_get_full_backing_filename(s->target, backing_filename,
diff --git a/include/block/block.h b/include/block/block.h
index ebd9512..1251c5c 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -137,7 +137,7 @@ int bdrv_parse_cache_flags(const char *mode, int *flags);
 int bdrv_parse_discard_flags(const char *mode, int *flags);
 int bdrv_file_open(BlockDriverState **pbs, const char *filename,
                    QDict *options, int flags);
-int bdrv_open_backing_file(BlockDriverState *bs);
+int bdrv_open_backing_file(BlockDriverState *bs, QDict *options);
 int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
               int flags, BlockDriver *drv);
 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
commit 2af5ef70af9fdc823407ddc4ae14766806d4837a
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 9 13:19:18 2013 +0200

    block: Fail gracefully when using a format driver on protocol level
    
    Specifying the wrong driver could fail an assertion:
    
    $ qemu-system-x86_64 -drive file.driver=qcow2,file=x
    qemu-system-x86_64: block.c:721: bdrv_open_common: Assertion `file !=
    ((void *)0)' failed.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block.c b/block.c
index 4ad663d..bea47c4 100644
--- a/block.c
+++ b/block.c
@@ -718,6 +718,13 @@ static int bdrv_open_common(BlockDriverState *bs, BlockDriverState *file,
         assert(drv->bdrv_parse_filename || filename != NULL);
         ret = drv->bdrv_file_open(bs, filename, options, open_flags);
     } else {
+        if (file == NULL) {
+            qerror_report(ERROR_CLASS_GENERIC_ERROR, "Can't use '%s' as a "
+                          "block driver for the protocol level",
+                          drv->format_name);
+            ret = -EINVAL;
+            goto free_and_fail;
+        }
         assert(file != NULL);
         bs->file = file;
         ret = drv->bdrv_open(bs, options, open_flags);
diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 8b51de3..8039e23 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -142,6 +142,13 @@ run_qemu -drive media=cdrom,cache=writethrough
 run_qemu -drive media=cdrom,cache=unsafe
 run_qemu -drive media=cdrom,cache=invalid_value
 
+echo
+echo === Specifying the protocol layer ===
+echo
+
+run_qemu -drive file=$TEST_IMG,file.driver=file
+run_qemu -drive file=$TEST_IMG,file.driver=qcow2
+
 # success, all done
 echo "*** done"
 rm -f $seq.full
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 48456d5..3d1ac7b 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -159,4 +159,14 @@ qququiquit
 Testing: -drive media=cdrom,cache=invalid_value
 QEMU_PROG: -drive media=cdrom,cache=invalid_value: invalid cache option
 
+
+=== Specifying the protocol layer ===
+
+Testing: -drive file=TEST_DIR/t.qcow2,file.driver=file
+qququiquit
+
+Testing: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2: Can't use 'qcow2' as a block driver for the protocol level
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,file.driver=qcow2: could not open disk image TEST_DIR/t.qcow2: Invalid argument
+
 *** done
commit bdda92324dad963e85589e9ea74b2f2620319304
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Tue Apr 16 11:22:36 2013 +0200

    qemu-iotests: Fix _filter_qemu
    
    $QEMU_PROG happens to be 'qemu' in my setup, so this sed command
    replaces a bit too much. Restrict it to the start of the line and to
    when it's followed by a colon, i.e. the form used by error messages.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index bc5f250..dcf6391 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -155,7 +155,7 @@ _filter_qemu_io()
 # replace occurrences of QEMU_PROG with "qemu"
 _filter_qemu()
 {
-    sed -e "s#$(basename $QEMU_PROG)#QEMU_PROG#g"
+    sed -e "s#^$(basename $QEMU_PROG):#QEMU_PROG:#"
 }
 
 # make sure this script returns success
commit 54f106d5fd51fcf385bab2ddf125477e83758038
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 17:17:33 2013 +0200

    qemu-img: do not zero-pad the compressed write buffer
    
    bdrv_write_compressed() does not allow requests that span the end of the
    device.  Therefore it is useless to zero-pad the last cluster and
    thereby exceed the end of the device.
    
    Let image formats handle zero-padding the final compressed cluster, if
    necessary.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/qemu-img.c b/qemu-img.c
index 31627b0..cd096a1 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1425,12 +1425,8 @@ static int img_convert(int argc, char **argv)
             }
             assert (remainder == 0);
 
-            if (n < cluster_sectors) {
-                memset(buf + n * 512, 0, cluster_size - n * 512);
-            }
-            if (!buffer_is_zero(buf, cluster_size)) {
-                ret = bdrv_write_compressed(out_bs, sector_num, buf,
-                                            cluster_sectors);
+            if (!buffer_is_zero(buf, n * BDRV_SECTOR_SIZE)) {
+                ret = bdrv_write_compressed(out_bs, sector_num, buf, n);
                 if (ret != 0) {
                     error_report("error while compressing sector %" PRId64
                                  ": %s", sector_num, strerror(-ret));
commit 16b3c5cd9f27678bc9d6707664640653b47533b9
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 17:17:32 2013 +0200

    qcow: allow sub-cluster compressed write to last cluster
    
    Compression in qcow requires image length to be a multiple of the
    cluster size.  Lift this requirement by zero-padding the final cluster
    when necessary.  The virtual disk size is still not cluster-aligned, so
    the guest cannot access the zero sectors.
    
    Note that this is almost identical to the qcow2 version of this code.
    qcow2's compression code is drawn from qcow.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow.c b/block/qcow.c
index 3278e55..e2a64c7 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -787,8 +787,21 @@ static int qcow_write_compressed(BlockDriverState *bs, int64_t sector_num,
     uint8_t *out_buf;
     uint64_t cluster_offset;
 
-    if (nb_sectors != s->cluster_sectors)
-        return -EINVAL;
+    if (nb_sectors != s->cluster_sectors) {
+        ret = -EINVAL;
+
+        /* Zero-pad last write if image size is not cluster aligned */
+        if (sector_num + nb_sectors == bs->total_sectors &&
+            nb_sectors < s->cluster_sectors) {
+            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
+            memset(pad_buf, 0, s->cluster_size);
+            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
+            ret = qcow_write_compressed(bs, sector_num,
+                                        pad_buf, s->cluster_sectors);
+            qemu_vfree(pad_buf);
+        }
+        return ret;
+    }
 
     out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
 
commit f4d38bef7cc79018e2aa789b0e4c23c3a8cdfca5
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 17:17:31 2013 +0200

    qcow2: allow sub-cluster compressed write to last cluster
    
    Compression in qcow2 requires image length to be a multiple of the
    cluster size.  Lift this requirement by zero-padding the final cluster
    when necessary.  The virtual disk size is still not cluster-aligned, so
    the guest cannot access the zero sectors.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2.c b/block/qcow2.c
index e8934de..2e346d8 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -1537,8 +1537,21 @@ static int qcow2_write_compressed(BlockDriverState *bs, int64_t sector_num,
         return 0;
     }
 
-    if (nb_sectors != s->cluster_sectors)
-        return -EINVAL;
+    if (nb_sectors != s->cluster_sectors) {
+        ret = -EINVAL;
+
+        /* Zero-pad last write if image size is not cluster aligned */
+        if (sector_num + nb_sectors == bs->total_sectors &&
+            nb_sectors < s->cluster_sectors) {
+            uint8_t *pad_buf = qemu_blockalign(bs, s->cluster_size);
+            memset(pad_buf, 0, s->cluster_size);
+            memcpy(pad_buf, buf, nb_sectors * BDRV_SECTOR_SIZE);
+            ret = qcow2_write_compressed(bs, sector_num,
+                                         pad_buf, s->cluster_sectors);
+            qemu_vfree(pad_buf);
+        }
+        return ret;
+    }
 
     out_buf = g_malloc(s->cluster_size + (s->cluster_size / 1000) + 128);
 
commit 68c0aa6e02f79f8825c0c5dc4c7ed25d524aaa8b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Apr 17 09:16:35 2013 +0000

    ui/cocoa.m: Fix recent compile breakage
    
    Fix failures to compile introduced by recent console commits
    1dbfa00503, 81c0d5a6) which removed is_graphic_console() and
    vga_hw_update() without updating the cocoa UI backend to match.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/ui/cocoa.m b/ui/cocoa.m
index 048cc97..d51462a 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -495,7 +495,7 @@ QemuCocoaView *cocoaView;
                 if (keycode == 58 || keycode == 69) { // emulate caps lock and num lock keydown and keyup
                     kbd_put_keycode(keycode);
                     kbd_put_keycode(keycode | 0x80);
-                } else if (is_graphic_console()) {
+                } else if (qemu_console_is_graphic(NULL)) {
                     if (keycode & 0x80)
                         kbd_put_keycode(0xe0);
                     if (modifiers_state[keycode] == 0) { // keydown
@@ -535,7 +535,7 @@ QemuCocoaView *cocoaView;
                 }
 
             // handle keys for graphic console
-            } else if (is_graphic_console()) {
+            } else if (qemu_console_is_graphic(NULL)) {
                 if (keycode & 0x80) //check bit for e0 in front
                     kbd_put_keycode(0xe0);
                 kbd_put_keycode(keycode & 0x7f); //remove e0 bit in front
@@ -578,7 +578,7 @@ QemuCocoaView *cocoaView;
             break;
         case NSKeyUp:
             keycode = cocoa_keycode_to_qemu([event keyCode]);
-            if (is_graphic_console()) {
+            if (qemu_console_is_graphic(NULL)) {
                 if (keycode & 0x80)
                     kbd_put_keycode(0xe0);
                 kbd_put_keycode(keycode | 0x80); //add 128 to signal release of key
@@ -1006,7 +1006,7 @@ static void cocoa_refresh(DisplayChangeListener *dcl)
             [cocoaView handleEvent:event];
         }
     } while(event != nil);
-    vga_hw_update();
+    graphic_hw_update(NULL);
 }
 
 static void cocoa_cleanup(void)
commit 089305ac0a273e64c9a5655d26da7fe19ecee66f
Author: Pavel Dovgaluk <Pavel.Dovgaluk at ispras.ru>
Date:   Mon Apr 15 10:59:15 2013 +0400

    i386 ROR r8/r16 instruction fix
    
    Fixed EFLAGS corruption by ROR r8/r16 instruction located at the end of the TB.
    
    Signed-off-by: Pavel Dovgalyuk <pavel.dovgaluk at gmail.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Aurelien Jarno <aurelien at aurel32.net>

diff --git a/target-i386/translate.c b/target-i386/translate.c
index 233f24f..40f891d 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -1775,6 +1775,7 @@ static void gen_rot_rm_T1(DisasContext *s, int ot, int op1, int is_right)
     if (is_right) {
         tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask - 1);
         tcg_gen_shri_tl(cpu_cc_dst, cpu_T[0], mask);
+        tcg_gen_andi_tl(cpu_cc_dst, cpu_cc_dst, 1);
     } else {
         tcg_gen_shri_tl(cpu_cc_src2, cpu_T[0], mask);
         tcg_gen_andi_tl(cpu_cc_dst, cpu_T[0], 1);
commit 21e5181f9552e3a876b488c77dc5cfeccff66414
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Sat Apr 20 14:48:28 2013 +0100

    qdev: Drop taddr properties
    
    Drop all the infrastructure for taddr properties (ie ones which
    are 'hwaddr' sized). These are now unused, and any further desired
    use would be rather questionable since device properties shouldn't
    generally depend on a type that is conceptually variable based on
    the target CPU. 32 or 64 bit integer properties should be used instead
    as appropriate for the specific device.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index 1ed874f..f1f1fd7 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -33,7 +33,6 @@
 #include "qemu/timer.h"
 #include "hw/isa/isa.h"
 #include "hw/sysbus.h"
-#include "hw/qdev-addr.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
 #include "qemu/log.h"
diff --git a/hw/core/Makefile.objs b/hw/core/Makefile.objs
index 94109f3..950146c 100644
--- a/hw/core/Makefile.objs
+++ b/hw/core/Makefile.objs
@@ -9,6 +9,5 @@ common-obj-$(CONFIG_PTIMER) += ptimer.o
 common-obj-$(CONFIG_SOFTMMU) += sysbus.o
 common-obj-$(CONFIG_SOFTMMU) += null-machine.o
 common-obj-$(CONFIG_SOFTMMU) += loader.o
-common-obj-$(CONFIG_SOFTMMU) += qdev-addr.o
 common-obj-$(CONFIG_SOFTMMU) += qdev-properties-system.o
 
diff --git a/hw/core/qdev-addr.c b/hw/core/qdev-addr.c
deleted file mode 100644
index 80a38bb..0000000
--- a/hw/core/qdev-addr.c
+++ /dev/null
@@ -1,78 +0,0 @@
-#include "hw/qdev.h"
-#include "hw/qdev-addr.h"
-#include "exec/hwaddr.h"
-#include "qapi/qmp/qerror.h"
-#include "qapi/visitor.h"
-
-/* --- target physical address --- */
-
-static int parse_taddr(DeviceState *dev, Property *prop, const char *str)
-{
-    hwaddr *ptr = qdev_get_prop_ptr(dev, prop);
-
-    *ptr = strtoull(str, NULL, 16);
-    return 0;
-}
-
-static int print_taddr(DeviceState *dev, Property *prop, char *dest, size_t len)
-{
-    hwaddr *ptr = qdev_get_prop_ptr(dev, prop);
-    return snprintf(dest, len, "0x" TARGET_FMT_plx, *ptr);
-}
-
-static void get_taddr(Object *obj, Visitor *v, void *opaque,
-                      const char *name, Error **errp)
-{
-    DeviceState *dev = DEVICE(obj);
-    Property *prop = opaque;
-    hwaddr *ptr = qdev_get_prop_ptr(dev, prop);
-    int64_t value;
-
-    value = *ptr;
-    visit_type_int64(v, &value, name, errp);
-}
-
-static void set_taddr(Object *obj, Visitor *v, void *opaque,
-                      const char *name, Error **errp)
-{
-    DeviceState *dev = DEVICE(obj);
-    Property *prop = opaque;
-    hwaddr *ptr = qdev_get_prop_ptr(dev, prop);
-    Error *local_err = NULL;
-    int64_t value;
-
-    if (dev->realized) {
-        qdev_prop_set_after_realize(dev, name, errp);
-        return;
-    }
-
-    visit_type_int64(v, &value, name, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-    if ((uint64_t)value <= (uint64_t) ~(hwaddr)0) {
-        *ptr = value;
-    } else {
-        error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
-                  dev->id?:"", name, value, (uint64_t) 0,
-                  (uint64_t) ~(hwaddr)0);
-    }
-}
-
-
-PropertyInfo qdev_prop_taddr = {
-    .name  = "taddr",
-    .parse = parse_taddr,
-    .print = print_taddr,
-    .get   = get_taddr,
-    .set   = set_taddr,
-};
-
-void qdev_prop_set_taddr(DeviceState *dev, const char *name, hwaddr value)
-{
-    Error *errp = NULL;
-    object_property_set_int(OBJECT(dev), value, name, &errp);
-    assert(!errp);
-
-}
diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index fc5e539..916816f 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -28,7 +28,6 @@
 #include "ui/console.h"
 #include "hw/devices.h"
 #include "hw/sysbus.h"
-#include "hw/qdev-addr.h"
 #include "qemu/range.h"
 #include "ui/pixel_ops.h"
 
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 77c7191..d7465c6 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -26,7 +26,6 @@
 #include "ui/console.h"
 #include "ui/pixel_ops.h"
 #include "hw/sysbus.h"
-#include "hw/qdev-addr.h"
 
 #define MAXX 1024
 #define MAXY 768
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index bc62664..3a3ef8a 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -26,7 +26,6 @@
 #include "qemu/timer.h"
 #include "hw/ptimer.h"
 #include "qemu/log.h"
-#include "hw/qdev-addr.h"
 #include "qapi/qmp/qerror.h"
 
 #include "hw/stream.h"
diff --git a/hw/lm32/milkymist-hw.h b/hw/lm32/milkymist-hw.h
index 4e86c4e..5317ce6 100644
--- a/hw/lm32/milkymist-hw.h
+++ b/hw/lm32/milkymist-hw.h
@@ -2,7 +2,6 @@
 #define QEMU_HW_MILKYMIST_H
 
 #include "hw/qdev.h"
-#include "hw/qdev-addr.h"
 #include "net/net.h"
 
 static inline DeviceState *milkymist_uart_create(hwaddr base,
diff --git a/hw/net/milkymist-minimac2.c b/hw/net/milkymist-minimac2.c
index 29618e8..4ef6318 100644
--- a/hw/net/milkymist-minimac2.c
+++ b/hw/net/milkymist-minimac2.c
@@ -27,7 +27,6 @@
 #include "trace.h"
 #include "net/net.h"
 #include "qemu/error-report.h"
-#include "hw/qdev-addr.h"
 
 #include <zlib.h>
 
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 31beb32..635115f 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -37,7 +37,6 @@
 #include "hw/nvram/fw_cfg.h"
 #include "hw/char/escc.h"
 #include "hw/empty_slot.h"
-#include "hw/qdev-addr.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/blockdev.h"
diff --git a/include/hw/qdev-addr.h b/include/hw/qdev-addr.h
deleted file mode 100644
index 79708e6..0000000
--- a/include/hw/qdev-addr.h
+++ /dev/null
@@ -1,10 +0,0 @@
-#ifndef HW_QDEV_ADDR_H
-#define HW_QDEV_ADDR_H 1
-
-#define DEFINE_PROP_TADDR(_n, _s, _f, _d)                               \
-    DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_taddr, hwaddr)
-
-extern PropertyInfo qdev_prop_taddr;
-void qdev_prop_set_taddr(DeviceState *dev, const char *name, hwaddr value);
-
-#endif
commit 19298eca060036c3697b0fd9ae77a3ba715cc9c5
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Sat Apr 20 14:48:27 2013 +0100

    hw/sm501: Use correct setter for sysbus-ohci dma-address property
    
    The sysbus-ohci dma-address property is declared as a HEX64
    property, not a TADDR, so use the correct setter for it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Andreas Färber <afaerber at suse.de>
    Tested-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Blue Swirl <blauwirbel at gmail.com>

diff --git a/hw/display/sm501.c b/hw/display/sm501.c
index f0e6d70..fc5e539 100644
--- a/hw/display/sm501.c
+++ b/hw/display/sm501.c
@@ -1434,7 +1434,7 @@ void sm501_init(MemoryRegion *address_space_mem, uint32_t base,
     /* bridge to usb host emulation module */
     dev = qdev_create(NULL, "sysbus-ohci");
     qdev_prop_set_uint32(dev, "num-ports", 2);
-    qdev_prop_set_taddr(dev, "dma-offset", base);
+    qdev_prop_set_uint64(dev, "dma-offset", base);
     qdev_init_nofail(dev);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0,
                     base + MMIO_BASE_OFFSET + SM501_USB_HOST);
commit f4374c82b158b36bd40a5055bffa60796569a300
Merge: 32370db af9277e
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 20 11:39:08 2013 +0000

    Merge branch 'arm-devs.next' of git://git.linaro.org/people/pmaydell/qemu-arm
    
    * 'arm-devs.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
      hw/versatile_pci: Drop unnecessary vpb_pci_config_addr()
      versatile_pci: Expose PCI memory space to system
      arm/realview: Fix mapping of PCI regions
      versatile_pci: Implement the PCI controller's control registers
      versatile_pci: Implement the correct PCI IRQ mapping
      versatile_pci: Put the host bridge PCI device at slot 29
      versatile_pci: Use separate PCI I/O space rather than system I/O space
      versatile_pci: Change to subclassing TYPE_PCI_HOST_BRIDGE
      versatile_pci: Update to realize and instance init functions
      versatile_pci: Expose PCI I/O region on Versatile PB
      versatile_pci: Fix hardcoded tabs

commit 32370db3fb8433259435397c4d60006164c0d198
Merge: 87885c8 e91f229
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 20 11:38:48 2013 +0000

    Merge branch 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm
    
    * 'target-arm.next' of git://git.linaro.org/people/pmaydell/qemu-arm:
      target-arm: Correctly restore FPSCR
      target-arm: Add some missing CPU state fields to VMState
      target-arm: port ARM CPU save/load to use VMState
      target-arm: Reinsert missing return statement in ARM mode SRS decode

commit 87885c8e57db38669dad2aa1a83577fe95f481be
Merge: f691df5 03903ff
Author: Blue Swirl <blauwirbel at gmail.com>
Date:   Sat Apr 20 11:38:29 2013 +0000

    Merge branch 'linux-user-for-upstream' of git://git.linaro.org/people/rikuvoipio/qemu
    
    * 'linux-user-for-upstream' of git://git.linaro.org/people/rikuvoipio/qemu:
      linux-user: fix setgroups/getgroups for non-UID16 archs
      linux-user: fix undefined shift in copy_to_user_fdset
      linux-user: change do_semop to return target errno when unsuccessful

commit d6e51919a7e3250bbfb4bb0ad0f208ab6fd688a4
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Mar 29 01:08:16 2013 +0000

    vhost-scsi-s390: new device supporting the tcm_vhost Linux kernel module
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Asias He <asias at redhat.com>
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index 8f29b5e..dabbc2e 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -28,6 +28,7 @@
 #include "hw/virtio/virtio-rng.h"
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-net.h"
+#include "hw/virtio/vhost-scsi.h"
 #include "hw/sysbus.h"
 #include "sysemu/kvm.h"
 
@@ -239,6 +240,28 @@ static void s390_virtio_scsi_instance_init(Object *obj)
     object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev), NULL);
 }
 
+#ifdef CONFIG_VHOST_SCSI
+static int s390_vhost_scsi_init(VirtIOS390Device *s390_dev)
+{
+    VHostSCSIS390 *dev = VHOST_SCSI_S390(s390_dev);
+    DeviceState *vdev = DEVICE(&dev->vdev);
+
+    qdev_set_parent_bus(vdev, BUS(&s390_dev->bus));
+    if (qdev_init(vdev) < 0) {
+        return -1;
+    }
+
+    return s390_virtio_device_init(s390_dev, VIRTIO_DEVICE(vdev));
+}
+
+static void s390_vhost_scsi_instance_init(Object *obj)
+{
+    VHostSCSIS390 *dev = VHOST_SCSI_S390(obj);
+    object_initialize(OBJECT(&dev->vdev), TYPE_VHOST_SCSI);
+    object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev), NULL);
+}
+#endif
+
 static int s390_virtio_rng_init(VirtIOS390Device *dev)
 {
     VirtIODevice *vdev;
@@ -582,6 +605,31 @@ static const TypeInfo s390_virtio_scsi = {
     .class_init    = s390_virtio_scsi_class_init,
 };
 
+#ifdef CONFIG_VHOST_SCSI
+static Property s390_vhost_scsi_properties[] = {
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOS390Device, host_features),
+    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSIS390, vdev.parent_obj.conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void s390_vhost_scsi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtIOS390DeviceClass *k = VIRTIO_S390_DEVICE_CLASS(klass);
+
+    k->init = s390_vhost_scsi_init;
+    dc->props = s390_vhost_scsi_properties;
+}
+
+static const TypeInfo s390_vhost_scsi = {
+    .name          = TYPE_VHOST_SCSI_S390,
+    .parent        = TYPE_VIRTIO_S390_DEVICE,
+    .instance_size = sizeof(VHostSCSIS390),
+    .instance_init = s390_vhost_scsi_instance_init,
+    .class_init    = s390_vhost_scsi_class_init,
+};
+#endif
+
 /***************** S390 Virtio Bus Bridge Device *******************/
 /* Only required to have the virtio bus as child in the system bus */
 
@@ -643,6 +691,7 @@ static void s390_virtio_register_types(void)
     type_register_static(&s390_virtio_blk);
     type_register_static(&s390_virtio_net);
     type_register_static(&s390_virtio_scsi);
+    type_register_static(&s390_vhost_scsi);
     type_register_static(&s390_virtio_rng);
     type_register_static(&s390_virtio_bridge_info);
 }
diff --git a/hw/s390x/s390-virtio-bus.h b/hw/s390x/s390-virtio-bus.h
index 925ed2b..d7c47db 100644
--- a/hw/s390x/s390-virtio-bus.h
+++ b/hw/s390x/s390-virtio-bus.h
@@ -25,6 +25,9 @@
 #include "hw/virtio/virtio-serial.h"
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/virtio-bus.h"
+#ifdef CONFIG_VHOST_SCSI
+#include "hw/virtio/vhost-scsi.h"
+#endif
 
 #define VIRTIO_DEV_OFFS_TYPE		0	/* 8 bits */
 #define VIRTIO_DEV_OFFS_NUM_VQ		1	/* 8 bits */
@@ -160,4 +163,17 @@ typedef struct VirtIONetS390 {
     VirtIONet vdev;
 } VirtIONetS390;
 
+/* vhost-scsi-s390 */
+
+#ifdef CONFIG_VHOST_SCSI
+#define TYPE_VHOST_SCSI_S390 "vhost-scsi-s390"
+#define VHOST_SCSI_S390(obj) \
+        OBJECT_CHECK(VHostSCSIS390, (obj), TYPE_VHOST_SCSI_S390)
+
+typedef struct VHostSCSIS390 {
+    VirtIOS390Device parent_obj;
+    VHostSCSI vdev;
+} VHostSCSIS390;
+#endif
+
 #endif
commit ccf6916c843edd30ea4ecfaaac68faa865529c97
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 16:16:50 2013 +0200

    vhost-scsi-ccw: new device supporting the tcm_vhost Linux kernel module
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 5232526..56539d3 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -687,6 +687,28 @@ static void virtio_ccw_scsi_instance_init(Object *obj)
     object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev), NULL);
 }
 
+#ifdef CONFIG_VHOST_SCSI
+static int vhost_ccw_scsi_init(VirtioCcwDevice *ccw_dev)
+{
+    VHostSCSICcw *dev = VHOST_SCSI_CCW(ccw_dev);
+    DeviceState *vdev = DEVICE(&dev->vdev);
+
+    qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus));
+    if (qdev_init(vdev) < 0) {
+        return -1;
+    }
+
+    return virtio_ccw_device_init(ccw_dev, VIRTIO_DEVICE(vdev));
+}
+
+static void vhost_ccw_scsi_instance_init(Object *obj)
+{
+    VHostSCSICcw *dev = VHOST_SCSI_CCW(obj);
+    object_initialize(OBJECT(&dev->vdev), TYPE_VHOST_SCSI);
+    object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev), NULL);
+}
+#endif
+
 static int virtio_ccw_rng_init(VirtioCcwDevice *dev)
 {
     VirtIODevice *vdev;
@@ -897,6 +919,34 @@ static const TypeInfo virtio_ccw_scsi = {
     .class_init    = virtio_ccw_scsi_class_init,
 };
 
+#ifdef CONFIG_VHOST_SCSI
+static Property vhost_ccw_scsi_properties[] = {
+    DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
+    DEFINE_VHOST_SCSI_PROPERTIES(VirtIOSCSICcw, vdev.parent_obj.conf),
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtioCcwDevice, host_features[0]),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_ccw_scsi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtIOCCWDeviceClass *k = VIRTIO_CCW_DEVICE_CLASS(klass);
+
+    k->init = vhost_ccw_scsi_init;
+    k->exit = virtio_ccw_exit;
+    dc->reset = virtio_ccw_reset;
+    dc->props = vhost_ccw_scsi_properties;
+}
+
+static const TypeInfo vhost_ccw_scsi = {
+    .name          = TYPE_VHOST_SCSI_CCW,
+    .parent        = TYPE_VIRTIO_CCW_DEVICE,
+    .instance_size = sizeof(VirtIOSCSICcw),
+    .instance_init = vhost_ccw_scsi_instance_init,
+    .class_init    = vhost_ccw_scsi_class_init,
+};
+#endif
+
 static void virtio_ccw_rng_initfn(Object *obj)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(obj);
@@ -1054,6 +1104,7 @@ static void virtio_ccw_register(void)
     type_register_static(&virtio_ccw_net);
     type_register_static(&virtio_ccw_balloon);
     type_register_static(&virtio_ccw_scsi);
+    type_register_static(&vhost_ccw_scsi);
     type_register_static(&virtio_ccw_rng);
     type_register_static(&virtual_css_bridge_info);
 }
diff --git a/hw/s390x/virtio-ccw.h b/hw/s390x/virtio-ccw.h
index 35ab1a5..84055e7 100644
--- a/hw/s390x/virtio-ccw.h
+++ b/hw/s390x/virtio-ccw.h
@@ -16,6 +16,9 @@
 #include <hw/virtio/virtio-net.h>
 #include <hw/virtio/virtio-serial.h>
 #include <hw/virtio/virtio-scsi.h>
+#ifdef CONFIG_VHOST_SCSI
+#include <hw/virtio/vhost-scsi.h>
+#endif
 #include <hw/virtio/virtio-balloon.h>
 #include <hw/virtio/virtio-rng.h>
 #include <hw/virtio/virtio-bus.h>
@@ -101,6 +104,17 @@ typedef struct VirtIOSCSICcw {
     VirtIOSCSI vdev;
 } VirtIOSCSICcw;
 
+/* vhost-scsi-ccw */
+
+#define TYPE_VHOST_SCSI_CCW "vhost-scsi-ccw"
+#define VHOST_SCSI_CCW(obj) \
+        OBJECT_CHECK(VHostSCSICcw, (obj), TYPE_VHOST_SCSI_CCW)
+
+typedef struct VHostSCSICcw {
+    VirtioCcwDevice parent_obj;
+    VHostSCSI vdev;
+} VHostSCSICcw;
+
 /* virtio-blk-ccw */
 
 #define TYPE_VIRTIO_BLK_CCW "virtio-blk-ccw"
commit 50787628ee343d3c149eb35c206b68429d1cfdf4
Author: Nicholas Bellinger <nab at linux-iscsi.org>
Date:   Fri Mar 29 01:08:16 2013 +0000

    vhost-scsi-pci: new device supporting the tcm_vhost Linux kernel module
    
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
    Signed-off-by: Asias He <asias at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index b362cc8..c1e9a60 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1285,6 +1285,63 @@ static const TypeInfo virtio_scsi_pci_info = {
     .class_init    = virtio_scsi_pci_class_init,
 };
 
+/* vhost-scsi-pci */
+
+#ifdef CONFIG_VHOST_SCSI
+static Property vhost_scsi_pci_properties[] = {
+    DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
+                       DEV_NVECTORS_UNSPECIFIED),
+    DEFINE_VIRTIO_COMMON_FEATURES(VirtIOPCIProxy, host_features),
+    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSIPCI, vdev.parent_obj.conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static int vhost_scsi_pci_init_pci(VirtIOPCIProxy *vpci_dev)
+{
+    VHostSCSIPCI *dev = VHOST_SCSI_PCI(vpci_dev);
+    DeviceState *vdev = DEVICE(&dev->vdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+
+    if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
+        vpci_dev->nvectors = vs->conf.num_queues + 3;
+    }
+
+    qdev_set_parent_bus(vdev, BUS(&vpci_dev->bus));
+    if (qdev_init(vdev) < 0) {
+        return -1;
+    }
+    return 0;
+}
+
+static void vhost_scsi_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
+    PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
+    k->init = vhost_scsi_pci_init_pci;
+    dc->props = vhost_scsi_pci_properties;
+    pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
+    pcidev_k->device_id = PCI_DEVICE_ID_VIRTIO_SCSI;
+    pcidev_k->revision = 0x00;
+    pcidev_k->class_id = PCI_CLASS_STORAGE_SCSI;
+}
+
+static void vhost_scsi_pci_instance_init(Object *obj)
+{
+    VHostSCSIPCI *dev = VHOST_SCSI_PCI(obj);
+    object_initialize(OBJECT(&dev->vdev), TYPE_VHOST_SCSI);
+    object_property_add_child(obj, "virtio-backend", OBJECT(&dev->vdev), NULL);
+}
+
+static const TypeInfo vhost_scsi_pci_info = {
+    .name          = TYPE_VHOST_SCSI_PCI,
+    .parent        = TYPE_VIRTIO_PCI,
+    .instance_size = sizeof(VHostSCSIPCI),
+    .instance_init = vhost_scsi_pci_instance_init,
+    .class_init    = vhost_scsi_pci_class_init,
+};
+#endif
+
 /* virtio-balloon-pci */
 
 static void balloon_pci_stats_get_all(Object *obj, struct Visitor *v,
@@ -1541,6 +1598,9 @@ static void virtio_pci_register_types(void)
     type_register_static(&virtio_balloon_pci_info);
     type_register_static(&virtio_serial_pci_info);
     type_register_static(&virtio_net_pci_info);
+#ifdef CONFIG_VHOST_SCSI
+    type_register_static(&vhost_scsi_pci_info);
+#endif
 }
 
 type_init(virtio_pci_register_types)
diff --git a/hw/virtio/virtio-pci.h b/hw/virtio/virtio-pci.h
index aa67561..1b66e46 100644
--- a/hw/virtio/virtio-pci.h
+++ b/hw/virtio/virtio-pci.h
@@ -24,6 +24,9 @@
 #include "hw/virtio/virtio-balloon.h"
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-9p.h"
+#ifdef CONFIG_VHOST_SCSI
+#include "hw/virtio/vhost-scsi.h"
+#endif
 
 typedef struct VirtIOPCIProxy VirtIOPCIProxy;
 typedef struct VirtIOBlkPCI VirtIOBlkPCI;
@@ -31,6 +34,7 @@ typedef struct VirtIOSCSIPCI VirtIOSCSIPCI;
 typedef struct VirtIOBalloonPCI VirtIOBalloonPCI;
 typedef struct VirtIOSerialPCI VirtIOSerialPCI;
 typedef struct VirtIONetPCI VirtIONetPCI;
+typedef struct VHostSCSIPCI VHostSCSIPCI;
 
 /* virtio-pci-bus */
 
@@ -104,6 +108,20 @@ struct VirtIOSCSIPCI {
     VirtIOSCSI vdev;
 };
 
+#ifdef CONFIG_VHOST_SCSI
+/*
+ * vhost-scsi-pci: This extends VirtioPCIProxy.
+ */
+#define TYPE_VHOST_SCSI_PCI "vhost-scsi-pci"
+#define VHOST_SCSI_PCI(obj) \
+        OBJECT_CHECK(VHostSCSIPCI, (obj), TYPE_VHOST_SCSI_PCI)
+
+struct VHostSCSIPCI {
+    VirtIOPCIProxy parent_obj;
+    VHostSCSI vdev;
+};
+#endif
+
 /*
  * virtio-blk-pci: This extends VirtioPCIProxy.
  */
commit 5e9be92d775208cf6cc9bf9a592853888046239e
Author: Nicholas Bellinger <nab at linux-iscsi.org>
Date:   Fri Mar 29 01:08:16 2013 +0000

    vhost-scsi: new device supporting the tcm_vhost Linux kernel module
    
    The WWPN specified in configfs is passed to "-device vhost-scsi-pci".
    The tgpt field of the SET_ENDPOINT ioctl is obsolete now, so it is not
    available from the QEMU command-line.  Instead, I hardcode it to zero.
    
    Changes in Patch-v2:
       - Add vhost_scsi_get_features() in order to determine feature bits
         supports by host kernel (mst + nab)
       - Re-enable usage of DEFINE_VIRTIO_COMMON_FEATURES, and allow
         EVENT_IDX to be disabled by host in vhost_scsi_get_features()
       - Drop unused hotplug bit in DEFINE_VHOST_SCSI_PROPERTIES
    
    Changes in Patch-v1:
       - Set event_idx=off by default (nab, thanks asias)
       - Disable hotplug feature bit for v3.9 tcm_vhost kernel code, need to
         re-enable in v3.10 (nab)
       - Update to latest qemu.git/master HEAD
    
    Changes in WIP-V3:
       - Drop ioeventfd vhost_scsi_properties (asias, thanks stefanha)
       - Add CONFIG_VHOST_SCSI (asias, thanks stefanha)
       - Add hotplug feature bit
    
    Changes in WIP-V2:
       - Add backend guest masking support (nab)
       - Bump ABI_VERSION to 1 (nab)
       - Set up set_guest_notifiers (asias)
       - Set up vs->dev.vq_index (asias)
       - Drop vs->vs.vdev.{set,clear}_vhost_endpoint (asias)
       - Drop VIRTIO_CONFIG_S_DRIVER check in vhost_scsi_set_status (asias)
    
    Howto:
       Use the latest seabios, at least commit b44a7be17b
       git clone git://git.seabios.org/seabios.git
       make
       cp out/bios.bin /usr/share/qemu/bios.bin
       qemu -device vhost-scsi-pci,wwpn=naa.6001405bd4e8476d,event_idx=off
    ...
    
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
    Signed-off-by: Asias He <asias at redhat.com>
    [ Rebase on top of VirtIOSCSICommon patch, fix bugs in feature
      negotiation and irqfd masking - Paolo ]
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/configure b/configure
index ed49f91..51a6c56 100755
--- a/configure
+++ b/configure
@@ -179,6 +179,7 @@ libattr=""
 xfs=""
 
 vhost_net="no"
+vhost_scsi="no"
 kvm="no"
 gprof="no"
 debug_tcg="no"
@@ -543,6 +544,7 @@ Haiku)
   usb="linux"
   kvm="yes"
   vhost_net="yes"
+  vhost_scsi="yes"
   if [ "$cpu" = "i386" -o "$cpu" = "x86_64" ] ; then
     audio_possible_drivers="$audio_possible_drivers fmod"
   fi
@@ -870,6 +872,10 @@ for opt do
   ;;
   --enable-vhost-net) vhost_net="yes"
   ;;
+  --disable-vhost-scsi) vhost_scsi="no"
+  ;;
+  --enable-vhost-scsi) vhost_scsi="yes"
+  ;;
   --disable-glx) glx="no"
   ;;
   --enable-glx) glx="yes"
@@ -3553,6 +3559,7 @@ echo "sigev_thread_id   $sigev_thread_id"
 echo "uuid support      $uuid"
 echo "libcap-ng support $cap_ng"
 echo "vhost-net support $vhost_net"
+echo "vhost-scsi support $vhost_scsi"
 echo "Trace backend     $trace_backend"
 echo "Trace output file $trace_file-<pid>"
 echo "spice support     $spice ($spice_protocol_version/$spice_server_version)"
@@ -3836,6 +3843,9 @@ fi
 if test "$virtfs" = "yes" ; then
   echo "CONFIG_VIRTFS=y" >> $config_host_mak
 fi
+if test "$vhost_scsi" = "yes" ; then
+  echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
+fi
 if test "$blobs" = "yes" ; then
   echo "INSTALL_BLOBS=yes" >> $config_host_mak
 fi
diff --git a/hw/scsi/Makefile.objs b/hw/scsi/Makefile.objs
index eaec6c8..121ddc5 100644
--- a/hw/scsi/Makefile.objs
+++ b/hw/scsi/Makefile.objs
@@ -6,4 +6,8 @@ common-obj-$(CONFIG_VMW_PVSCSI_SCSI_PCI) += vmw_pvscsi.o
 common-obj-$(CONFIG_ESP) += esp.o
 common-obj-$(CONFIG_ESP_PCI) += esp-pci.o
 obj-$(CONFIG_PSERIES) += spapr_vscsi.o
-obj-$(CONFIG_VIRTIO) += virtio-scsi.o
+
+ifeq ($(CONFIG_VIRTIO),y)
+obj-y += virtio-scsi.o
+obj-$(CONFIG_VHOST_SCSI) += vhost-scsi.o
+endif
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
new file mode 100644
index 0000000..3dd1a0f
--- /dev/null
+++ b/hw/scsi/vhost-scsi.c
@@ -0,0 +1,288 @@
+/*
+ * vhost_scsi host device
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * Authors:
+ *  Stefan Hajnoczi   <stefanha at linux.vnet.ibm.com>
+ *
+ * Changes for QEMU mainline + tcm_vhost kernel upstream:
+ *  Nicholas Bellinger <nab at risingtidesystems.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include <sys/ioctl.h>
+#include "config.h"
+#include "qemu/queue.h"
+#include "monitor/monitor.h"
+#include "migration/migration.h"
+#include "hw/virtio/vhost-scsi.h"
+#include "hw/virtio/vhost.h"
+#include "hw/virtio/virtio-scsi.h"
+
+static int vhost_scsi_set_endpoint(VHostSCSI *s)
+{
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+    struct vhost_scsi_target backend;
+    int ret;
+
+    memset(&backend, 0, sizeof(backend));
+    pstrcpy(backend.vhost_wwpn, sizeof(backend.vhost_wwpn), vs->conf.wwpn);
+    ret = ioctl(s->dev.control, VHOST_SCSI_SET_ENDPOINT, &backend);
+    if (ret < 0) {
+        return -errno;
+    }
+    return 0;
+}
+
+static void vhost_scsi_clear_endpoint(VHostSCSI *s)
+{
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+    struct vhost_scsi_target backend;
+
+    memset(&backend, 0, sizeof(backend));
+    pstrcpy(backend.vhost_wwpn, sizeof(backend.vhost_wwpn), vs->conf.wwpn);
+    ioctl(s->dev.control, VHOST_SCSI_CLEAR_ENDPOINT, &backend);
+}
+
+static int vhost_scsi_start(VHostSCSI *s)
+{
+    int ret, abi_version, i;
+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
+
+    if (!vdev->binding->set_guest_notifiers) {
+        error_report("binding does not support guest notifiers");
+        return -ENOSYS;
+    }
+
+    ret = ioctl(s->dev.control, VHOST_SCSI_GET_ABI_VERSION, &abi_version);
+    if (ret < 0) {
+        return -errno;
+    }
+    if (abi_version > VHOST_SCSI_ABI_VERSION) {
+        error_report("vhost-scsi: The running tcm_vhost kernel abi_version:"
+                     " %d is greater than vhost_scsi userspace supports: %d, please"
+                     " upgrade your version of QEMU\n", abi_version,
+                     VHOST_SCSI_ABI_VERSION);
+        return -ENOSYS;
+    }
+
+    ret = vhost_dev_enable_notifiers(&s->dev, vdev);
+    if (ret < 0) {
+        return ret;
+    }
+
+    s->dev.acked_features = vdev->guest_features;
+    ret = vhost_dev_start(&s->dev, vdev);
+    if (ret < 0) {
+        error_report("Error start vhost dev");
+        goto err_notifiers;
+    }
+
+    ret = vhost_scsi_set_endpoint(s);
+    if (ret < 0) {
+        error_report("Error set vhost-scsi endpoint");
+        goto err_vhost_stop;
+    }
+
+    ret = vdev->binding->set_guest_notifiers(vdev->binding_opaque, s->dev.nvqs, true);
+    if (ret < 0) {
+        error_report("Error binding guest notifier");
+        goto err_endpoint;
+    }
+
+    /* guest_notifier_mask/pending not used yet, so just unmask
+     * everything here.  virtio-pci will do the right thing by
+     * enabling/disabling irqfd.
+     */
+    for (i = 0; i < s->dev.nvqs; i++) {
+        vhost_virtqueue_mask(&s->dev, vdev, i, false);
+    }
+
+    return ret;
+
+err_endpoint:
+    vhost_scsi_clear_endpoint(s);
+err_vhost_stop:
+    vhost_dev_stop(&s->dev, vdev);
+err_notifiers:
+    vhost_dev_disable_notifiers(&s->dev, vdev);
+    return ret;
+}
+
+static void vhost_scsi_stop(VHostSCSI *s)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
+    int ret = 0;
+
+    if (!vdev->binding->set_guest_notifiers) {
+        ret = vdev->binding->set_guest_notifiers(vdev->binding_opaque,
+                                                 s->dev.nvqs, false);
+        if (ret < 0) {
+                error_report("vhost guest notifier cleanup failed: %d\n", ret);
+        }
+    }
+    assert(ret >= 0);
+
+    vhost_scsi_clear_endpoint(s);
+    vhost_dev_stop(&s->dev, vdev);
+    vhost_dev_disable_notifiers(&s->dev, vdev);
+}
+
+static uint32_t vhost_scsi_get_features(VirtIODevice *vdev,
+                                        uint32_t features)
+{
+    VHostSCSI *s = VHOST_SCSI(vdev);
+
+    /* Clear features not supported by host kernel. */
+    if (!(s->dev.features & (1 << VIRTIO_F_NOTIFY_ON_EMPTY))) {
+        features &= ~(1 << VIRTIO_F_NOTIFY_ON_EMPTY);
+    }
+    if (!(s->dev.features & (1 << VIRTIO_RING_F_INDIRECT_DESC))) {
+        features &= ~(1 << VIRTIO_RING_F_INDIRECT_DESC);
+    }
+    if (!(s->dev.features & (1 << VIRTIO_RING_F_EVENT_IDX))) {
+        features &= ~(1 << VIRTIO_RING_F_EVENT_IDX);
+    }
+    if (!(s->dev.features & (1 << VIRTIO_SCSI_F_HOTPLUG))) {
+        features &= ~(1 << VIRTIO_SCSI_F_HOTPLUG);
+    }
+
+    return features;
+}
+
+static void vhost_scsi_set_config(VirtIODevice *vdev,
+                                  const uint8_t *config)
+{
+    VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+
+    if ((uint32_t) ldl_raw(&scsiconf->sense_size) != vs->sense_size ||
+        (uint32_t) ldl_raw(&scsiconf->cdb_size) != vs->cdb_size) {
+        error_report("vhost-scsi does not support changing the sense data and CDB sizes");
+        exit(1);
+    }
+}
+
+static void vhost_scsi_set_status(VirtIODevice *vdev, uint8_t val)
+{
+    VHostSCSI *s = (VHostSCSI *)vdev;
+    bool start = (val & VIRTIO_CONFIG_S_DRIVER_OK);
+
+    if (s->dev.started == start) {
+        return;
+    }
+
+    if (start) {
+        int ret;
+
+        ret = vhost_scsi_start(s);
+        if (ret < 0) {
+            error_report("virtio-scsi: unable to start vhost: %s\n",
+                         strerror(-ret));
+
+            /* There is no userspace virtio-scsi fallback so exit */
+            exit(1);
+        }
+    } else {
+        vhost_scsi_stop(s);
+    }
+}
+
+static int vhost_scsi_init(VirtIODevice *vdev)
+{
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+    VHostSCSI *s = VHOST_SCSI(vdev);
+    int vhostfd = -1;
+    int ret;
+
+    if (!vs->conf.wwpn) {
+        error_report("vhost-scsi: missing wwpn\n");
+        return -EINVAL;
+    }
+
+    if (vs->conf.vhostfd) {
+        vhostfd = monitor_handle_fd_param(cur_mon, vs->conf.vhostfd);
+        if (vhostfd == -1) {
+            error_report("vhost-scsi: unable to parse vhostfd\n");
+            return -EINVAL;
+        }
+    }
+
+    ret = virtio_scsi_common_init(vs);
+    if (ret < 0) {
+        return ret;
+    }
+
+    vdev->get_features = vhost_scsi_get_features;
+    vdev->set_config = vhost_scsi_set_config;
+    vdev->set_status = vhost_scsi_set_status;
+
+    s->dev.nvqs = VHOST_SCSI_VQ_NUM_FIXED + vs->conf.num_queues;
+    s->dev.vqs = g_new(struct vhost_virtqueue, s->dev.nvqs);
+    s->dev.vq_index = 0;
+
+    ret = vhost_dev_init(&s->dev, vhostfd, "/dev/vhost-scsi", true);
+    if (ret < 0) {
+        error_report("vhost-scsi: vhost initialization failed: %s\n",
+                strerror(-ret));
+        return ret;
+    }
+    s->dev.backend_features = 0;
+
+    error_setg(&s->migration_blocker,
+            "vhost-scsi does not support migration");
+    migrate_add_blocker(s->migration_blocker);
+
+    return 0;
+}
+
+static int vhost_scsi_exit(DeviceState *qdev)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(qdev);
+    VHostSCSI *s = VHOST_SCSI(qdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(qdev);
+
+    migrate_del_blocker(s->migration_blocker);
+    error_free(s->migration_blocker);
+
+    /* This will stop vhost backend. */
+    vhost_scsi_set_status(vdev, 0);
+
+    g_free(s->dev.vqs);
+    return virtio_scsi_common_exit(vs);
+}
+
+static Property vhost_scsi_properties[] = {
+    DEFINE_VHOST_SCSI_PROPERTIES(VHostSCSI, parent_obj.conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vhost_scsi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+    dc->exit = vhost_scsi_exit;
+    dc->props = vhost_scsi_properties;
+    vdc->init = vhost_scsi_init;
+    vdc->get_features = vhost_scsi_get_features;
+    vdc->set_config = vhost_scsi_set_config;
+    vdc->set_status = vhost_scsi_set_status;
+}
+
+static const TypeInfo vhost_scsi_info = {
+    .name = TYPE_VHOST_SCSI,
+    .parent = TYPE_VIRTIO_SCSI_COMMON,
+    .instance_size = sizeof(VHostSCSI),
+    .class_init = vhost_scsi_class_init,
+};
+
+static void virtio_register_types(void)
+{
+    type_register_static(&vhost_scsi_info);
+}
+
+type_init(virtio_register_types)
diff --git a/include/hw/virtio/vhost-scsi.h b/include/hw/virtio/vhost-scsi.h
new file mode 100644
index 0000000..85cc031
--- /dev/null
+++ b/include/hw/virtio/vhost-scsi.h
@@ -0,0 +1,73 @@
+/*
+ * vhost_scsi host device
+ *
+ * Copyright IBM, Corp. 2011
+ *
+ * Authors:
+ *  Stefan Hajnoczi   <stefanha at linux.vnet.ibm.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#ifndef VHOST_SCSI_H
+#define VHOST_SCSI_H
+
+#include "qemu-common.h"
+#include "hw/qdev.h"
+#include "hw/virtio/virtio-scsi.h"
+#include "hw/virtio/vhost.h"
+
+/*
+ * Used by QEMU userspace to ensure a consistent vhost-scsi ABI.
+ *
+ * ABI Rev 0: July 2012 version starting point for v3.6-rc merge candidate +
+ *            RFC-v2 vhost-scsi userspace.  Add GET_ABI_VERSION ioctl usage
+ * ABI Rev 1: January 2013. Ignore vhost_tpgt filed in struct vhost_scsi_target.
+ * 	      All the targets under vhost_wwpn can be seen and used by guest.
+ */
+
+#define VHOST_SCSI_ABI_VERSION 1
+
+/* TODO #include <linux/vhost.h> properly */
+/* For VHOST_SCSI_SET_ENDPOINT/VHOST_SCSI_CLEAR_ENDPOINT ioctl */
+struct vhost_scsi_target {
+    int abi_version;
+    char vhost_wwpn[224];
+    unsigned short vhost_tpgt;
+    unsigned short reserved;
+};
+
+enum vhost_scsi_vq_list {
+    VHOST_SCSI_VQ_CONTROL = 0,
+    VHOST_SCSI_VQ_EVENT = 1,
+    VHOST_SCSI_VQ_NUM_FIXED = 2,
+};
+
+#define VHOST_VIRTIO 0xAF
+#define VHOST_SCSI_SET_ENDPOINT _IOW(VHOST_VIRTIO, 0x40, struct vhost_scsi_target)
+#define VHOST_SCSI_CLEAR_ENDPOINT _IOW(VHOST_VIRTIO, 0x41, struct vhost_scsi_target)
+#define VHOST_SCSI_GET_ABI_VERSION _IOW(VHOST_VIRTIO, 0x42, int)
+
+#define TYPE_VHOST_SCSI "vhost-scsi"
+#define VHOST_SCSI(obj) \
+        OBJECT_CHECK(VHostSCSI, (obj), TYPE_VHOST_SCSI)
+
+typedef struct VHostSCSI {
+    VirtIOSCSICommon parent_obj;
+
+    Error *migration_blocker;
+
+    struct vhost_dev dev;
+} VHostSCSI;
+
+#define DEFINE_VHOST_SCSI_PROPERTIES(_state, _conf_field) \
+    DEFINE_PROP_STRING("vhostfd", _state, _conf_field.vhostfd), \
+    DEFINE_PROP_STRING("wwpn", _state, _conf_field.wwpn), \
+    DEFINE_PROP_UINT32("num_queues", _state, _conf_field.num_queues, 1), \
+    DEFINE_PROP_UINT32("max_sectors", _state, _conf_field.max_sectors, 0xFFFF), \
+    DEFINE_PROP_UINT32("cmd_per_lun", _state, _conf_field.cmd_per_lun, 128)
+
+
+#endif
diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index 4a961b9..4db346b 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -151,6 +151,8 @@ struct VirtIOSCSIConf {
     uint32_t num_queues;
     uint32_t max_sectors;
     uint32_t cmd_per_lun;
+    char *vhostfd;
+    char *wwpn;
 };
 
 typedef struct VirtIOSCSICommon {
commit e9cd423fa833533612beaa7674f988954bccb801
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Apr 19 10:45:25 2013 +0200

    virtio: simplify Makefile conditionals
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/Makefile.objs b/hw/Makefile.objs
index b7a1613..0243d6a 100644
--- a/hw/Makefile.objs
+++ b/hw/Makefile.objs
@@ -24,7 +24,7 @@ devices-dirs-$(CONFIG_SOFTMMU) += ssi/
 devices-dirs-$(CONFIG_SOFTMMU) += timer/
 devices-dirs-$(CONFIG_TPM) += tpm/
 devices-dirs-$(CONFIG_SOFTMMU) += usb/
-devices-dirs-$(CONFIG_SOFTMMU) += virtio/
+devices-dirs-$(CONFIG_VIRTIO) += virtio/
 devices-dirs-$(CONFIG_SOFTMMU) += watchdog/
 devices-dirs-$(CONFIG_SOFTMMU) += xen/
 devices-dirs-y += core/
diff --git a/hw/virtio/Makefile.objs b/hw/virtio/Makefile.objs
index c7e8013..cbe6d51 100644
--- a/hw/virtio/Makefile.objs
+++ b/hw/virtio/Makefile.objs
@@ -1,7 +1,7 @@
-common-obj-$(CONFIG_VIRTIO) += virtio-rng.o
+common-obj-y += virtio-rng.o
 common-obj-$(CONFIG_VIRTIO_PCI) += virtio-pci.o
-common-obj-$(CONFIG_VIRTIO) += virtio-bus.o
+common-obj-y += virtio-bus.o
 common-obj-$(CONFIG_VIRTIO_BLK_DATA_PLANE) += dataplane/
 
-obj-$(CONFIG_VIRTIO) += virtio.o virtio-balloon.o 
-obj-$(CONFIG_VHOST_NET) += vhost.o
+obj-y += virtio.o virtio-balloon.o 
+obj-$(CONFIG_LINUX) += vhost.o
commit 292c8e50d540735c601886acc13eb0c117ee94f8
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Fri Mar 29 01:08:15 2013 +0000

    virtio-scsi: create VirtIOSCSICommon
    
    This patch refactors existing virtio-scsi code into VirtIOSCSICommon
    in order to allow virtio_scsi_init_common() to be used by both internal
    virtio_scsi_init() and external vhost-scsi-pci code.
    
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Cc: Asias He <asias at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/s390x/s390-virtio-bus.c b/hw/s390x/s390-virtio-bus.c
index ca0e301..8f29b5e 100644
--- a/hw/s390x/s390-virtio-bus.c
+++ b/hw/s390x/s390-virtio-bus.c
@@ -560,7 +560,7 @@ static const TypeInfo virtio_s390_device_info = {
 };
 
 static Property s390_virtio_scsi_properties[] = {
-    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSIS390, vdev.conf),
+    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSIS390, vdev.parent_obj.conf),
     DEFINE_VIRTIO_SCSI_FEATURES(VirtIOS390Device, host_features),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index e9e7509..5232526 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -873,7 +873,7 @@ static const TypeInfo virtio_ccw_balloon = {
 
 static Property virtio_ccw_scsi_properties[] = {
     DEFINE_PROP_STRING("devno", VirtioCcwDevice, bus_id),
-    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSICcw, vdev.conf),
+    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSICcw, vdev.parent_obj.conf),
     DEFINE_VIRTIO_SCSI_FEATURES(VirtioCcwDevice, host_features[0]),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index ead7cda..051daea 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -19,118 +19,6 @@
 #include <block/scsi.h>
 #include <hw/virtio/virtio-bus.h>
 
-#define VIRTIO_SCSI_VQ_SIZE     128
-#define VIRTIO_SCSI_CDB_SIZE    32
-#define VIRTIO_SCSI_SENSE_SIZE  96
-#define VIRTIO_SCSI_MAX_CHANNEL 0
-#define VIRTIO_SCSI_MAX_TARGET  255
-#define VIRTIO_SCSI_MAX_LUN     16383
-
-/* Response codes */
-#define VIRTIO_SCSI_S_OK                       0
-#define VIRTIO_SCSI_S_OVERRUN                  1
-#define VIRTIO_SCSI_S_ABORTED                  2
-#define VIRTIO_SCSI_S_BAD_TARGET               3
-#define VIRTIO_SCSI_S_RESET                    4
-#define VIRTIO_SCSI_S_BUSY                     5
-#define VIRTIO_SCSI_S_TRANSPORT_FAILURE        6
-#define VIRTIO_SCSI_S_TARGET_FAILURE           7
-#define VIRTIO_SCSI_S_NEXUS_FAILURE            8
-#define VIRTIO_SCSI_S_FAILURE                  9
-#define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED       10
-#define VIRTIO_SCSI_S_FUNCTION_REJECTED        11
-#define VIRTIO_SCSI_S_INCORRECT_LUN            12
-
-/* Controlq type codes.  */
-#define VIRTIO_SCSI_T_TMF                      0
-#define VIRTIO_SCSI_T_AN_QUERY                 1
-#define VIRTIO_SCSI_T_AN_SUBSCRIBE             2
-
-/* Valid TMF subtypes.  */
-#define VIRTIO_SCSI_T_TMF_ABORT_TASK           0
-#define VIRTIO_SCSI_T_TMF_ABORT_TASK_SET       1
-#define VIRTIO_SCSI_T_TMF_CLEAR_ACA            2
-#define VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET       3
-#define VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET      4
-#define VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET   5
-#define VIRTIO_SCSI_T_TMF_QUERY_TASK           6
-#define VIRTIO_SCSI_T_TMF_QUERY_TASK_SET       7
-
-/* Events.  */
-#define VIRTIO_SCSI_T_EVENTS_MISSED            0x80000000
-#define VIRTIO_SCSI_T_NO_EVENT                 0
-#define VIRTIO_SCSI_T_TRANSPORT_RESET          1
-#define VIRTIO_SCSI_T_ASYNC_NOTIFY             2
-#define VIRTIO_SCSI_T_PARAM_CHANGE             3
-
-/* Reasons for transport reset event */
-#define VIRTIO_SCSI_EVT_RESET_HARD             0
-#define VIRTIO_SCSI_EVT_RESET_RESCAN           1
-#define VIRTIO_SCSI_EVT_RESET_REMOVED          2
-
-/* SCSI command request, followed by data-out */
-typedef struct {
-    uint8_t lun[8];              /* Logical Unit Number */
-    uint64_t tag;                /* Command identifier */
-    uint8_t task_attr;           /* Task attribute */
-    uint8_t prio;
-    uint8_t crn;
-    uint8_t cdb[];
-} QEMU_PACKED VirtIOSCSICmdReq;
-
-/* Response, followed by sense data and data-in */
-typedef struct {
-    uint32_t sense_len;          /* Sense data length */
-    uint32_t resid;              /* Residual bytes in data buffer */
-    uint16_t status_qualifier;   /* Status qualifier */
-    uint8_t status;              /* Command completion status */
-    uint8_t response;            /* Response values */
-    uint8_t sense[];
-} QEMU_PACKED VirtIOSCSICmdResp;
-
-/* Task Management Request */
-typedef struct {
-    uint32_t type;
-    uint32_t subtype;
-    uint8_t lun[8];
-    uint64_t tag;
-} QEMU_PACKED VirtIOSCSICtrlTMFReq;
-
-typedef struct {
-    uint8_t response;
-} QEMU_PACKED VirtIOSCSICtrlTMFResp;
-
-/* Asynchronous notification query/subscription */
-typedef struct {
-    uint32_t type;
-    uint8_t lun[8];
-    uint32_t event_requested;
-} QEMU_PACKED VirtIOSCSICtrlANReq;
-
-typedef struct {
-    uint32_t event_actual;
-    uint8_t response;
-} QEMU_PACKED VirtIOSCSICtrlANResp;
-
-typedef struct {
-    uint32_t event;
-    uint8_t lun[8];
-    uint32_t reason;
-} QEMU_PACKED VirtIOSCSIEvent;
-
-typedef struct {
-    uint32_t num_queues;
-    uint32_t seg_max;
-    uint32_t max_sectors;
-    uint32_t cmd_per_lun;
-    uint32_t event_info_size;
-    uint32_t sense_size;
-    uint32_t cdb_size;
-    uint16_t max_channel;
-    uint16_t max_target;
-    uint32_t max_lun;
-} QEMU_PACKED VirtIOSCSIConfig;
-
 typedef struct VirtIOSCSIReq {
     VirtIOSCSI *dev;
     VirtQueue *vq;
@@ -237,9 +125,10 @@ static VirtIOSCSIReq *virtio_scsi_pop_req(VirtIOSCSI *s, VirtQueue *vq)
 static void virtio_scsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 {
     VirtIOSCSIReq *req = sreq->hba_private;
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(req->dev);
     uint32_t n = virtio_queue_get_id(req->vq) - 2;
 
-    assert(n < req->dev->conf.num_queues);
+    assert(n < vs->conf.num_queues);
     qemu_put_be32s(f, &n);
     qemu_put_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
 }
@@ -248,14 +137,15 @@ static void *virtio_scsi_load_request(QEMUFile *f, SCSIRequest *sreq)
 {
     SCSIBus *bus = sreq->bus;
     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
     VirtIOSCSIReq *req;
     uint32_t n;
 
     req = g_malloc(sizeof(*req));
     qemu_get_be32s(f, &n);
-    assert(n < s->conf.num_queues);
+    assert(n < vs->conf.num_queues);
     qemu_get_buffer(f, (unsigned char *)&req->elem, sizeof(req->elem));
-    virtio_scsi_parse_req(s, s->cmd_vqs[n], req);
+    virtio_scsi_parse_req(s, vs->cmd_vqs[n], req);
 
     scsi_req_ref(sreq);
     req->sreq = sreq;
@@ -457,7 +347,10 @@ static void virtio_scsi_fail_cmd_req(VirtIOSCSIReq *req)
 
 static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 {
+    /* use non-QOM casts in the data path */
     VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+    VirtIOSCSICommon *vs = &s->parent_obj;
+
     VirtIOSCSIReq *req;
     int n;
 
@@ -470,8 +363,8 @@ static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
 
         out_size = req->elem.out_sg[0].iov_len;
         in_size = req->elem.in_sg[0].iov_len;
-        if (out_size < sizeof(VirtIOSCSICmdReq) + s->cdb_size ||
-            in_size < sizeof(VirtIOSCSICmdResp) + s->sense_size) {
+        if (out_size < sizeof(VirtIOSCSICmdReq) + vs->cdb_size ||
+            in_size < sizeof(VirtIOSCSICmdResp) + vs->sense_size) {
             virtio_scsi_bad_req();
         }
 
@@ -513,7 +406,7 @@ static void virtio_scsi_get_config(VirtIODevice *vdev,
                                    uint8_t *config)
 {
     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
-    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+    VirtIOSCSICommon *s = VIRTIO_SCSI_COMMON(vdev);
 
     stl_raw(&scsiconf->num_queues, s->conf.num_queues);
     stl_raw(&scsiconf->seg_max, 128 - 2);
@@ -531,7 +424,7 @@ static void virtio_scsi_set_config(VirtIODevice *vdev,
                                    const uint8_t *config)
 {
     VirtIOSCSIConfig *scsiconf = (VirtIOSCSIConfig *)config;
-    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 
     if ((uint32_t) ldl_raw(&scsiconf->sense_size) >= 65536 ||
         (uint32_t) ldl_raw(&scsiconf->cdb_size) >= 256) {
@@ -539,8 +432,8 @@ static void virtio_scsi_set_config(VirtIODevice *vdev,
         exit(1);
     }
 
-    s->sense_size = ldl_raw(&scsiconf->sense_size);
-    s->cdb_size = ldl_raw(&scsiconf->cdb_size);
+    vs->sense_size = ldl_raw(&scsiconf->sense_size);
+    vs->cdb_size = ldl_raw(&scsiconf->cdb_size);
 }
 
 static uint32_t virtio_scsi_get_features(VirtIODevice *vdev,
@@ -551,14 +444,15 @@ static uint32_t virtio_scsi_get_features(VirtIODevice *vdev,
 
 static void virtio_scsi_reset(VirtIODevice *vdev)
 {
-    VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 
     s->resetting++;
     qbus_reset_all(&s->bus.qbus);
     s->resetting--;
 
-    s->sense_size = VIRTIO_SCSI_SENSE_SIZE;
-    s->cdb_size = VIRTIO_SCSI_CDB_SIZE;
+    vs->sense_size = VIRTIO_SCSI_SENSE_SIZE;
+    vs->cdb_size = VIRTIO_SCSI_CDB_SIZE;
     s->events_dropped = false;
 }
 
@@ -586,7 +480,8 @@ static int virtio_scsi_load(QEMUFile *f, void *opaque, int version_id)
 static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
                                    uint32_t event, uint32_t reason)
 {
-    VirtIOSCSIReq *req = virtio_scsi_pop_req(s, s->event_vq);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+    VirtIOSCSIReq *req = virtio_scsi_pop_req(s, vs->event_vq);
     VirtIOSCSIEvent *evt;
     VirtIODevice *vdev = VIRTIO_DEVICE(s);
     int in_size;
@@ -692,23 +587,19 @@ static struct SCSIBusInfo virtio_scsi_scsi_info = {
     .load_request = virtio_scsi_load_request,
 };
 
-static int virtio_scsi_device_init(VirtIODevice *vdev)
+int virtio_scsi_common_init(VirtIOSCSICommon *s)
 {
-    DeviceState *qdev = DEVICE(vdev);
-    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
-    static int virtio_scsi_id;
+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
     int i;
 
     virtio_init(VIRTIO_DEVICE(s), "virtio-scsi", VIRTIO_ID_SCSI,
                 sizeof(VirtIOSCSIConfig));
 
     s->cmd_vqs = g_malloc0(s->conf.num_queues * sizeof(VirtQueue *));
+    s->sense_size = VIRTIO_SCSI_SENSE_SIZE;
+    s->cdb_size = VIRTIO_SCSI_CDB_SIZE;
 
-    /* TODO set up vdev function pointers */
     vdev->get_config = virtio_scsi_get_config;
-    vdev->set_config = virtio_scsi_set_config;
-    vdev->get_features = virtio_scsi_get_features;
-    vdev->reset = virtio_scsi_reset;
 
     s->ctrl_vq = virtio_add_queue(vdev, VIRTIO_SCSI_VQ_SIZE,
                                   virtio_scsi_handle_ctrl);
@@ -719,6 +610,26 @@ static int virtio_scsi_device_init(VirtIODevice *vdev)
                                          virtio_scsi_handle_cmd);
     }
 
+    return 0;
+}
+
+static int virtio_scsi_device_init(VirtIODevice *vdev)
+{
+    DeviceState *qdev = DEVICE(vdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
+    VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+    static int virtio_scsi_id;
+    int ret;
+
+    ret = virtio_scsi_common_init(vs);
+    if (ret < 0) {
+        return ret;
+    }
+
+    vdev->get_features = virtio_scsi_get_features;
+    vdev->set_config = virtio_scsi_set_config;
+    vdev->reset = virtio_scsi_reset;
+
     scsi_bus_new(&s->bus, qdev, &virtio_scsi_scsi_info);
     if (!qdev->hotplugged) {
         scsi_bus_legacy_handle_cmdline(&s->bus);
@@ -730,22 +641,36 @@ static int virtio_scsi_device_init(VirtIODevice *vdev)
     return 0;
 }
 
+int virtio_scsi_common_exit(VirtIOSCSICommon *vs)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(vs);
+
+    g_free(vs->cmd_vqs);
+    virtio_common_cleanup(vdev);
+    return 0;
+}
+
 static int virtio_scsi_device_exit(DeviceState *qdev)
 {
     VirtIOSCSI *s = VIRTIO_SCSI(qdev);
-    VirtIODevice *vdev = VIRTIO_DEVICE(qdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(qdev);
 
     unregister_savevm(qdev, "virtio-scsi", s);
-    g_free(s->cmd_vqs);
-    virtio_common_cleanup(vdev);
-    return 0;
+    return virtio_scsi_common_exit(vs);
 }
 
 static Property virtio_scsi_properties[] = {
-    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSI, conf),
+    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSI, parent_obj.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
+static void virtio_scsi_common_class_init(ObjectClass *klass, void *data)
+{
+    VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
+
+    vdc->get_config = virtio_scsi_get_config;
+}
+
 static void virtio_scsi_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -753,21 +678,28 @@ static void virtio_scsi_class_init(ObjectClass *klass, void *data)
     dc->exit = virtio_scsi_device_exit;
     dc->props = virtio_scsi_properties;
     vdc->init = virtio_scsi_device_init;
-    vdc->get_config = virtio_scsi_get_config;
     vdc->set_config = virtio_scsi_set_config;
     vdc->get_features = virtio_scsi_get_features;
     vdc->reset = virtio_scsi_reset;
 }
 
+static const TypeInfo virtio_scsi_common_info = {
+    .name = TYPE_VIRTIO_SCSI_COMMON,
+    .parent = TYPE_VIRTIO_DEVICE,
+    .instance_size = sizeof(VirtIOSCSICommon),
+    .class_init = virtio_scsi_common_class_init,
+};
+
 static const TypeInfo virtio_scsi_info = {
     .name = TYPE_VIRTIO_SCSI,
-    .parent = TYPE_VIRTIO_DEVICE,
+    .parent = TYPE_VIRTIO_SCSI_COMMON,
     .instance_size = sizeof(VirtIOSCSI),
     .class_init = virtio_scsi_class_init,
 };
 
 static void virtio_register_types(void)
 {
+    type_register_static(&virtio_scsi_common_info);
     type_register_static(&virtio_scsi_info);
 }
 
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index e2d1693..b362cc8 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1236,7 +1236,7 @@ static Property virtio_scsi_pci_properties[] = {
     DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
                        DEV_NVECTORS_UNSPECIFIED),
     DEFINE_VIRTIO_SCSI_FEATURES(VirtIOPCIProxy, host_features),
-    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSIPCI, vdev.conf),
+    DEFINE_VIRTIO_SCSI_PROPERTIES(VirtIOSCSIPCI, vdev.parent_obj.conf),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -1244,9 +1244,10 @@ static int virtio_scsi_pci_init_pci(VirtIOPCIProxy *vpci_dev)
 {
     VirtIOSCSIPCI *dev = VIRTIO_SCSI_PCI(vpci_dev);
     DeviceState *vdev = DEVICE(&dev->vdev);
+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(vdev);
 
     if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
-        vpci_dev->nvectors = dev->vdev.conf.num_queues + 3;
+        vpci_dev->nvectors = vs->conf.num_queues + 3;
     }
 
     qdev_set_parent_bus(vdev, BUS(&vpci_dev->bus));
diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index ccd7b06..4a961b9 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -18,6 +18,10 @@
 #include "hw/pci/pci.h"
 #include "hw/scsi/scsi.h"
 
+#define TYPE_VIRTIO_SCSI_COMMON "virtio-scsi-common"
+#define VIRTIO_SCSI_COMMON(obj) \
+        OBJECT_CHECK(VirtIOSCSICommon, (obj), TYPE_VIRTIO_SCSI_COMMON)
+
 #define TYPE_VIRTIO_SCSI "virtio-scsi-device"
 #define VIRTIO_SCSI(obj) \
         OBJECT_CHECK(VirtIOSCSI, (obj), TYPE_VIRTIO_SCSI)
@@ -31,24 +35,141 @@
 #define VIRTIO_SCSI_F_HOTPLUG                  1
 #define VIRTIO_SCSI_F_CHANGE                   2
 
+#define VIRTIO_SCSI_VQ_SIZE     128
+#define VIRTIO_SCSI_CDB_SIZE    32
+#define VIRTIO_SCSI_SENSE_SIZE  96
+#define VIRTIO_SCSI_MAX_CHANNEL 0
+#define VIRTIO_SCSI_MAX_TARGET  255
+#define VIRTIO_SCSI_MAX_LUN     16383
+
+/* Response codes */
+#define VIRTIO_SCSI_S_OK                       0
+#define VIRTIO_SCSI_S_OVERRUN                  1
+#define VIRTIO_SCSI_S_ABORTED                  2
+#define VIRTIO_SCSI_S_BAD_TARGET               3
+#define VIRTIO_SCSI_S_RESET                    4
+#define VIRTIO_SCSI_S_BUSY                     5
+#define VIRTIO_SCSI_S_TRANSPORT_FAILURE        6
+#define VIRTIO_SCSI_S_TARGET_FAILURE           7
+#define VIRTIO_SCSI_S_NEXUS_FAILURE            8
+#define VIRTIO_SCSI_S_FAILURE                  9
+#define VIRTIO_SCSI_S_FUNCTION_SUCCEEDED       10
+#define VIRTIO_SCSI_S_FUNCTION_REJECTED        11
+#define VIRTIO_SCSI_S_INCORRECT_LUN            12
+
+/* Controlq type codes.  */
+#define VIRTIO_SCSI_T_TMF                      0
+#define VIRTIO_SCSI_T_AN_QUERY                 1
+#define VIRTIO_SCSI_T_AN_SUBSCRIBE             2
+
+/* Valid TMF subtypes.  */
+#define VIRTIO_SCSI_T_TMF_ABORT_TASK           0
+#define VIRTIO_SCSI_T_TMF_ABORT_TASK_SET       1
+#define VIRTIO_SCSI_T_TMF_CLEAR_ACA            2
+#define VIRTIO_SCSI_T_TMF_CLEAR_TASK_SET       3
+#define VIRTIO_SCSI_T_TMF_I_T_NEXUS_RESET      4
+#define VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET   5
+#define VIRTIO_SCSI_T_TMF_QUERY_TASK           6
+#define VIRTIO_SCSI_T_TMF_QUERY_TASK_SET       7
+
+/* Events.  */
+#define VIRTIO_SCSI_T_EVENTS_MISSED            0x80000000
+#define VIRTIO_SCSI_T_NO_EVENT                 0
+#define VIRTIO_SCSI_T_TRANSPORT_RESET          1
+#define VIRTIO_SCSI_T_ASYNC_NOTIFY             2
+#define VIRTIO_SCSI_T_PARAM_CHANGE             3
+
+/* Reasons for transport reset event */
+#define VIRTIO_SCSI_EVT_RESET_HARD             0
+#define VIRTIO_SCSI_EVT_RESET_RESCAN           1
+#define VIRTIO_SCSI_EVT_RESET_REMOVED          2
+
+/* SCSI command request, followed by data-out */
+typedef struct {
+    uint8_t lun[8];              /* Logical Unit Number */
+    uint64_t tag;                /* Command identifier */
+    uint8_t task_attr;           /* Task attribute */
+    uint8_t prio;
+    uint8_t crn;
+    uint8_t cdb[];
+} QEMU_PACKED VirtIOSCSICmdReq;
+
+/* Response, followed by sense data and data-in */
+typedef struct {
+    uint32_t sense_len;          /* Sense data length */
+    uint32_t resid;              /* Residual bytes in data buffer */
+    uint16_t status_qualifier;   /* Status qualifier */
+    uint8_t status;              /* Command completion status */
+    uint8_t response;            /* Response values */
+    uint8_t sense[];
+} QEMU_PACKED VirtIOSCSICmdResp;
+
+/* Task Management Request */
+typedef struct {
+    uint32_t type;
+    uint32_t subtype;
+    uint8_t lun[8];
+    uint64_t tag;
+} QEMU_PACKED VirtIOSCSICtrlTMFReq;
+
+typedef struct {
+    uint8_t response;
+} QEMU_PACKED VirtIOSCSICtrlTMFResp;
+
+/* Asynchronous notification query/subscription */
+typedef struct {
+    uint32_t type;
+    uint8_t lun[8];
+    uint32_t event_requested;
+} QEMU_PACKED VirtIOSCSICtrlANReq;
+
+typedef struct {
+    uint32_t event_actual;
+    uint8_t response;
+} QEMU_PACKED VirtIOSCSICtrlANResp;
+
+typedef struct {
+    uint32_t event;
+    uint8_t lun[8];
+    uint32_t reason;
+} QEMU_PACKED VirtIOSCSIEvent;
+
+typedef struct {
+    uint32_t num_queues;
+    uint32_t seg_max;
+    uint32_t max_sectors;
+    uint32_t cmd_per_lun;
+    uint32_t event_info_size;
+    uint32_t sense_size;
+    uint32_t cdb_size;
+    uint16_t max_channel;
+    uint16_t max_target;
+    uint32_t max_lun;
+} QEMU_PACKED VirtIOSCSIConfig;
+
 struct VirtIOSCSIConf {
     uint32_t num_queues;
     uint32_t max_sectors;
     uint32_t cmd_per_lun;
 };
 
-typedef struct VirtIOSCSI {
+typedef struct VirtIOSCSICommon {
     VirtIODevice parent_obj;
     VirtIOSCSIConf conf;
 
-    SCSIBus bus;
     uint32_t sense_size;
     uint32_t cdb_size;
-    int resetting;
-    bool events_dropped;
     VirtQueue *ctrl_vq;
     VirtQueue *event_vq;
     VirtQueue **cmd_vqs;
+} VirtIOSCSICommon;
+
+typedef struct {
+    VirtIOSCSICommon parent_obj;
+
+    SCSIBus bus;
+    int resetting;
+    bool events_dropped;
 } VirtIOSCSI;
 
 #define DEFINE_VIRTIO_SCSI_PROPERTIES(_state, _conf_field)                     \
@@ -63,4 +184,8 @@ typedef struct VirtIOSCSI {
     DEFINE_PROP_BIT("param_change", _state, _feature_field,                    \
                                             VIRTIO_SCSI_F_CHANGE, true)
 
+int virtio_scsi_common_init(VirtIOSCSICommon *vs);
+int virtio_scsi_common_exit(VirtIOSCSICommon *vs);
+
+
 #endif /* _QEMU_VIRTIO_SCSI_H */
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index df24400..8b465fd 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -67,6 +67,10 @@ typedef signed int              int_fast16_t;
 #define MAX(a, b) (((a) > (b)) ? (a) : (b))
 #endif
 
+#ifndef ROUND_UP
+#define ROUND_UP(n,d) (((n) + (d) - 1) & -(d))
+#endif
+
 #ifndef DIV_ROUND_UP
 #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
 #endif
commit f691df528340807d42247fe79a89ea88e6303e1d
Merge: 5dff24b ad6b40f
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Apr 19 08:38:16 2013 -0500

    Merge remote-tracking branch 'stefanha/trivial-patches' into staging
    
    # By Stefan Weil (3) and others
    # Via Stefan Hajnoczi
    * stefanha/trivial-patches:
      m25p80: Remove bogus include of devices.h
      ssh: Remove unnecessary use of strlen function.
      block/ssh: Add missing gcc format attributes
      linux-user: change do_semop to return target errno when unsuccessful
      w64: Fix compiler warnings (wrong format specifier)
      Remove unneeded type casts
      virtio.h: drop unused function prototypes
      bswap: fix compiler warning
    
    Message-id: 1366371241-23430-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit 5dff24bebae5103810002ea76b1d03927e2148f2
Merge: b6c99f8 22773d6
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Apr 19 08:38:05 2013 -0500

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pci: add pci test device
    
    This adds a new device that we can use for testing PCI PIO and MMIO, with and
    without ioeventfd in different configurations.  FAST_MMIO will be added if/when
    kvm supports it.  Also included are minor cleanups in kvm APIs that it needs.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Mon 15 Apr 2013 05:42:24 PM CDT using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By Michael S. Tsirkin
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      pci: add pci test device
      kvm: support non datamatch ioeventfd
      kvm: support any size for pio eventfd
      kvm: remove unused APIs
    
    Message-id: cover.1366272004.git.mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit b6c99f8a6d66c5fa01a60483d9b012eb2b0932f2
Merge: 09dada4 007e986
Author: Anthony Liguori <aliguori at us.ibm.com>
Date:   Fri Apr 19 08:37:58 2013 -0500

    Merge remote-tracking branch 'qemu-kvm/uq/master' into staging
    
    # By Jan Kiszka (4) and Marcelo Tosatti (1)
    # Via Marcelo Tosatti
    * qemu-kvm/uq/master:
      vmxcap: Update according to SDM of January 2013
      target-i386: kvm: save/restore steal time MSR
      vmxcap: Report APIC register emulation and RDTSCP control
      vmxcap: Augment reported information
      vmxcap: Open MSR file in unbuffered mode
    
    Message-id: cover.1366253306.git.mtosatti at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>

commit dcc6ceffc066745777960a1f0d32f3a555924f65
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Thu Apr 18 11:53:32 2013 -0400

    virtio-balloon: fix integer overflow in BALLOON_CHANGE QMP event
    
    Because dev->actual is uint32_t, the expression 'dev->actual <<
    VIRTIO_BALLOON_PFN_SHIFT' is truncated to 32 bits. This overflows when
    dev->actual >= 1048576.
    
    To reproduce:
    
     1. Start a VM with a QMP socket and 5G of RAM
     2. Connect to the QMP socket, negotiate capabilities and issue:
    
       { "execute":"balloon", "arguments": { "value": 1073741824 } }
    
     3. Watch for BALLOON_CHANGE QMP events, the last one will incorretly be:
    
       { "timestamp": { "seconds": 1366228965, "microseconds": 245466 },
         "event": "BALLOON_CHANGE", "data": { "actual": 5368709120 } }
    
    To fix it this commit casts it to ram_addr_t, which is ram_size's type.
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index c2c446e..76e32ce 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -275,7 +275,7 @@ static void virtio_balloon_set_config(VirtIODevice *vdev,
     dev->actual = le32_to_cpu(config.actual);
     if (dev->actual != oldactual) {
         qemu_balloon_changed(ram_size -
-                             (dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
+                       ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
     }
 }
 
commit 153d02e338a063ad5c51ff0725d5d88285f44121
Author: Amos Kong <akong at redhat.com>
Date:   Tue Apr 16 13:47:32 2013 +0800

    monitor: fix the wrong order of releasing keys
    
    (qemu) sendkey ctrl_r-scroll_lock-scroll_lock
    
    Executing this command could not let Windows guest panic, it caused by
    the wrong order of releasing keys. This problem was introduced by
    commit e4c8f004c55d9da3eae3e14df740238bf805b5d6.
    
    The right release order should be starting from last item.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/ui/input.c b/ui/input.c
index 9abef0c..ecfeb43 100644
--- a/ui/input.c
+++ b/ui/input.c
@@ -234,13 +234,11 @@ static void free_keycodes(void)
 
 static void release_keys(void *opaque)
 {
-    int i;
-
-    for (i = 0; i < keycodes_size; i++) {
-        if (keycodes[i] & 0x80) {
+    while (keycodes_size > 0) {
+        if (keycodes[--keycodes_size] & 0x80) {
             kbd_put_keycode(0xe0);
         }
-        kbd_put_keycode(keycodes[i]| 0x80);
+        kbd_put_keycode(keycodes[keycodes_size] | 0x80);
     }
 
     free_keycodes();
commit e91f229a253f489f6d12b946ad7bdcdc158c5b67
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 12:24:19 2013 +0100

    target-arm: Correctly restore FPSCR
    
    Use the helper functions to save and restore the FPSCR, so that
    we correctly propagate rounding mode and flushing behaviour into
    the float_status fields. This also allows us to stop saving the
    vector length/stride fields separately.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/machine.c b/target-arm/machine.c
index 2dd48d7..4dd057c 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -9,17 +9,51 @@ static bool vfp_needed(void *opaque)
     return arm_feature(env, ARM_FEATURE_VFP);
 }
 
+static int get_fpscr(QEMUFile *f, void *opaque, size_t size)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+    uint32_t val = qemu_get_be32(f);
+
+    vfp_set_fpscr(env, val);
+    return 0;
+}
+
+static void put_fpscr(QEMUFile *f, void *opaque, size_t size)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+
+    qemu_put_be32(f, vfp_get_fpscr(env));
+}
+
+static const VMStateInfo vmstate_fpscr = {
+    .name = "fpscr",
+    .get = get_fpscr,
+    .put = put_fpscr,
+};
+
 static const VMStateDescription vmstate_vfp = {
     .name = "cpu/vfp",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .minimum_version_id_old = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
+    .minimum_version_id_old = 2,
     .fields = (VMStateField[]) {
         VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 32),
-        VMSTATE_UINT32_ARRAY(env.vfp.xregs, ARMCPU, 16),
-        /* TODO: Should use proper FPSCR access functions.  */
-        VMSTATE_INT32(env.vfp.vec_len, ARMCPU),
-        VMSTATE_INT32(env.vfp.vec_stride, ARMCPU),
+        /* The xregs array is a little awkward because element 1 (FPSCR)
+         * requires a specific accessor, so we have to split it up in
+         * the vmstate:
+         */
+        VMSTATE_UINT32(env.vfp.xregs[0], ARMCPU),
+        VMSTATE_UINT32_SUB_ARRAY(env.vfp.xregs, ARMCPU, 2, 14),
+        {
+            .name = "fpscr",
+            .version_id = 0,
+            .size = sizeof(uint32_t),
+            .info = &vmstate_fpscr,
+            .flags = VMS_SINGLE,
+            .offset = 0,
+        },
         VMSTATE_END_OF_LIST()
     }
 };
commit 602131e944f513f85ffa5593b020d263599cb2cd
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 12:24:19 2013 +0100

    target-arm: Add some missing CPU state fields to VMState
    
    A number of CPU state fields were accidentally omitted from
    our migration state: some OMAP specific cp15 registers, and
    some related to state for load/store exclusive insns. Add them.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/machine.c b/target-arm/machine.c
index 3c41f06..2dd48d7 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -116,9 +116,9 @@ static const VMStateInfo vmstate_cpsr = {
 
 const VMStateDescription vmstate_arm_cpu = {
     .name = "cpu",
-    .version_id = 10,
-    .minimum_version_id = 10,
-    .minimum_version_id_old = 10,
+    .version_id = 11,
+    .minimum_version_id = 11,
+    .minimum_version_id_old = 11,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
         {
@@ -172,9 +172,16 @@ const VMStateDescription vmstate_arm_cpu = {
         VMSTATE_UINT32(env.cp15.c13_tls2, ARMCPU),
         VMSTATE_UINT32(env.cp15.c13_tls3, ARMCPU),
         VMSTATE_UINT32(env.cp15.c15_cpar, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_ticonfig, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_i_max, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_i_min, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_threadid, ARMCPU),
         VMSTATE_UINT32(env.cp15.c15_power_control, ARMCPU),
         VMSTATE_UINT32(env.cp15.c15_diagnostic, ARMCPU),
         VMSTATE_UINT32(env.cp15.c15_power_diagnostic, ARMCPU),
+        VMSTATE_UINT32(env.exclusive_addr, ARMCPU),
+        VMSTATE_UINT32(env.exclusive_val, ARMCPU),
+        VMSTATE_UINT32(env.exclusive_high, ARMCPU),
         VMSTATE_UINT64(env.features, ARMCPU),
         VMSTATE_END_OF_LIST()
     },
commit 3cc1d20823e8677038c5bb5db10910f6271b1883
Author: Juan Quintela <quintela at redhat.com>
Date:   Fri Apr 19 12:24:19 2013 +0100

    target-arm: port ARM CPU save/load to use VMState
    
    Port the ARM CPU save/load code to use VMState. Some state is
    saved in a slightly different order to simplify things -- for
    example arrays are saved one after the other rather than 'striped',
    and we always save all 32 VFP registers even if the CPU happens
    to only have 16.
    
    Use one subsection for each feature.  This means that we don't need to
    bump the version field each time that a new feature gets introduced.
    
    Signed-off-by: Juan Quintela <quintela at redhat.com>
    [PMM: fixed conflicts, updated to use cpu_class_set_vmsd(),  updated
     with new/removed fields since original patch, changed to use custom
     VMStateInfo for cpsr rather than presave/postload hooks, corrected
     subsection names so vmload doesn't fail]
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h
index 2589550..12fcefe 100644
--- a/target-arm/cpu-qom.h
+++ b/target-arm/cpu-qom.h
@@ -111,6 +111,10 @@ static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
 
 #define ENV_OFFSET offsetof(ARMCPU, env)
 
+#ifndef CONFIG_USER_ONLY
+extern const struct VMStateDescription vmstate_arm_cpu;
+#endif
+
 void register_cp_regs_for_features(ARMCPU *cpu);
 
 void arm_cpu_do_interrupt(CPUState *cpu);
diff --git a/target-arm/cpu.c b/target-arm/cpu.c
index a1e9093..496a59f 100644
--- a/target-arm/cpu.c
+++ b/target-arm/cpu.c
@@ -814,6 +814,7 @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 
     cc->class_by_name = arm_cpu_class_by_name;
     cc->do_interrupt = arm_cpu_do_interrupt;
+    cpu_class_set_vmsd(cc, &vmstate_arm_cpu);
 }
 
 static void cpu_register(const ARMCPUInfo *info)
diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 2b97221..5438444 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -640,8 +640,6 @@ static inline CPUARMState *cpu_init(const char *cpu_model)
 #define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list
 
-#define CPU_SAVE_VERSION 9
-
 /* MMU modes definitions */
 #define MMU_MODE0_SUFFIX _kernel
 #define MMU_MODE1_SUFFIX _user
diff --git a/target-arm/machine.c b/target-arm/machine.c
index 68dca7f..3c41f06 100644
--- a/target-arm/machine.c
+++ b/target-arm/machine.c
@@ -1,237 +1,198 @@
 #include "hw/hw.h"
 #include "hw/boards.h"
 
-void cpu_save(QEMUFile *f, void *opaque)
+static bool vfp_needed(void *opaque)
 {
-    int i;
-    CPUARMState *env = (CPUARMState *)opaque;
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
 
-    for (i = 0; i < 16; i++) {
-        qemu_put_be32(f, env->regs[i]);
-    }
-    qemu_put_be32(f, cpsr_read(env));
-    qemu_put_be32(f, env->spsr);
-    for (i = 0; i < 6; i++) {
-        qemu_put_be32(f, env->banked_spsr[i]);
-        qemu_put_be32(f, env->banked_r13[i]);
-        qemu_put_be32(f, env->banked_r14[i]);
-    }
-    for (i = 0; i < 5; i++) {
-        qemu_put_be32(f, env->usr_regs[i]);
-        qemu_put_be32(f, env->fiq_regs[i]);
-    }
-    qemu_put_be32(f, env->cp15.c0_cpuid);
-    qemu_put_be32(f, env->cp15.c0_cssel);
-    qemu_put_be32(f, env->cp15.c1_sys);
-    qemu_put_be32(f, env->cp15.c1_coproc);
-    qemu_put_be32(f, env->cp15.c1_xscaleauxcr);
-    qemu_put_be32(f, env->cp15.c1_scr);
-    qemu_put_be32(f, env->cp15.c2_base0);
-    qemu_put_be32(f, env->cp15.c2_base0_hi);
-    qemu_put_be32(f, env->cp15.c2_base1);
-    qemu_put_be32(f, env->cp15.c2_base1_hi);
-    qemu_put_be32(f, env->cp15.c2_control);
-    qemu_put_be32(f, env->cp15.c2_mask);
-    qemu_put_be32(f, env->cp15.c2_base_mask);
-    qemu_put_be32(f, env->cp15.c2_data);
-    qemu_put_be32(f, env->cp15.c2_insn);
-    qemu_put_be32(f, env->cp15.c3);
-    qemu_put_be32(f, env->cp15.c5_insn);
-    qemu_put_be32(f, env->cp15.c5_data);
-    for (i = 0; i < 8; i++) {
-        qemu_put_be32(f, env->cp15.c6_region[i]);
-    }
-    qemu_put_be32(f, env->cp15.c6_insn);
-    qemu_put_be32(f, env->cp15.c6_data);
-    qemu_put_be32(f, env->cp15.c7_par);
-    qemu_put_be32(f, env->cp15.c7_par_hi);
-    qemu_put_be32(f, env->cp15.c9_insn);
-    qemu_put_be32(f, env->cp15.c9_data);
-    qemu_put_be32(f, env->cp15.c9_pmcr);
-    qemu_put_be32(f, env->cp15.c9_pmcnten);
-    qemu_put_be32(f, env->cp15.c9_pmovsr);
-    qemu_put_be32(f, env->cp15.c9_pmxevtyper);
-    qemu_put_be32(f, env->cp15.c9_pmuserenr);
-    qemu_put_be32(f, env->cp15.c9_pminten);
-    qemu_put_be32(f, env->cp15.c13_fcse);
-    qemu_put_be32(f, env->cp15.c13_context);
-    qemu_put_be32(f, env->cp15.c13_tls1);
-    qemu_put_be32(f, env->cp15.c13_tls2);
-    qemu_put_be32(f, env->cp15.c13_tls3);
-    qemu_put_be32(f, env->cp15.c15_cpar);
-    qemu_put_be32(f, env->cp15.c15_power_control);
-    qemu_put_be32(f, env->cp15.c15_diagnostic);
-    qemu_put_be32(f, env->cp15.c15_power_diagnostic);
-
-    qemu_put_be64(f, env->features);
-
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
-        for (i = 0;  i < 16; i++) {
-            CPU_DoubleU u;
-            u.d = env->vfp.regs[i];
-            qemu_put_be32(f, u.l.upper);
-            qemu_put_be32(f, u.l.lower);
-        }
-        for (i = 0; i < 16; i++) {
-            qemu_put_be32(f, env->vfp.xregs[i]);
-        }
+    return arm_feature(env, ARM_FEATURE_VFP);
+}
 
+static const VMStateDescription vmstate_vfp = {
+    .name = "cpu/vfp",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 32),
+        VMSTATE_UINT32_ARRAY(env.vfp.xregs, ARMCPU, 16),
         /* TODO: Should use proper FPSCR access functions.  */
-        qemu_put_be32(f, env->vfp.vec_len);
-        qemu_put_be32(f, env->vfp.vec_stride);
-
-        if (arm_feature(env, ARM_FEATURE_VFP3)) {
-            for (i = 16;  i < 32; i++) {
-                CPU_DoubleU u;
-                u.d = env->vfp.regs[i];
-                qemu_put_be32(f, u.l.upper);
-                qemu_put_be32(f, u.l.lower);
-            }
-        }
+        VMSTATE_INT32(env.vfp.vec_len, ARMCPU),
+        VMSTATE_INT32(env.vfp.vec_stride, ARMCPU),
+        VMSTATE_END_OF_LIST()
     }
+};
 
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        for (i = 0; i < 16; i++) {
-            qemu_put_be64(f, env->iwmmxt.regs[i]);
-        }
-        for (i = 0; i < 16; i++) {
-            qemu_put_be32(f, env->iwmmxt.cregs[i]);
-        }
-    }
+static bool iwmmxt_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
 
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        qemu_put_be32(f, env->v7m.other_sp);
-        qemu_put_be32(f, env->v7m.vecbase);
-        qemu_put_be32(f, env->v7m.basepri);
-        qemu_put_be32(f, env->v7m.control);
-        qemu_put_be32(f, env->v7m.current_sp);
-        qemu_put_be32(f, env->v7m.exception);
-    }
+    return arm_feature(env, ARM_FEATURE_IWMMXT);
+}
 
-    if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
-        qemu_put_be32(f, env->teecr);
-        qemu_put_be32(f, env->teehbr);
+static const VMStateDescription vmstate_iwmmxt = {
+    .name = "cpu/iwmmxt",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(env.iwmmxt.regs, ARMCPU, 16),
+        VMSTATE_UINT32_ARRAY(env.iwmmxt.cregs, ARMCPU, 16),
+        VMSTATE_END_OF_LIST()
     }
+};
+
+static bool m_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+
+    return arm_feature(env, ARM_FEATURE_M);
 }
 
-int cpu_load(QEMUFile *f, void *opaque, int version_id)
+const VMStateDescription vmstate_m = {
+    .name = "cpu/m",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.v7m.other_sp, ARMCPU),
+        VMSTATE_UINT32(env.v7m.vecbase, ARMCPU),
+        VMSTATE_UINT32(env.v7m.basepri, ARMCPU),
+        VMSTATE_UINT32(env.v7m.control, ARMCPU),
+        VMSTATE_INT32(env.v7m.current_sp, ARMCPU),
+        VMSTATE_INT32(env.v7m.exception, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool thumb2ee_needed(void *opaque)
 {
-    CPUARMState *env = (CPUARMState *)opaque;
-    int i;
-    uint32_t val;
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
 
-    if (version_id != CPU_SAVE_VERSION)
-        return -EINVAL;
+    return arm_feature(env, ARM_FEATURE_THUMB2EE);
+}
 
-    for (i = 0; i < 16; i++) {
-        env->regs[i] = qemu_get_be32(f);
+static const VMStateDescription vmstate_thumb2ee = {
+    .name = "cpu/thumb2ee",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.teecr, ARMCPU),
+        VMSTATE_UINT32(env.teehbr, ARMCPU),
+        VMSTATE_END_OF_LIST()
     }
-    val = qemu_get_be32(f);
-    /* Avoid mode switch when restoring CPSR.  */
+};
+
+static int get_cpsr(QEMUFile *f, void *opaque, size_t size)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+    uint32_t val = qemu_get_be32(f);
+
+    /* Avoid mode switch when restoring CPSR */
     env->uncached_cpsr = val & CPSR_M;
     cpsr_write(env, val, 0xffffffff);
-    env->spsr = qemu_get_be32(f);
-    for (i = 0; i < 6; i++) {
-        env->banked_spsr[i] = qemu_get_be32(f);
-        env->banked_r13[i] = qemu_get_be32(f);
-        env->banked_r14[i] = qemu_get_be32(f);
-    }
-    for (i = 0; i < 5; i++) {
-        env->usr_regs[i] = qemu_get_be32(f);
-        env->fiq_regs[i] = qemu_get_be32(f);
-    }
-    env->cp15.c0_cpuid = qemu_get_be32(f);
-    env->cp15.c0_cssel = qemu_get_be32(f);
-    env->cp15.c1_sys = qemu_get_be32(f);
-    env->cp15.c1_coproc = qemu_get_be32(f);
-    env->cp15.c1_xscaleauxcr = qemu_get_be32(f);
-    env->cp15.c1_scr = qemu_get_be32(f);
-    env->cp15.c2_base0 = qemu_get_be32(f);
-    env->cp15.c2_base0_hi = qemu_get_be32(f);
-    env->cp15.c2_base1 = qemu_get_be32(f);
-    env->cp15.c2_base1_hi = qemu_get_be32(f);
-    env->cp15.c2_control = qemu_get_be32(f);
-    env->cp15.c2_mask = qemu_get_be32(f);
-    env->cp15.c2_base_mask = qemu_get_be32(f);
-    env->cp15.c2_data = qemu_get_be32(f);
-    env->cp15.c2_insn = qemu_get_be32(f);
-    env->cp15.c3 = qemu_get_be32(f);
-    env->cp15.c5_insn = qemu_get_be32(f);
-    env->cp15.c5_data = qemu_get_be32(f);
-    for (i = 0; i < 8; i++) {
-        env->cp15.c6_region[i] = qemu_get_be32(f);
-    }
-    env->cp15.c6_insn = qemu_get_be32(f);
-    env->cp15.c6_data = qemu_get_be32(f);
-    env->cp15.c7_par = qemu_get_be32(f);
-    env->cp15.c7_par_hi = qemu_get_be32(f);
-    env->cp15.c9_insn = qemu_get_be32(f);
-    env->cp15.c9_data = qemu_get_be32(f);
-    env->cp15.c9_pmcr = qemu_get_be32(f);
-    env->cp15.c9_pmcnten = qemu_get_be32(f);
-    env->cp15.c9_pmovsr = qemu_get_be32(f);
-    env->cp15.c9_pmxevtyper = qemu_get_be32(f);
-    env->cp15.c9_pmuserenr = qemu_get_be32(f);
-    env->cp15.c9_pminten = qemu_get_be32(f);
-    env->cp15.c13_fcse = qemu_get_be32(f);
-    env->cp15.c13_context = qemu_get_be32(f);
-    env->cp15.c13_tls1 = qemu_get_be32(f);
-    env->cp15.c13_tls2 = qemu_get_be32(f);
-    env->cp15.c13_tls3 = qemu_get_be32(f);
-    env->cp15.c15_cpar = qemu_get_be32(f);
-    env->cp15.c15_power_control = qemu_get_be32(f);
-    env->cp15.c15_diagnostic = qemu_get_be32(f);
-    env->cp15.c15_power_diagnostic = qemu_get_be32(f);
-
-    env->features = qemu_get_be64(f);
-
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
-        for (i = 0;  i < 16; i++) {
-            CPU_DoubleU u;
-            u.l.upper = qemu_get_be32(f);
-            u.l.lower = qemu_get_be32(f);
-            env->vfp.regs[i] = u.d;
-        }
-        for (i = 0; i < 16; i++) {
-            env->vfp.xregs[i] = qemu_get_be32(f);
-        }
-
-        /* TODO: Should use proper FPSCR access functions.  */
-        env->vfp.vec_len = qemu_get_be32(f);
-        env->vfp.vec_stride = qemu_get_be32(f);
-
-        if (arm_feature(env, ARM_FEATURE_VFP3)) {
-            for (i = 16;  i < 32; i++) {
-                CPU_DoubleU u;
-                u.l.upper = qemu_get_be32(f);
-                u.l.lower = qemu_get_be32(f);
-                env->vfp.regs[i] = u.d;
-            }
-        }
-    }
+    return 0;
+}
 
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        for (i = 0; i < 16; i++) {
-            env->iwmmxt.regs[i] = qemu_get_be64(f);
-        }
-        for (i = 0; i < 16; i++) {
-            env->iwmmxt.cregs[i] = qemu_get_be32(f);
-        }
-    }
+static void put_cpsr(QEMUFile *f, void *opaque, size_t size)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
 
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        env->v7m.other_sp = qemu_get_be32(f);
-        env->v7m.vecbase = qemu_get_be32(f);
-        env->v7m.basepri = qemu_get_be32(f);
-        env->v7m.control = qemu_get_be32(f);
-        env->v7m.current_sp = qemu_get_be32(f);
-        env->v7m.exception = qemu_get_be32(f);
-    }
+    qemu_put_be32(f, cpsr_read(env));
+}
 
-    if (arm_feature(env, ARM_FEATURE_THUMB2EE)) {
-        env->teecr = qemu_get_be32(f);
-        env->teehbr = qemu_get_be32(f);
+static const VMStateInfo vmstate_cpsr = {
+    .name = "cpsr",
+    .get = get_cpsr,
+    .put = put_cpsr,
+};
+
+const VMStateDescription vmstate_arm_cpu = {
+    .name = "cpu",
+    .version_id = 10,
+    .minimum_version_id = 10,
+    .minimum_version_id_old = 10,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
+        {
+            .name = "cpsr",
+            .version_id = 0,
+            .size = sizeof(uint32_t),
+            .info = &vmstate_cpsr,
+            .flags = VMS_SINGLE,
+            .offset = 0,
+        },
+        VMSTATE_UINT32(env.spsr, ARMCPU),
+        VMSTATE_UINT32_ARRAY(env.banked_spsr, ARMCPU, 6),
+        VMSTATE_UINT32_ARRAY(env.banked_r13, ARMCPU, 6),
+        VMSTATE_UINT32_ARRAY(env.banked_r14, ARMCPU, 6),
+        VMSTATE_UINT32_ARRAY(env.usr_regs, ARMCPU, 5),
+        VMSTATE_UINT32_ARRAY(env.fiq_regs, ARMCPU, 5),
+        VMSTATE_UINT32(env.cp15.c0_cpuid, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c0_cssel, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c1_sys, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c1_coproc, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c1_xscaleauxcr, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c1_scr, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_base0, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_base0_hi, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_base1, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_base1_hi, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_control, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_mask, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_base_mask, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_data, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c2_insn, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c3, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c5_insn, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c5_data, ARMCPU),
+        VMSTATE_UINT32_ARRAY(env.cp15.c6_region, ARMCPU, 8),
+        VMSTATE_UINT32(env.cp15.c6_insn, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c6_data, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c7_par, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c7_par_hi, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_insn, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_data, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pmcr, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pmcnten, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pmovsr, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pmxevtyper, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pmuserenr, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c9_pminten, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c13_fcse, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c13_context, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c13_tls1, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c13_tls2, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c13_tls3, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_cpar, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_power_control, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_diagnostic, ARMCPU),
+        VMSTATE_UINT32(env.cp15.c15_power_diagnostic, ARMCPU),
+        VMSTATE_UINT64(env.features, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection[]) {
+        {
+            .vmsd = &vmstate_vfp,
+            .needed = vfp_needed,
+        } , {
+            .vmsd = &vmstate_iwmmxt,
+            .needed = iwmmxt_needed,
+        } , {
+            .vmsd = &vmstate_m,
+            .needed = m_needed,
+        } , {
+            .vmsd = &vmstate_thumb2ee,
+            .needed = thumb2ee_needed,
+        } , {
+            /* empty */
+        }
     }
-
-    return 0;
-}
+};
commit 3b3284486be6898937395fac3ddbd2e68c5cb52f
Author: Peter Chubb <peter.chubb at nicta.com.au>
Date:   Fri Apr 19 12:24:18 2013 +0100

    target-arm: Reinsert missing return statement in ARM mode SRS decode
    
    Since patch
       81465888c5306cd94abb9847e560796fd13d3c2f
       target-arm: factor out handling of SRS instruction
    the ARM mode SRS instruction has not worked in QEMU.
    
    The problem is a missing return directive that was removed in the
    refactoring, so after decoding the instruction, qemu would fall through
    to generate an UNDEF exception for an illegal instruction.
    
    Signed-off-by: Peter Chubb <peter.chubb at nicta.com.au>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/target-arm/translate.c b/target-arm/translate.c
index 35a21be..a1b7b8c 100644
--- a/target-arm/translate.c
+++ b/target-arm/translate.c
@@ -6762,6 +6762,7 @@ static void disas_arm_insn(CPUARMState * env, DisasContext *s)
             }
             ARCH(6);
             gen_srs(s, (insn & 0x1f), (insn >> 23) & 3, insn & (1 << 21));
+            return;
         } else if ((insn & 0x0e50ffe0) == 0x08100a00) {
             /* rfe */
             int32_t offset;
commit af9277e69df688ebb8ccccb7edecc45f0f85ea51
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:21 2013 +0100

    hw/versatile_pci: Drop unnecessary vpb_pci_config_addr()
    
    Drop the vpb_pci_config_addr() function -- it is unnecessary since
    the size of the memory regions means the hwaddr is always within
    the 24 bit size. (This function was probably a leftover from when
    read/write functions were called with absolute addresses rather
    than relative ones.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index e99f35f..540daf7 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -214,11 +214,6 @@ static const MemoryRegionOps pci_vpb_reg_ops = {
     },
 };
 
-static inline uint32_t vpb_pci_config_addr(hwaddr addr)
-{
-    return addr & 0xffffff;
-}
-
 static void pci_vpb_config_write(void *opaque, hwaddr addr,
                                  uint64_t val, unsigned size)
 {
@@ -234,7 +229,7 @@ static void pci_vpb_config_write(void *opaque, hwaddr addr,
             }
         }
     }
-    pci_data_write(&s->pci_bus, vpb_pci_config_addr(addr), val, size);
+    pci_data_write(&s->pci_bus, addr, val, size);
 }
 
 static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
@@ -242,7 +237,7 @@ static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
 {
     PCIVPBState *s = opaque;
     uint32_t val;
-    val = pci_data_read(&s->pci_bus, vpb_pci_config_addr(addr), size);
+    val = pci_data_read(&s->pci_bus, addr, size);
     return val;
 }
 
commit 89a32d32fb573b32bbe129421602c2b3c3c247ec
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:20 2013 +0100

    versatile_pci: Expose PCI memory space to system
    
    The VersatilePB's PCI controller exposes the PCI memory space to the
    system via three regions controlled by the mapping control registers.
    Implement this so that guests can actually use MMIO-BAR PCI cards.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index 8f561c2..d6f47bf 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -221,6 +221,9 @@ static void realview_init(QEMUMachineInitArgs *args,
         sysbus_mmio_map(busdev, 1, 0x60000000); /* PCI self-config */
         sysbus_mmio_map(busdev, 2, 0x61000000); /* PCI config */
         sysbus_mmio_map(busdev, 3, 0x62000000); /* PCI I/O */
+        sysbus_mmio_map(busdev, 4, 0x63000000); /* PCI memory window 1 */
+        sysbus_mmio_map(busdev, 5, 0x64000000); /* PCI memory window 2 */
+        sysbus_mmio_map(busdev, 6, 0x68000000); /* PCI memory window 3 */
         sysbus_connect_irq(busdev, 0, pic[48]);
         sysbus_connect_irq(busdev, 1, pic[49]);
         sysbus_connect_irq(busdev, 2, pic[50]);
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 8128fcd..753757e 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -228,6 +228,9 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
     sysbus_mmio_map(busdev, 1, 0x41000000); /* PCI self-config */
     sysbus_mmio_map(busdev, 2, 0x42000000); /* PCI config */
     sysbus_mmio_map(busdev, 3, 0x43000000); /* PCI I/O */
+    sysbus_mmio_map(busdev, 4, 0x44000000); /* PCI memory window 1 */
+    sysbus_mmio_map(busdev, 5, 0x50000000); /* PCI memory window 2 */
+    sysbus_mmio_map(busdev, 6, 0x60000000); /* PCI memory window 3 */
     sysbus_connect_irq(busdev, 0, sic[27]);
     sysbus_connect_irq(busdev, 1, sic[28]);
     sysbus_connect_irq(busdev, 2, sic[29]);
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index b0132e6..e99f35f 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -42,13 +42,20 @@ typedef struct {
     MemoryRegion controlregs;
     MemoryRegion mem_config;
     MemoryRegion mem_config2;
+    /* Containers representing the PCI address spaces */
     MemoryRegion pci_io_space;
+    MemoryRegion pci_mem_space;
+    /* Alias regions into PCI address spaces which we expose as sysbus regions.
+     * The offsets into pci_mem_space are controlled by the imap registers.
+     */
     MemoryRegion pci_io_window;
+    MemoryRegion pci_mem_window[3];
     PCIBus pci_bus;
     PCIDevice pci_dev;
 
     /* Constant for life of device: */
     int realview;
+    uint32_t mem_win_size[3];
 
     /* Variable state: */
     uint32_t imap[3];
@@ -58,10 +65,49 @@ typedef struct {
     uint8_t irq_mapping;
 } PCIVPBState;
 
+static void pci_vpb_update_window(PCIVPBState *s, int i)
+{
+    /* Adjust the offset of the alias region we use for
+     * the memory window i to account for a change in the
+     * value of the corresponding IMAP register.
+     * Note that the semantics of the IMAP register differ
+     * for realview and versatile variants of the controller.
+     */
+    hwaddr offset;
+    if (s->realview) {
+        /* Top bits of register (masked according to window size) provide
+         * top bits of PCI address.
+         */
+        offset = s->imap[i] & ~(s->mem_win_size[i] - 1);
+    } else {
+        /* Bottom 4 bits of register provide top 4 bits of PCI address */
+        offset = s->imap[i] << 28;
+    }
+    memory_region_set_alias_offset(&s->pci_mem_window[i], offset);
+}
+
+static void pci_vpb_update_all_windows(PCIVPBState *s)
+{
+    /* Update all alias windows based on the current register state */
+    int i;
+
+    for (i = 0; i < 3; i++) {
+        pci_vpb_update_window(s, i);
+    }
+}
+
+static int pci_vpb_post_load(void *opaque, int version_id)
+{
+    PCIVPBState *s = opaque;
+    pci_vpb_update_all_windows(s);
+    return 0;
+}
+
 static const VMStateDescription pci_vpb_vmstate = {
     .name = "versatile-pci",
     .version_id = 1,
     .minimum_version_id = 1,
+    .post_load = pci_vpb_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3),
         VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3),
@@ -103,6 +149,7 @@ static void pci_vpb_reg_write(void *opaque, hwaddr addr,
     {
         int win = (addr - PCI_IMAP0) >> 2;
         s->imap[win] = val;
+        pci_vpb_update_window(s, win);
         break;
     }
     case PCI_SELFID:
@@ -270,6 +317,8 @@ static void pci_vpb_reset(DeviceState *d)
     s->selfid = 0;
     s->flags = 0;
     s->irq_mapping = PCI_VPB_IRQMAP_ASSUME_OK;
+
+    pci_vpb_update_all_windows(s);
 }
 
 static void pci_vpb_init(Object *obj)
@@ -278,9 +327,10 @@ static void pci_vpb_init(Object *obj)
     PCIVPBState *s = PCI_VPB(obj);
 
     memory_region_init(&s->pci_io_space, "pci_io", 1ULL << 32);
+    memory_region_init(&s->pci_mem_space, "pci_mem", 1ULL << 32);
 
     pci_bus_new_inplace(&s->pci_bus, DEVICE(obj), "pci",
-                        get_system_memory(), &s->pci_io_space,
+                        &s->pci_mem_space, &s->pci_io_space,
                         PCI_DEVFN(11, 0), TYPE_PCI_BUS);
     h->bus = &s->pci_bus;
 
@@ -288,6 +338,11 @@ static void pci_vpb_init(Object *obj)
     qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
     object_property_set_int(OBJECT(&s->pci_dev), PCI_DEVFN(29, 0), "addr",
                             NULL);
+
+    /* Window sizes for VersatilePB; realview_pci's init will override */
+    s->mem_win_size[0] = 0x0c000000;
+    s->mem_win_size[1] = 0x10000000;
+    s->mem_win_size[2] = 0x10000000;
 }
 
 static void pci_vpb_realize(DeviceState *dev, Error **errp)
@@ -314,6 +369,7 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * 1 : PCI self config window
      * 2 : PCI config window
      * 3 : PCI IO window
+     * 4..6 : PCI memory windows
      */
     memory_region_init_io(&s->controlregs, &pci_vpb_reg_ops, s, "pci-vpb-regs",
                           0x1000);
@@ -333,6 +389,16 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
 
     sysbus_init_mmio(sbd, &s->pci_io_space);
 
+    /* Create the alias regions corresponding to our three windows onto
+     * PCI memory space. The sizes vary from board to board; the base
+     * offsets are guest controllable via the IMAP registers.
+     */
+    for (i = 0; i < 3; i++) {
+        memory_region_init_alias(&s->pci_mem_window[i], "pci-vbp-window",
+                                 &s->pci_mem_space, 0, s->mem_win_size[i]);
+        sysbus_init_mmio(sbd, &s->pci_mem_window[i]);
+    }
+
     /* TODO Remove once realize propagates to child devices. */
     object_property_set_bool(OBJECT(&s->pci_dev), true, "realized", errp);
 }
@@ -384,6 +450,10 @@ static void pci_realview_init(Object *obj)
     PCIVPBState *s = PCI_VPB(obj);
 
     s->realview = 1;
+    /* The PCI window sizes are different on Realview boards */
+    s->mem_win_size[0] = 0x01000000;
+    s->mem_win_size[1] = 0x04000000;
+    s->mem_win_size[2] = 0x08000000;
 }
 
 static const TypeInfo pci_realview_info = {
commit a2bff788d2316c037ce5ab72468b3fda1a0527a1
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:20 2013 +0100

    arm/realview: Fix mapping of PCI regions
    
    Fix the mapping of the PCI regions for the realview board, which were
    all incorrect. (This was never noticed because the Linux kernel
    doesn't actually include a PCI driver for the realview boards.)
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index df907d1..8f561c2 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -218,9 +218,9 @@ static void realview_init(QEMUMachineInitArgs *args,
         busdev = SYS_BUS_DEVICE(dev);
         qdev_init_nofail(dev);
         sysbus_mmio_map(busdev, 0, 0x10019000); /* PCI controller registers */
-        sysbus_mmio_map(busdev, 1, 0x61000000); /* PCI self-config */
-        sysbus_mmio_map(busdev, 2, 0x62000000); /* PCI config */
-        sysbus_mmio_map(busdev, 3, 0x63000000); /* PCI I/O */
+        sysbus_mmio_map(busdev, 1, 0x60000000); /* PCI self-config */
+        sysbus_mmio_map(busdev, 2, 0x61000000); /* PCI config */
+        sysbus_mmio_map(busdev, 3, 0x62000000); /* PCI I/O */
         sysbus_connect_irq(busdev, 0, pic[48]);
         sysbus_connect_irq(busdev, 1, pic[49]);
         sysbus_connect_irq(busdev, 2, pic[50]);
@@ -304,12 +304,12 @@ static void realview_init(QEMUMachineInitArgs *args,
     /*  0x58000000 PISMO.  */
     /*  0x5c000000 PISMO.  */
     /* 0x60000000 PCI.  */
-    /* 0x61000000 PCI Self Config.  */
-    /* 0x62000000 PCI Config.  */
-    /* 0x63000000 PCI IO.  */
-    /* 0x64000000 PCI mem 0.  */
-    /* 0x68000000 PCI mem 1.  */
-    /* 0x6c000000 PCI mem 2.  */
+    /* 0x60000000 PCI Self Config.  */
+    /* 0x61000000 PCI Config.  */
+    /* 0x62000000 PCI IO.  */
+    /* 0x63000000 PCI mem 0.  */
+    /* 0x64000000 PCI mem 1.  */
+    /* 0x68000000 PCI mem 2.  */
 
     /* ??? Hack to map an additional page of ram for the secondary CPU
        startup code.  I guess this works on real hardware because the
commit 7468d73ac9a514b33c0c2797a1238db11163b23b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:20 2013 +0100

    versatile_pci: Implement the PCI controller's control registers
    
    The versatile_pci PCI controller has a set of control registers which
    handle the mapping between PCI and system address spaces. Implement
    these registers (though for now they have no effect since we don't
    implement mapping PCI space into system memory at all).
    
    The most natural order for our sysbus regions has the control
    registers at the start, so move all the others down one.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index feabfc5..df907d1 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -217,9 +217,10 @@ static void realview_init(QEMUMachineInitArgs *args,
         dev = qdev_create(NULL, "realview_pci");
         busdev = SYS_BUS_DEVICE(dev);
         qdev_init_nofail(dev);
-        sysbus_mmio_map(busdev, 0, 0x61000000); /* PCI self-config */
-        sysbus_mmio_map(busdev, 1, 0x62000000); /* PCI config */
-        sysbus_mmio_map(busdev, 2, 0x63000000); /* PCI I/O */
+        sysbus_mmio_map(busdev, 0, 0x10019000); /* PCI controller registers */
+        sysbus_mmio_map(busdev, 1, 0x61000000); /* PCI self-config */
+        sysbus_mmio_map(busdev, 2, 0x62000000); /* PCI config */
+        sysbus_mmio_map(busdev, 3, 0x63000000); /* PCI I/O */
         sysbus_connect_irq(busdev, 0, pic[48]);
         sysbus_connect_irq(busdev, 1, pic[49]);
         sysbus_connect_irq(busdev, 2, pic[50]);
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 33a8222..8128fcd 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -224,9 +224,10 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
     dev = qdev_create(NULL, "versatile_pci");
     busdev = SYS_BUS_DEVICE(dev);
     qdev_init_nofail(dev);
-    sysbus_mmio_map(busdev, 0, 0x41000000); /* PCI self-config */
-    sysbus_mmio_map(busdev, 1, 0x42000000); /* PCI config */
-    sysbus_mmio_map(busdev, 2, 0x43000000); /* PCI I/O */
+    sysbus_mmio_map(busdev, 0, 0x10001000); /* PCI controller regs */
+    sysbus_mmio_map(busdev, 1, 0x41000000); /* PCI self-config */
+    sysbus_mmio_map(busdev, 2, 0x42000000); /* PCI config */
+    sysbus_mmio_map(busdev, 3, 0x43000000); /* PCI I/O */
     sysbus_connect_irq(busdev, 0, sic[27]);
     sysbus_connect_irq(busdev, 1, sic[28]);
     sysbus_connect_irq(busdev, 2, sic[29]);
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 5d543a9..b0132e6 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -39,6 +39,7 @@ typedef struct {
     PCIHostState parent_obj;
 
     qemu_irq irq[4];
+    MemoryRegion controlregs;
     MemoryRegion mem_config;
     MemoryRegion mem_config2;
     MemoryRegion pci_io_space;
@@ -50,9 +51,27 @@ typedef struct {
     int realview;
 
     /* Variable state: */
+    uint32_t imap[3];
+    uint32_t smap[3];
+    uint32_t selfid;
+    uint32_t flags;
     uint8_t irq_mapping;
 } PCIVPBState;
 
+static const VMStateDescription pci_vpb_vmstate = {
+    .name = "versatile-pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(imap, PCIVPBState, 3),
+        VMSTATE_UINT32_ARRAY(smap, PCIVPBState, 3),
+        VMSTATE_UINT32(selfid, PCIVPBState),
+        VMSTATE_UINT32(flags, PCIVPBState),
+        VMSTATE_UINT8(irq_mapping, PCIVPBState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 #define TYPE_VERSATILE_PCI "versatile_pci"
 #define PCI_VPB(obj) \
     OBJECT_CHECK(PCIVPBState, (obj), TYPE_VERSATILE_PCI)
@@ -61,6 +80,93 @@ typedef struct {
 #define PCI_VPB_HOST(obj) \
     OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST)
 
+typedef enum {
+    PCI_IMAP0 = 0x0,
+    PCI_IMAP1 = 0x4,
+    PCI_IMAP2 = 0x8,
+    PCI_SELFID = 0xc,
+    PCI_FLAGS = 0x10,
+    PCI_SMAP0 = 0x14,
+    PCI_SMAP1 = 0x18,
+    PCI_SMAP2 = 0x1c,
+} PCIVPBControlRegs;
+
+static void pci_vpb_reg_write(void *opaque, hwaddr addr,
+                              uint64_t val, unsigned size)
+{
+    PCIVPBState *s = opaque;
+
+    switch (addr) {
+    case PCI_IMAP0:
+    case PCI_IMAP1:
+    case PCI_IMAP2:
+    {
+        int win = (addr - PCI_IMAP0) >> 2;
+        s->imap[win] = val;
+        break;
+    }
+    case PCI_SELFID:
+        s->selfid = val;
+        break;
+    case PCI_FLAGS:
+        s->flags = val;
+        break;
+    case PCI_SMAP0:
+    case PCI_SMAP1:
+    case PCI_SMAP2:
+    {
+        int win = (addr - PCI_SMAP0) >> 2;
+        s->smap[win] = val;
+        break;
+    }
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "pci_vpb_reg_write: Bad offset %x\n", (int)addr);
+        break;
+    }
+}
+
+static uint64_t pci_vpb_reg_read(void *opaque, hwaddr addr,
+                                 unsigned size)
+{
+    PCIVPBState *s = opaque;
+
+    switch (addr) {
+    case PCI_IMAP0:
+    case PCI_IMAP1:
+    case PCI_IMAP2:
+    {
+        int win = (addr - PCI_IMAP0) >> 2;
+        return s->imap[win];
+    }
+    case PCI_SELFID:
+        return s->selfid;
+    case PCI_FLAGS:
+        return s->flags;
+    case PCI_SMAP0:
+    case PCI_SMAP1:
+    case PCI_SMAP2:
+    {
+        int win = (addr - PCI_SMAP0) >> 2;
+        return s->smap[win];
+    }
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "pci_vpb_reg_read: Bad offset %x\n", (int)addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps pci_vpb_reg_ops = {
+    .read = pci_vpb_reg_read,
+    .write = pci_vpb_reg_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
 static inline uint32_t vpb_pci_config_addr(hwaddr addr)
 {
     return addr & 0xffffff;
@@ -155,6 +261,14 @@ static void pci_vpb_reset(DeviceState *d)
 {
     PCIVPBState *s = PCI_VPB(d);
 
+    s->imap[0] = 0;
+    s->imap[1] = 0;
+    s->imap[2] = 0;
+    s->smap[0] = 0;
+    s->smap[1] = 0;
+    s->smap[2] = 0;
+    s->selfid = 0;
+    s->flags = 0;
     s->irq_mapping = PCI_VPB_IRQMAP_ASSUME_OK;
 }
 
@@ -195,13 +309,15 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
 
     pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4);
 
-    /* ??? Register memory space.  */
-
     /* Our memory regions are:
-     * 0 : PCI self config window
-     * 1 : PCI config window
-     * 2 : PCI IO window
+     * 0 : our control registers
+     * 1 : PCI self config window
+     * 2 : PCI config window
+     * 3 : PCI IO window
      */
+    memory_region_init_io(&s->controlregs, &pci_vpb_reg_ops, s, "pci-vpb-regs",
+                          0x1000);
+    sysbus_init_mmio(sbd, &s->controlregs);
     memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, s,
                           "pci-vpb-selfconfig", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config);
@@ -252,6 +368,7 @@ static void pci_vpb_class_init(ObjectClass *klass, void *data)
 
     dc->realize = pci_vpb_realize;
     dc->reset = pci_vpb_reset;
+    dc->vmsd = &pci_vpb_vmstate;
 }
 
 static const TypeInfo pci_vpb_info = {
commit 66a96d7018b9cbabb73c9b87b62a37e4cc46580a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:19 2013 +0100

    versatile_pci: Implement the correct PCI IRQ mapping
    
    Implement the correct IRQ mapping for the Versatile PCI controller; it
    differs between realview and versatile boards, but the previous QEMU
    implementation was correct only for the first PCI card on a versatile
    board, since we weren't swizzling IRQs based on the slot number.
    
    Since this change would otherwise break any uses of PCI on Linux kernels
    which have an equivalent bug (since they have effectively only been
    tested against QEMU, not real hardware), we implement a mechanism
    for automatically detecting those broken kernels and switching back
    to the old mapping. This works by looking at the values the kernel
    writes to the PCI_INTERRUPT_LINE register in the config space, which
    is effectively the interrupt number the kernel expects the device
    to be using.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 8f8612c..5d543a9 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -13,6 +13,28 @@
 #include "hw/pci/pci_host.h"
 #include "exec/address-spaces.h"
 
+/* Old and buggy versions of QEMU used the wrong mapping from
+ * PCI IRQs to system interrupt lines. Unfortunately the Linux
+ * kernel also had the corresponding bug in setting up interrupts
+ * (so older kernels work on QEMU and not on real hardware).
+ * We automatically detect these broken kernels and flip back
+ * to the broken irq mapping by spotting guest writes to the
+ * PCI_INTERRUPT_LINE register to see where the guest thinks
+ * interrupts are going to be routed. So we start in state
+ * ASSUME_OK on reset, and transition to either BROKEN or
+ * FORCE_OK at the first write to an INTERRUPT_LINE register for
+ * a slot where broken and correct interrupt mapping would differ.
+ * Once in either BROKEN or FORCE_OK we never transition again;
+ * this allows a newer kernel to use the INTERRUPT_LINE
+ * registers arbitrarily once it has indicated that it isn't
+ * broken in its init code somewhere.
+ */
+enum {
+    PCI_VPB_IRQMAP_ASSUME_OK,
+    PCI_VPB_IRQMAP_BROKEN,
+    PCI_VPB_IRQMAP_FORCE_OK,
+};
+
 typedef struct {
     PCIHostState parent_obj;
 
@@ -26,6 +48,9 @@ typedef struct {
 
     /* Constant for life of device: */
     int realview;
+
+    /* Variable state: */
+    uint8_t irq_mapping;
 } PCIVPBState;
 
 #define TYPE_VERSATILE_PCI "versatile_pci"
@@ -44,14 +69,27 @@ static inline uint32_t vpb_pci_config_addr(hwaddr addr)
 static void pci_vpb_config_write(void *opaque, hwaddr addr,
                                  uint64_t val, unsigned size)
 {
-    pci_data_write(opaque, vpb_pci_config_addr(addr), val, size);
+    PCIVPBState *s = opaque;
+    if (!s->realview && (addr & 0xff) == PCI_INTERRUPT_LINE
+        && s->irq_mapping == PCI_VPB_IRQMAP_ASSUME_OK) {
+        uint8_t devfn = addr >> 8;
+        if ((PCI_SLOT(devfn) % PCI_NUM_PINS) != 2) {
+            if (val == 27) {
+                s->irq_mapping = PCI_VPB_IRQMAP_BROKEN;
+            } else {
+                s->irq_mapping = PCI_VPB_IRQMAP_FORCE_OK;
+            }
+        }
+    }
+    pci_data_write(&s->pci_bus, vpb_pci_config_addr(addr), val, size);
 }
 
 static uint64_t pci_vpb_config_read(void *opaque, hwaddr addr,
                                     unsigned size)
 {
+    PCIVPBState *s = opaque;
     uint32_t val;
-    val = pci_data_read(opaque, vpb_pci_config_addr(addr), size);
+    val = pci_data_read(&s->pci_bus, vpb_pci_config_addr(addr), size);
     return val;
 }
 
@@ -63,7 +101,47 @@ static const MemoryRegionOps pci_vpb_config_ops = {
 
 static int pci_vpb_map_irq(PCIDevice *d, int irq_num)
 {
-    return irq_num;
+    PCIVPBState *s = container_of(d->bus, PCIVPBState, pci_bus);
+
+    if (s->irq_mapping == PCI_VPB_IRQMAP_BROKEN) {
+        /* Legacy broken IRQ mapping for compatibility with old and
+         * buggy Linux guests
+         */
+        return irq_num;
+    }
+
+    /* Slot to IRQ mapping for RealView Platform Baseboard 926 backplane
+     *      name    slot    IntA    IntB    IntC    IntD
+     *      A       31      IRQ28   IRQ29   IRQ30   IRQ27
+     *      B       30      IRQ27   IRQ28   IRQ29   IRQ30
+     *      C       29      IRQ30   IRQ27   IRQ28   IRQ29
+     * Slot C is for the host bridge; A and B the peripherals.
+     * Our output irqs 0..3 correspond to the baseboard's 27..30.
+     *
+     * This mapping function takes account of an oddity in the PB926
+     * board wiring, where the FPGA's P_nINTA input is connected to
+     * the INTB connection on the board PCI edge connector, P_nINTB
+     * is connected to INTC, and so on, so everything is one number
+     * further round from where you might expect.
+     */
+    return pci_swizzle_map_irq_fn(d, irq_num + 2);
+}
+
+static int pci_vpb_rv_map_irq(PCIDevice *d, int irq_num)
+{
+    /* Slot to IRQ mapping for RealView EB and PB1176 backplane
+     *      name    slot    IntA    IntB    IntC    IntD
+     *      A       31      IRQ50   IRQ51   IRQ48   IRQ49
+     *      B       30      IRQ49   IRQ50   IRQ51   IRQ48
+     *      C       29      IRQ48   IRQ49   IRQ50   IRQ51
+     * Slot C is for the host bridge; A and B the peripherals.
+     * Our output irqs 0..3 correspond to the baseboard's 48..51.
+     *
+     * The PB1176 and EB boards don't have the PB926 wiring oddity
+     * described above; P_nINTA connects to INTA, P_nINTB to INTB
+     * and so on, which is why this mapping function is different.
+     */
+    return pci_swizzle_map_irq_fn(d, irq_num + 3);
 }
 
 static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
@@ -73,6 +151,13 @@ static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(pic[irq_num], level);
 }
 
+static void pci_vpb_reset(DeviceState *d)
+{
+    PCIVPBState *s = PCI_VPB(d);
+
+    s->irq_mapping = PCI_VPB_IRQMAP_ASSUME_OK;
+}
+
 static void pci_vpb_init(Object *obj)
 {
     PCIHostState *h = PCI_HOST_BRIDGE(obj);
@@ -95,13 +180,20 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
 {
     PCIVPBState *s = PCI_VPB(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    pci_map_irq_fn mapfn;
     int i;
 
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(sbd, &s->irq[i]);
     }
 
-    pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, pci_vpb_map_irq, s->irq, 4);
+    if (s->realview) {
+        mapfn = pci_vpb_rv_map_irq;
+    } else {
+        mapfn = pci_vpb_map_irq;
+    }
+
+    pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, mapfn, s->irq, 4);
 
     /* ??? Register memory space.  */
 
@@ -110,10 +202,10 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * 1 : PCI config window
      * 2 : PCI IO window
      */
-    memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, &s->pci_bus,
+    memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, s,
                           "pci-vpb-selfconfig", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config);
-    memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, &s->pci_bus,
+    memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, s,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config2);
 
@@ -159,6 +251,7 @@ static void pci_vpb_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->realize = pci_vpb_realize;
+    dc->reset = pci_vpb_reset;
 }
 
 static const TypeInfo pci_vpb_info = {
commit 5f37ef92b7690423ac6311d3c597e182fc5f8fe6
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:19 2013 +0100

    versatile_pci: Put the host bridge PCI device at slot 29
    
    On real hardware the host bridge appears as a PCI device in slot 29,
    so make QEMU put its host bridge in that slot too.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index ce5bdf2..8f8612c 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -87,6 +87,8 @@ static void pci_vpb_init(Object *obj)
 
     object_initialize(&s->pci_dev, TYPE_VERSATILE_PCI_HOST);
     qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
+    object_property_set_int(OBJECT(&s->pci_dev), PCI_DEVFN(29, 0), "addr",
+                            NULL);
 }
 
 static void pci_vpb_realize(DeviceState *dev, Error **errp)
commit 967c2607496087abf84904c82e6de0cd320a3831
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:18 2013 +0100

    versatile_pci: Use separate PCI I/O space rather than system I/O space
    
    Rather than overloading the system I/O space (which doesn't even make
    any sense on ARM) for PCI I/O, create an memory region in the PCI
    controller and use that to represent the I/O space.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 9e0ece0..ce5bdf2 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -19,7 +19,8 @@ typedef struct {
     qemu_irq irq[4];
     MemoryRegion mem_config;
     MemoryRegion mem_config2;
-    MemoryRegion isa;
+    MemoryRegion pci_io_space;
+    MemoryRegion pci_io_window;
     PCIBus pci_bus;
     PCIDevice pci_dev;
 
@@ -77,8 +78,10 @@ static void pci_vpb_init(Object *obj)
     PCIHostState *h = PCI_HOST_BRIDGE(obj);
     PCIVPBState *s = PCI_VPB(obj);
 
+    memory_region_init(&s->pci_io_space, "pci_io", 1ULL << 32);
+
     pci_bus_new_inplace(&s->pci_bus, DEVICE(obj), "pci",
-                        get_system_memory(), get_system_io(),
+                        get_system_memory(), &s->pci_io_space,
                         PCI_DEVFN(11, 0), TYPE_PCI_BUS);
     h->bus = &s->pci_bus;
 
@@ -111,8 +114,14 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, &s->pci_bus,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config2);
-    isa_mmio_setup(&s->isa, 0x0100000);
-    sysbus_init_mmio(sbd, &s->isa);
+
+    /* The window into I/O space is always into a fixed base address;
+     * its size is the same for both realview and versatile.
+     */
+    memory_region_init_alias(&s->pci_io_window, "pci-vbp-io-window",
+                             &s->pci_io_space, 0, 0x100000);
+
+    sysbus_init_mmio(sbd, &s->pci_io_space);
 
     /* TODO Remove once realize propagates to child devices. */
     object_property_set_bool(OBJECT(&s->pci_dev), true, "realized", errp);
commit 0688810b416a5a4a41aa480132e89d65f81dafc6
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:18 2013 +0100

    versatile_pci: Change to subclassing TYPE_PCI_HOST_BRIDGE
    
    Change versatile_pci to subclass TYPE_PCI_HOST_BRIDGE and generally
    handle PCI in a more QOM-like fashion.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index ad33ce7..9e0ece0 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -9,16 +9,22 @@
 
 #include "hw/sysbus.h"
 #include "hw/pci/pci.h"
+#include "hw/pci/pci_bus.h"
 #include "hw/pci/pci_host.h"
 #include "exec/address-spaces.h"
 
 typedef struct {
-    SysBusDevice busdev;
+    PCIHostState parent_obj;
+
     qemu_irq irq[4];
-    int realview;
     MemoryRegion mem_config;
     MemoryRegion mem_config2;
     MemoryRegion isa;
+    PCIBus pci_bus;
+    PCIDevice pci_dev;
+
+    /* Constant for life of device: */
+    int realview;
 } PCIVPBState;
 
 #define TYPE_VERSATILE_PCI "versatile_pci"
@@ -66,20 +72,31 @@ static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(pic[irq_num], level);
 }
 
+static void pci_vpb_init(Object *obj)
+{
+    PCIHostState *h = PCI_HOST_BRIDGE(obj);
+    PCIVPBState *s = PCI_VPB(obj);
+
+    pci_bus_new_inplace(&s->pci_bus, DEVICE(obj), "pci",
+                        get_system_memory(), get_system_io(),
+                        PCI_DEVFN(11, 0), TYPE_PCI_BUS);
+    h->bus = &s->pci_bus;
+
+    object_initialize(&s->pci_dev, TYPE_VERSATILE_PCI_HOST);
+    qdev_set_parent_bus(DEVICE(&s->pci_dev), BUS(&s->pci_bus));
+}
+
 static void pci_vpb_realize(DeviceState *dev, Error **errp)
 {
     PCIVPBState *s = PCI_VPB(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    PCIBus *bus;
     int i;
 
     for (i = 0; i < 4; i++) {
         sysbus_init_irq(sbd, &s->irq[i]);
     }
-    bus = pci_register_bus(dev, "pci",
-                           pci_vpb_set_irq, pci_vpb_map_irq, s->irq,
-                           get_system_memory(), get_system_io(),
-                           PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS);
+
+    pci_bus_irqs(&s->pci_bus, pci_vpb_set_irq, pci_vpb_map_irq, s->irq, 4);
 
     /* ??? Register memory space.  */
 
@@ -88,16 +105,17 @@ static void pci_vpb_realize(DeviceState *dev, Error **errp)
      * 1 : PCI config window
      * 2 : PCI IO window
      */
-    memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, bus,
+    memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, &s->pci_bus,
                           "pci-vpb-selfconfig", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config);
-    memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, bus,
+    memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, &s->pci_bus,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(sbd, &s->mem_config2);
     isa_mmio_setup(&s->isa, 0x0100000);
     sysbus_init_mmio(sbd, &s->isa);
 
-    pci_create_simple(bus, -1, "versatile_pci_host");
+    /* TODO Remove once realize propagates to child devices. */
+    object_property_set_bool(OBJECT(&s->pci_dev), true, "realized", errp);
 }
 
 static int versatile_pci_host_init(PCIDevice *d)
@@ -134,8 +152,9 @@ static void pci_vpb_class_init(ObjectClass *klass, void *data)
 
 static const TypeInfo pci_vpb_info = {
     .name          = TYPE_VERSATILE_PCI,
-    .parent        = TYPE_SYS_BUS_DEVICE,
+    .parent        = TYPE_PCI_HOST_BRIDGE,
     .instance_size = sizeof(PCIVPBState),
+    .instance_init = pci_vpb_init,
     .class_init    = pci_vpb_class_init,
 };
 
commit cd93dbf375bd3d7ccbb7005d8d4e2b91293e967b
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:18 2013 +0100

    versatile_pci: Update to realize and instance init functions
    
    Update the Versatile PCI controller to use a realize function rather
    than SysBusDevice::init. To reflect the fact that the 'realview_pci'
    class is taking most of its implementation from 'versatile_pci' (and
    to make the QOM casts work) we make 'realview_pci' a subclass of
    'versatile_pci'.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index a50a18b..ad33ce7 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -21,6 +21,14 @@ typedef struct {
     MemoryRegion isa;
 } PCIVPBState;
 
+#define TYPE_VERSATILE_PCI "versatile_pci"
+#define PCI_VPB(obj) \
+    OBJECT_CHECK(PCIVPBState, (obj), TYPE_VERSATILE_PCI)
+
+#define TYPE_VERSATILE_PCI_HOST "versatile_pci_host"
+#define PCI_VPB_HOST(obj) \
+    OBJECT_CHECK(PCIDevice, (obj), TYPE_VERSATILE_PCIHOST)
+
 static inline uint32_t vpb_pci_config_addr(hwaddr addr)
 {
     return addr & 0xffffff;
@@ -58,16 +66,17 @@ static void pci_vpb_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(pic[irq_num], level);
 }
 
-static int pci_vpb_init(SysBusDevice *dev)
+static void pci_vpb_realize(DeviceState *dev, Error **errp)
 {
-    PCIVPBState *s = FROM_SYSBUS(PCIVPBState, dev);
+    PCIVPBState *s = PCI_VPB(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     PCIBus *bus;
     int i;
 
     for (i = 0; i < 4; i++) {
-        sysbus_init_irq(dev, &s->irq[i]);
+        sysbus_init_irq(sbd, &s->irq[i]);
     }
-    bus = pci_register_bus(&dev->qdev, "pci",
+    bus = pci_register_bus(dev, "pci",
                            pci_vpb_set_irq, pci_vpb_map_irq, s->irq,
                            get_system_memory(), get_system_io(),
                            PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS);
@@ -81,22 +90,14 @@ static int pci_vpb_init(SysBusDevice *dev)
      */
     memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, bus,
                           "pci-vpb-selfconfig", 0x1000000);
-    sysbus_init_mmio(dev, &s->mem_config);
+    sysbus_init_mmio(sbd, &s->mem_config);
     memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, bus,
                           "pci-vpb-config", 0x1000000);
-    sysbus_init_mmio(dev, &s->mem_config2);
+    sysbus_init_mmio(sbd, &s->mem_config2);
     isa_mmio_setup(&s->isa, 0x0100000);
-    sysbus_init_mmio(dev, &s->isa);
+    sysbus_init_mmio(sbd, &s->isa);
 
     pci_create_simple(bus, -1, "versatile_pci_host");
-    return 0;
-}
-
-static int pci_realview_init(SysBusDevice *dev)
-{
-    PCIVPBState *s = FROM_SYSBUS(PCIVPBState, dev);
-    s->realview = 1;
-    return pci_vpb_init(dev);
 }
 
 static int versatile_pci_host_init(PCIDevice *d)
@@ -118,7 +119,7 @@ static void versatile_pci_host_class_init(ObjectClass *klass, void *data)
 }
 
 static const TypeInfo versatile_pci_host_info = {
-    .name          = "versatile_pci_host",
+    .name          = TYPE_VERSATILE_PCI_HOST,
     .parent        = TYPE_PCI_DEVICE,
     .instance_size = sizeof(PCIDevice),
     .class_init    = versatile_pci_host_class_init,
@@ -126,30 +127,29 @@ static const TypeInfo versatile_pci_host_info = {
 
 static void pci_vpb_class_init(ObjectClass *klass, void *data)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
-    sdc->init = pci_vpb_init;
+    dc->realize = pci_vpb_realize;
 }
 
 static const TypeInfo pci_vpb_info = {
-    .name          = "versatile_pci",
+    .name          = TYPE_VERSATILE_PCI,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(PCIVPBState),
     .class_init    = pci_vpb_class_init,
 };
 
-static void pci_realview_class_init(ObjectClass *klass, void *data)
+static void pci_realview_init(Object *obj)
 {
-    SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass);
+    PCIVPBState *s = PCI_VPB(obj);
 
-    sdc->init = pci_realview_init;
+    s->realview = 1;
 }
 
 static const TypeInfo pci_realview_info = {
     .name          = "realview_pci",
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(PCIVPBState),
-    .class_init    = pci_realview_class_init,
+    .parent        = TYPE_VERSATILE_PCI,
+    .instance_init = pci_realview_init,
 };
 
 static void versatile_pci_register_types(void)
commit 5fb8084f31e9df7f0b2d63cfd3d10645d29b5eab
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:17 2013 +0100

    versatile_pci: Expose PCI I/O region on Versatile PB
    
    Comments in the QEMU source code claim that the version of the PCI
    controller on the VersatilePB board doesn't support the PCI I/O
    region, but this is incorrect; expose that region, map it in the
    correct location, and drop the misleading comments.
    
    This change removes the only currently implemented difference
    between the realview-pci and versatile-pci models; however there
    are other differences in not-yet-implemented functionality, so we
    retain the distinction between the two device types.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 25c665a..33a8222 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -226,14 +226,13 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
     qdev_init_nofail(dev);
     sysbus_mmio_map(busdev, 0, 0x41000000); /* PCI self-config */
     sysbus_mmio_map(busdev, 1, 0x42000000); /* PCI config */
+    sysbus_mmio_map(busdev, 2, 0x43000000); /* PCI I/O */
     sysbus_connect_irq(busdev, 0, sic[27]);
     sysbus_connect_irq(busdev, 1, sic[28]);
     sysbus_connect_irq(busdev, 2, sic[29]);
     sysbus_connect_irq(busdev, 3, sic[30]);
     pci_bus = (PCIBus *)qdev_get_child_bus(dev, "pci");
 
-    /* The Versatile PCI bridge does not provide access to PCI IO space,
-       so many of the qemu PCI devices are not useable.  */
     for(n = 0; n < nb_nics; n++) {
         nd = &nd_table[n];
 
diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index 04d0029..a50a18b 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -77,7 +77,7 @@ static int pci_vpb_init(SysBusDevice *dev)
     /* Our memory regions are:
      * 0 : PCI self config window
      * 1 : PCI config window
-     * 2 : PCI IO window (realview_pci only)
+     * 2 : PCI IO window
      */
     memory_region_init_io(&s->mem_config, &pci_vpb_config_ops, bus,
                           "pci-vpb-selfconfig", 0x1000000);
@@ -85,10 +85,8 @@ static int pci_vpb_init(SysBusDevice *dev)
     memory_region_init_io(&s->mem_config2, &pci_vpb_config_ops, bus,
                           "pci-vpb-config", 0x1000000);
     sysbus_init_mmio(dev, &s->mem_config2);
-    if (s->realview) {
-        isa_mmio_setup(&s->isa, 0x0100000);
-        sysbus_init_mmio(dev, &s->isa);
-    }
+    isa_mmio_setup(&s->isa, 0x0100000);
+    sysbus_init_mmio(dev, &s->isa);
 
     pci_create_simple(bus, -1, "versatile_pci_host");
     return 0;
commit c5c86c5346e927f55918ffdf1b09742fee7a5d8d
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Fri Apr 19 11:15:17 2013 +0100

    versatile_pci: Fix hardcoded tabs
    
    There is just one line in this source file with a hardcoded tab
    indent, so just fix it.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Acked-by: Paul Brook <paul at codesourcery.com>

diff --git a/hw/pci-host/versatile.c b/hw/pci-host/versatile.c
index d67ca79..04d0029 100644
--- a/hw/pci-host/versatile.c
+++ b/hw/pci-host/versatile.c
@@ -104,7 +104,7 @@ static int pci_realview_init(SysBusDevice *dev)
 static int versatile_pci_host_init(PCIDevice *d)
 {
     pci_set_word(d->config + PCI_STATUS,
-		 PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM);
+                 PCI_STATUS_66MHZ | PCI_STATUS_DEVSEL_MEDIUM);
     pci_set_byte(d->config + PCI_LATENCY_TIMER, 0x10);
     return 0;
 }
commit ad6b40f471cf8bf7b106032145b1b2ac105f99cf
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Fri Apr 19 12:18:05 2013 +1000

    m25p80: Remove bogus include of devices.h
    
    I think in the early revisions of this we had an instantiation helper
    for the device in devices.h. This was later removed and this header was
    left over. Removed
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index efcc7f4..b3ca19a 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -24,7 +24,6 @@
 #include "hw/hw.h"
 #include "sysemu/blockdev.h"
 #include "hw/ssi.h"
-#include "hw/devices.h"
 
 #ifndef M25P80_ERR_DEBUG
 #define M25P80_ERR_DEBUG 0
commit c7a101f5297442de7cbee44f7a31428f0e85a09f
Author: Richard W.M. Jones <rjones at redhat.com>
Date:   Thu Apr 18 22:09:33 2013 +0100

    ssh: Remove unnecessary use of strlen function.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/ssh.c b/block/ssh.c
index b4e048c..93a8b53 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -387,15 +387,13 @@ static int check_host_key(BDRVSSHState *s, const char *host, int port,
     }
 
     /* host_key_check=md5:xx:yy:zz:... */
-    if (strlen(host_key_check) >= 4 &&
-        strncmp(host_key_check, "md5:", 4) == 0) {
+    if (strncmp(host_key_check, "md5:", 4) == 0) {
         return check_host_key_hash(s, &host_key_check[4],
                                    LIBSSH2_HOSTKEY_HASH_MD5, 16);
     }
 
     /* host_key_check=sha1:xx:yy:zz:... */
-    if (strlen(host_key_check) >= 5 &&
-        strncmp(host_key_check, "sha1:", 5) == 0) {
+    if (strncmp(host_key_check, "sha1:", 5) == 0) {
         return check_host_key_hash(s, &host_key_check[5],
                                    LIBSSH2_HOSTKEY_HASH_SHA1, 20);
     }
commit 6ae7d660a089502ec5f5cea133e5fd93fd82f3a8
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Apr 18 22:21:05 2013 +0200

    block/ssh: Add missing gcc format attributes
    
    Now gcc will check whether format string and variable arguments match.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/ssh.c b/block/ssh.c
index 8f78e2e..b4e048c 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -109,7 +109,7 @@ static void ssh_state_free(BDRVSSHState *s)
 /* Wrappers around error_report which make sure to dump as much
  * information from libssh2 as possible.
  */
-static void
+static void GCC_FMT_ATTR(2, 3)
 session_error_report(BDRVSSHState *s, const char *fs, ...)
 {
     va_list args;
@@ -132,7 +132,7 @@ session_error_report(BDRVSSHState *s, const char *fs, ...)
     error_printf("\n");
 }
 
-static void
+static void GCC_FMT_ATTR(2, 3)
 sftp_error_report(BDRVSSHState *s, const char *fs, ...)
 {
     va_list args;
commit 40508bb424971d9f39f3fb3b455a1765aa7799ee
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Thu Mar 21 18:57:36 2013 +0100

    linux-user: change do_semop to return target errno when unsuccessful
    
    do_semop() is called from two places, and one of these fails to convert
    return error to target errno when semop fails. This patch changes the
    function to always return target errno in case of an unsuccessful call.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 1f07621..d6d2050 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2764,7 +2764,7 @@ static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
     if (target_to_host_sembuf(sops, ptr, nsops))
         return -TARGET_EFAULT;
 
-    return semop(semid, sops, nsops);
+    return get_errno(semop(semid, sops, nsops));
 }
 
 struct target_msqid_ds
@@ -6957,7 +6957,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 #endif
 #ifdef TARGET_NR_semop
     case TARGET_NR_semop:
-        ret = get_errno(do_semop(arg1, arg2, arg3));
+        ret = do_semop(arg1, arg2, arg3);
         break;
 #endif
 #ifdef TARGET_NR_semctl
commit 7f1721dfb7d3a9e464ba59a7d5f76761fd8a3ab9
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Apr 13 22:45:50 2013 +0200

    w64: Fix compiler warnings (wrong format specifier)
    
    GetLastError() returns a DWORD value which is unsigned long,
    so the correct format specifier is %lu.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/cpus.c b/cpus.c
index c15ff6c..5a98a37 100644
--- a/cpus.c
+++ b/cpus.c
@@ -865,7 +865,7 @@ static void qemu_cpu_kick_thread(CPUState *cpu)
         CONTEXT tcgContext;
 
         if (SuspendThread(cpu->hThread) == (DWORD)-1) {
-            fprintf(stderr, "qemu:%s: GetLastError:%d\n", __func__,
+            fprintf(stderr, "qemu:%s: GetLastError:%lu\n", __func__,
                     GetLastError());
             exit(1);
         }
@@ -881,7 +881,7 @@ static void qemu_cpu_kick_thread(CPUState *cpu)
         cpu_signal(0);
 
         if (ResumeThread(cpu->hThread) == (DWORD)-1) {
-            fprintf(stderr, "qemu:%s: GetLastError:%d\n", __func__,
+            fprintf(stderr, "qemu:%s: GetLastError:%lu\n", __func__,
                     GetLastError());
             exit(1);
         }
commit e1fe50dcb3c86e25ce482a7f67f2ac5405bced8a
Author: Stefan Weil <sw at weilnetz.de>
Date:   Fri Apr 12 20:53:58 2013 +0200

    Remove unneeded type casts
    
    cpu_physical_memory_read, cpu_physical_memory_write take any pointer
    as 2nd argument without needing a type cast.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index 2ae3576..93422bc 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -56,7 +56,7 @@ static uint32_t bitband_readw(void *opaque, hwaddr offset)
     addr = bitband_addr(opaque, offset) & ~1;
     mask = (1 << ((offset >> 2) & 15));
     mask = tswap16(mask);
-    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    cpu_physical_memory_read(addr, &v, 2);
     return (v & mask) != 0;
 }
 
@@ -69,12 +69,12 @@ static void bitband_writew(void *opaque, hwaddr offset,
     addr = bitband_addr(opaque, offset) & ~1;
     mask = (1 << ((offset >> 2) & 15));
     mask = tswap16(mask);
-    cpu_physical_memory_read(addr, (uint8_t *)&v, 2);
+    cpu_physical_memory_read(addr, &v, 2);
     if (value & 1)
         v |= mask;
     else
         v &= ~mask;
-    cpu_physical_memory_write(addr, (uint8_t *)&v, 2);
+    cpu_physical_memory_write(addr, &v, 2);
 }
 
 static uint32_t bitband_readl(void *opaque, hwaddr offset)
@@ -85,7 +85,7 @@ static uint32_t bitband_readl(void *opaque, hwaddr offset)
     addr = bitband_addr(opaque, offset) & ~3;
     mask = (1 << ((offset >> 2) & 31));
     mask = tswap32(mask);
-    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    cpu_physical_memory_read(addr, &v, 4);
     return (v & mask) != 0;
 }
 
@@ -98,12 +98,12 @@ static void bitband_writel(void *opaque, hwaddr offset,
     addr = bitband_addr(opaque, offset) & ~3;
     mask = (1 << ((offset >> 2) & 31));
     mask = tswap32(mask);
-    cpu_physical_memory_read(addr, (uint8_t *)&v, 4);
+    cpu_physical_memory_read(addr, &v, 4);
     if (value & 1)
         v |= mask;
     else
         v &= ~mask;
-    cpu_physical_memory_write(addr, (uint8_t *)&v, 4);
+    cpu_physical_memory_write(addr, &v, 4);
 }
 
 static const MemoryRegionOps bitband_ops = {
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index e9c0945..f451529 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -128,7 +128,7 @@ static void set_kernel_args(const struct arm_boot_info *info)
         int cmdline_size;
 
         cmdline_size = strlen(info->kernel_cmdline);
-        cpu_physical_memory_write(p + 8, (void *)info->kernel_cmdline,
+        cpu_physical_memory_write(p + 8, info->kernel_cmdline,
                                   cmdline_size + 1);
         cmdline_size = (cmdline_size >> 2) + 1;
         WRITE_WORD(p, cmdline_size + 2);
@@ -219,7 +219,7 @@ static void set_kernel_args_old(const struct arm_boot_info *info)
     }
     s = info->kernel_cmdline;
     if (s) {
-        cpu_physical_memory_write(p, (void *)s, strlen(s) + 1);
+        cpu_physical_memory_write(p, s, strlen(s) + 1);
     } else {
         WRITE_WORD(p, 0);
     }
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 31586c6..f33ba9a 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -170,12 +170,12 @@ static void eth_rx_desc_put(uint32_t addr, mv88w8618_rx_desc *desc)
     cpu_to_le16s(&desc->buffer_size);
     cpu_to_le32s(&desc->buffer);
     cpu_to_le32s(&desc->next);
-    cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
+    cpu_physical_memory_write(addr, desc, sizeof(*desc));
 }
 
 static void eth_rx_desc_get(uint32_t addr, mv88w8618_rx_desc *desc)
 {
-    cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
+    cpu_physical_memory_read(addr, desc, sizeof(*desc));
     le32_to_cpus(&desc->cmdstat);
     le16_to_cpus(&desc->bytes);
     le16_to_cpus(&desc->buffer_size);
@@ -229,12 +229,12 @@ static void eth_tx_desc_put(uint32_t addr, mv88w8618_tx_desc *desc)
     cpu_to_le16s(&desc->bytes);
     cpu_to_le32s(&desc->buffer);
     cpu_to_le32s(&desc->next);
-    cpu_physical_memory_write(addr, (void *)desc, sizeof(*desc));
+    cpu_physical_memory_write(addr, desc, sizeof(*desc));
 }
 
 static void eth_tx_desc_get(uint32_t addr, mv88w8618_tx_desc *desc)
 {
-    cpu_physical_memory_read(addr, (void *)desc, sizeof(*desc));
+    cpu_physical_memory_read(addr, desc, sizeof(*desc));
     le32_to_cpus(&desc->cmdstat);
     le16_to_cpus(&desc->res);
     le16_to_cpus(&desc->bytes);
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index 4976438..f6c9dc0 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -970,7 +970,7 @@ static void n800_gpmc_init(struct n800_s *s)
             (4 << 0);		/* BASEADDRESS */
 
     cpu_physical_memory_write(0x6800a078,		/* GPMC_CONFIG7_0 */
-                    (void *) &config7, sizeof(config7));
+                              &config7, sizeof(config7));
 }
 
 /* Setup sequence done by the bootloader */
@@ -982,7 +982,7 @@ static void n8x0_boot_init(void *opaque)
     /* PRCM setup */
 #define omap_writel(addr, val)	\
     buf = (val);			\
-    cpu_physical_memory_write(addr, (void *) &buf, sizeof(buf))
+    cpu_physical_memory_write(addr, &buf, sizeof(buf))
 
     omap_writel(0x48008060, 0x41);		/* PRCM_CLKSRC_CTRL */
     omap_writel(0x48008070, 1);			/* PRCM_CLKOUT_CTRL */
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index f59f0f2..c06c642 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -31,7 +31,7 @@ uint32_t omap_badwidth_read8(void *opaque, hwaddr addr)
     uint8_t ret;
 
     OMAP_8B_REG(addr);
-    cpu_physical_memory_read(addr, (void *) &ret, 1);
+    cpu_physical_memory_read(addr, &ret, 1);
     return ret;
 }
 
@@ -41,7 +41,7 @@ void omap_badwidth_write8(void *opaque, hwaddr addr,
     uint8_t val8 = value;
 
     OMAP_8B_REG(addr);
-    cpu_physical_memory_write(addr, (void *) &val8, 1);
+    cpu_physical_memory_write(addr, &val8, 1);
 }
 
 uint32_t omap_badwidth_read16(void *opaque, hwaddr addr)
@@ -49,7 +49,7 @@ uint32_t omap_badwidth_read16(void *opaque, hwaddr addr)
     uint16_t ret;
 
     OMAP_16B_REG(addr);
-    cpu_physical_memory_read(addr, (void *) &ret, 2);
+    cpu_physical_memory_read(addr, &ret, 2);
     return ret;
 }
 
@@ -59,7 +59,7 @@ void omap_badwidth_write16(void *opaque, hwaddr addr,
     uint16_t val16 = value;
 
     OMAP_16B_REG(addr);
-    cpu_physical_memory_write(addr, (void *) &val16, 2);
+    cpu_physical_memory_write(addr, &val16, 2);
 }
 
 uint32_t omap_badwidth_read32(void *opaque, hwaddr addr)
@@ -67,7 +67,7 @@ uint32_t omap_badwidth_read32(void *opaque, hwaddr addr)
     uint32_t ret;
 
     OMAP_32B_REG(addr);
-    cpu_physical_memory_read(addr, (void *) &ret, 4);
+    cpu_physical_memory_read(addr, &ret, 4);
     return ret;
 }
 
@@ -75,7 +75,7 @@ void omap_badwidth_write32(void *opaque, hwaddr addr,
                 uint32_t value)
 {
     OMAP_32B_REG(addr);
-    cpu_physical_memory_write(addr, (void *) &value, 4);
+    cpu_physical_memory_write(addr, &value, 4);
 }
 
 /* MPU OS timers */
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index f9b68fd..de06dfd 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -77,8 +77,7 @@ static void mv88w8618_audio_callback(void *opaque, int free_out, int free_in)
     if (block_size > 4096) {
         return;
     }
-    cpu_physical_memory_read(s->target_buffer + s->play_pos, (void *)buf,
-                             block_size);
+    cpu_physical_memory_read(s->target_buffer + s->play_pos, buf, block_size);
     mem_buffer = buf;
     if (s->playback_mode & MP_AUDIO_16BIT_SAMPLE) {
         if (s->playback_mode & MP_AUDIO_MONO) {
diff --git a/hw/display/pxa2xx_lcd.c b/hw/display/pxa2xx_lcd.c
index 12d9cd2..76276cf 100644
--- a/hw/display/pxa2xx_lcd.c
+++ b/hw/display/pxa2xx_lcd.c
@@ -315,7 +315,7 @@ static void pxa2xx_descriptor_load(PXA2xxLCDState *s)
             continue;
         }
 
-        cpu_physical_memory_read(descptr, (void *)&desc, sizeof(desc));
+        cpu_physical_memory_read(descptr, &desc, sizeof(desc));
         s->dma_ch[i].descriptor = tswap32(desc.fdaddr);
         s->dma_ch[i].source = tswap32(desc.fsaddr);
         s->dma_ch[i].id = tswap32(desc.fidr);
diff --git a/hw/dma/pxa2xx_dma.c b/hw/dma/pxa2xx_dma.c
index 6e4c1f6..b60569f 100644
--- a/hw/dma/pxa2xx_dma.c
+++ b/hw/dma/pxa2xx_dma.c
@@ -151,7 +151,7 @@ static inline void pxa2xx_dma_descriptor_fetch(
     if ((s->chan[ch].descr & DDADR_BREN) && (s->chan[ch].state & DCSR_CMPST))
         daddr += 32;
 
-    cpu_physical_memory_read(daddr, (uint8_t *) desc, 16);
+    cpu_physical_memory_read(daddr, desc, 16);
     s->chan[ch].descr = desc[DDADR];
     s->chan[ch].src = desc[DSADR];
     s->chan[ch].dest = desc[DTADR];
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index 1c23762..bc62664 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -197,7 +197,7 @@ static void stream_desc_load(struct Stream *s, hwaddr addr)
 {
     struct SDesc *d = &s->desc;
 
-    cpu_physical_memory_read(addr, (void *) d, sizeof *d);
+    cpu_physical_memory_read(addr, d, sizeof *d);
 
     /* Convert from LE into host endianness.  */
     d->buffer_address = le64_to_cpu(d->buffer_address);
@@ -215,7 +215,7 @@ static void stream_desc_store(struct Stream *s, hwaddr addr)
     d->nxtdesc = cpu_to_le64(d->nxtdesc);
     d->control = cpu_to_le32(d->control);
     d->status = cpu_to_le32(d->status);
-    cpu_physical_memory_write(addr, (void *) d, sizeof *d);
+    cpu_physical_memory_write(addr, d, sizeof *d);
 }
 
 static void stream_update_irq(struct Stream *s)
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index d853ea1..c6cdef3 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -287,6 +287,6 @@ static struct QEMU_PACKED sl_param_info {
 
 void sl_bootparam_write(hwaddr ptr)
 {
-    cpu_physical_memory_write(ptr, (void *)&zaurus_bootparam,
+    cpu_physical_memory_write(ptr, &zaurus_bootparam,
                               sizeof(struct sl_param_info));
 }
diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c
index 23cb11d..e543d88 100644
--- a/hw/microblaze/boot.c
+++ b/hw/microblaze/boot.c
@@ -80,7 +80,7 @@ static int microblaze_load_dtb(hwaddr addr,
         }
     }
 
-    cpu_physical_memory_write(addr, (void *)fdt, fdt_size);
+    cpu_physical_memory_write(addr, fdt, fdt_size);
 #else
     /* We lack libfdt so we cannot manipulate the fdt. Just pass on the blob
        to the kernel.  */
diff --git a/hw/misc/macio/mac_dbdma.c b/hw/misc/macio/mac_dbdma.c
index a2363bb..2fc7f87 100644
--- a/hw/misc/macio/mac_dbdma.c
+++ b/hw/misc/macio/mac_dbdma.c
@@ -192,7 +192,7 @@ static void dbdma_cmdptr_load(DBDMA_channel *ch)
     DBDMA_DPRINTF("dbdma_cmdptr_load 0x%08x\n",
                   ch->regs[DBDMA_CMDPTR_LO]);
     cpu_physical_memory_read(ch->regs[DBDMA_CMDPTR_LO],
-                             (uint8_t*)&ch->current, sizeof(dbdma_cmd));
+                             &ch->current, sizeof(dbdma_cmd));
 }
 
 static void dbdma_cmdptr_save(DBDMA_channel *ch)
@@ -203,7 +203,7 @@ static void dbdma_cmdptr_save(DBDMA_channel *ch)
                   le16_to_cpu(ch->current.xfer_status),
                   le16_to_cpu(ch->current.res_count));
     cpu_physical_memory_write(ch->regs[DBDMA_CMDPTR_LO],
-                              (uint8_t*)&ch->current, sizeof(dbdma_cmd));
+                              &ch->current, sizeof(dbdma_cmd));
 }
 
 static void kill_channel(DBDMA_channel *ch)
@@ -454,7 +454,7 @@ static void load_word(DBDMA_channel *ch, int key, uint32_t addr,
         return;
     }
 
-    cpu_physical_memory_read(addr, (uint8_t*)&val, len);
+    cpu_physical_memory_read(addr, &val, len);
 
     if (len == 2)
         val = (val << 16) | (current->cmd_dep & 0x0000ffff);
@@ -499,7 +499,7 @@ static void store_word(DBDMA_channel *ch, int key, uint32_t addr,
     else if (len == 1)
         val >>= 24;
 
-    cpu_physical_memory_write(addr, (uint8_t*)&val, len);
+    cpu_physical_memory_write(addr, &val, len);
 
     if (conditional_wait(ch))
         goto wait;
diff --git a/hw/misc/milkymist-pfpu.c b/hw/misc/milkymist-pfpu.c
index ad44b4d..fe1b039 100644
--- a/hw/misc/milkymist-pfpu.c
+++ b/hw/misc/milkymist-pfpu.c
@@ -228,8 +228,8 @@ static int pfpu_decode_insn(MilkymistPFPUState *s)
         hwaddr dma_ptr =
             get_dma_address(s->regs[R_MESHBASE],
                     s->gp_regs[GPR_X], s->gp_regs[GPR_Y]);
-        cpu_physical_memory_write(dma_ptr, (uint8_t *)&a, 4);
-        cpu_physical_memory_write(dma_ptr + 4, (uint8_t *)&b, 4);
+        cpu_physical_memory_write(dma_ptr, &a, 4);
+        cpu_physical_memory_write(dma_ptr + 4, &b, 4);
         s->regs[R_LASTDMA] = dma_ptr + 4;
         D_EXEC(qemu_log("VECTOUT a=%08x b=%08x dma=%08x\n", a, b, dma_ptr));
         trace_milkymist_pfpu_vectout(a, b, dma_ptr);
diff --git a/hw/net/mcf_fec.c b/hw/net/mcf_fec.c
index 9b68052..2ef5a0d 100644
--- a/hw/net/mcf_fec.c
+++ b/hw/net/mcf_fec.c
@@ -108,7 +108,7 @@ typedef struct {
 
 static void mcf_fec_read_bd(mcf_fec_bd *bd, uint32_t addr)
 {
-    cpu_physical_memory_read(addr, (uint8_t *)bd, sizeof(*bd));
+    cpu_physical_memory_read(addr, bd, sizeof(*bd));
     be16_to_cpus(&bd->flags);
     be16_to_cpus(&bd->length);
     be32_to_cpus(&bd->data);
@@ -120,7 +120,7 @@ static void mcf_fec_write_bd(mcf_fec_bd *bd, uint32_t addr)
     tmp.flags = cpu_to_be16(bd->flags);
     tmp.length = cpu_to_be16(bd->length);
     tmp.data = cpu_to_be32(bd->data);
-    cpu_physical_memory_write(addr, (uint8_t *)&tmp, sizeof(tmp));
+    cpu_physical_memory_write(addr, &tmp, sizeof(tmp));
 }
 
 static void mcf_fec_update(mcf_fec_state *s)
diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index 8e56b16..f0c7ee9 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -337,7 +337,7 @@ static void ref405ep_init(QEMUMachineInitArgs *args)
         if (kernel_cmdline != NULL) {
             len = strlen(kernel_cmdline);
             bdloc -= ((len + 255) & ~255);
-            cpu_physical_memory_write(bdloc, (void *)kernel_cmdline, len + 1);
+            cpu_physical_memory_write(bdloc, kernel_cmdline, len + 1);
             env->gpr[6] = bdloc;
             env->gpr[7] = bdloc + len;
         } else {
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 6728ba7..1b4ce76 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -161,7 +161,7 @@ static int xilinx_load_device_tree(hwaddr addr,
     r = qemu_devtree_setprop_string(fdt, "/chosen", "bootargs", kernel_cmdline);
     if (r < 0)
         fprintf(stderr, "couldn't set /chosen/bootargs\n");
-    cpu_physical_memory_write (addr, (void *)fdt, fdt_size);
+    cpu_physical_memory_write(addr, fdt, fdt_size);
 #else
     /* We lack libfdt so we cannot manipulate the fdt. Just pass on the blob
        to the kernel.  */
commit fd1ca7e0d5f76c6787428171355bcde49133c9c1
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Fri Apr 12 09:12:55 2013 -0400

    virtio.h: drop unused function prototypes
    
    They are unused since commit 5c7d0962f60498c3f11d402e1c857cb9d5d8568d.
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index b21e5c2..d3f1436 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -258,7 +258,6 @@ VirtIODevice *virtio_net_init(DeviceState *dev, NICConf *conf,
                               uint32_t host_features);
 typedef struct virtio_serial_conf virtio_serial_conf;
 VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *serial);
-VirtIODevice *virtio_balloon_init(DeviceState *dev);
 typedef struct VirtIOSCSIConf VirtIOSCSIConf;
 VirtIODevice *virtio_scsi_init(DeviceState *dev, VirtIOSCSIConf *conf);
 typedef struct VirtIORNGConf VirtIORNGConf;
@@ -270,7 +269,6 @@ VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf);
 
 void virtio_net_exit(VirtIODevice *vdev);
 void virtio_serial_exit(VirtIODevice *vdev);
-void virtio_balloon_exit(VirtIODevice *vdev);
 void virtio_scsi_exit(VirtIODevice *vdev);
 void virtio_rng_exit(VirtIODevice *vdev);
 
commit ea44910eefc3661af6b80442858102a4f8cd8034
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Mon Apr 15 11:47:56 2013 +1000

    bswap: fix compiler warning
    
    The bswap functions use memcpy but the bswap.h header itself does not seem to
    include it in some configuration such as cross compiling for powerpc64
    on x86_64 machine.
    
    The patch explicitly includes string.h.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: David Gibson <david at gibson.dropbear.id.au>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/include/qemu/bswap.h b/include/qemu/bswap.h
index d3af35d..14a5f65 100644
--- a/include/qemu/bswap.h
+++ b/include/qemu/bswap.h
@@ -4,6 +4,7 @@
 #include "config-host.h"
 #include <inttypes.h>
 #include <limits.h>
+#include <string.h>
 #include "fpu/softfloat.h"
 
 #ifdef CONFIG_MACHINE_BSWAP_H
commit af60314291af3cabda18d27f928b0e0ff899cc76
Author: Nicholas Bellinger <nab at linux-iscsi.org>
Date:   Wed Apr 3 09:15:11 2013 +0000

    vhost: Add vhost_commit callback for SeaBIOS ROM region re-mapping
    
    This patch follows MST's recommendation to move checks for
    vhost_verify_ring_mappings() -> cpu_physical_memory_map() operations
    from MemoryListener->region_[add,del]() -> vhost_set_memory() into
    final MemoryListener->commit() -> vhost_commit() callback.
    
    It addresses the case where virtio-scsi vq ioport RAM re-mapping
    to read-only SeaBIOS ROM triggers a cpu_physical_memory_map()
    NIL MemoryRegionSection pointer failure.
    
    Also save vhost_dev->mem_changed_[start,end]_addr values in
    vhost_set_memory() for final ranges_overlap checks.  (Thanks Paolo!)
    
    Cc: Michael S. Tsirkin <mst at redhat.com>
    Cc: Paolo Bonzini <pbonzini at redhat.com>
    Cc: Asias He <asias at redhat.com>
    Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 636fad0..40feab4 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -382,8 +382,6 @@ static void vhost_set_memory(MemoryListener *listener,
     bool log_dirty = memory_region_is_logging(section->mr);
     int s = offsetof(struct vhost_memory, regions) +
         (dev->mem->nregions + 1) * sizeof dev->mem->regions[0];
-    uint64_t log_size;
-    int r;
     void *ram;
 
     dev->mem = g_realloc(dev->mem, s);
@@ -416,12 +414,47 @@ static void vhost_set_memory(MemoryListener *listener,
         /* Remove old mapping for this memory, if any. */
         vhost_dev_unassign_memory(dev, start_addr, size);
     }
+    dev->mem_changed_start_addr = MIN(dev->mem_changed_start_addr, start_addr);
+    dev->mem_changed_end_addr = MAX(dev->mem_changed_end_addr, start_addr + size - 1);
+    dev->memory_changed = true;
+}
+
+static bool vhost_section(MemoryRegionSection *section)
+{
+    return memory_region_is_ram(section->mr);
+}
+
+static void vhost_begin(MemoryListener *listener)
+{
+    struct vhost_dev *dev = container_of(listener, struct vhost_dev,
+                                         memory_listener);
+    dev->mem_changed_end_addr = 0;
+    dev->mem_changed_start_addr = -1;
+}
 
+static void vhost_commit(MemoryListener *listener)
+{
+    struct vhost_dev *dev = container_of(listener, struct vhost_dev,
+                                         memory_listener);
+    hwaddr start_addr = 0;
+    ram_addr_t size = 0;
+    uint64_t log_size;
+    int r;
+
+    if (!dev->memory_changed) {
+        return;
+    }
     if (!dev->started) {
         return;
     }
+    if (dev->mem_changed_start_addr > dev->mem_changed_end_addr) {
+        return;
+    }
 
     if (dev->started) {
+        start_addr = dev->mem_changed_start_addr;
+        size = dev->mem_changed_end_addr - dev->mem_changed_start_addr + 1;
+
         r = vhost_verify_ring_mappings(dev, start_addr, size);
         assert(r >= 0);
     }
@@ -429,6 +462,7 @@ static void vhost_set_memory(MemoryListener *listener,
     if (!dev->log_enabled) {
         r = ioctl(dev->control, VHOST_SET_MEM_TABLE, dev->mem);
         assert(r >= 0);
+        dev->memory_changed = false;
         return;
     }
     log_size = vhost_get_log_size(dev);
@@ -445,19 +479,7 @@ static void vhost_set_memory(MemoryListener *listener,
     if (dev->log_size > log_size + VHOST_LOG_BUFFER) {
         vhost_dev_log_resize(dev, log_size);
     }
-}
-
-static bool vhost_section(MemoryRegionSection *section)
-{
-    return memory_region_is_ram(section->mr);
-}
-
-static void vhost_begin(MemoryListener *listener)
-{
-}
-
-static void vhost_commit(MemoryListener *listener)
-{
+    dev->memory_changed = false;
 }
 
 static void vhost_region_add(MemoryListener *listener,
@@ -842,6 +864,7 @@ int vhost_dev_init(struct vhost_dev *hdev, int devfd, const char *devpath,
     hdev->log_size = 0;
     hdev->log_enabled = false;
     hdev->started = false;
+    hdev->memory_changed = false;
     memory_listener_register(&hdev->memory_listener, &address_space_memory);
     hdev->force = force;
     return 0;
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index b373be0..de24746 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -45,6 +45,9 @@ struct vhost_dev {
     vhost_log_chunk_t *log;
     unsigned long long log_size;
     bool force;
+    bool memory_changed;
+    hwaddr mem_changed_start_addr;
+    hwaddr mem_changed_end_addr;
 };
 
 int vhost_dev_init(struct vhost_dev *hdev, int devfd, const char *devpath,
commit 881d588a98bf0dce98ddb65c15aa0854c0ac41ed
Author: Dmitry Fleytman <dmitry at daynix.com>
Date:   Fri Apr 19 10:05:46 2013 +0300

    scsi: VMWare PVSCSI paravirtual device implementation
    
    Signed-off-by: Dmitry Fleytman <dmitry at daynix.com>
    Signed-off-by: Yan Vugenfirer <yan at daynix.com>
    [ Rename files to vmw_pvscsi, fix setting of hostStatus in
      pvscsi_request_cancelled - Paolo ]
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/default-configs/pci.mak b/default-configs/pci.mak
index f5f100e..bf2cad7 100644
--- a/default-configs/pci.mak
+++ b/default-configs/pci.mak
@@ -10,6 +10,7 @@ CONFIG_EEPRO100_PCI=y
 CONFIG_PCNET_PCI=y
 CONFIG_PCNET_COMMON=y
 CONFIG_LSI_SCSI_PCI=y
+CONFIG_VMW_PVSCSI_SCSI_PCI=y
 CONFIG_MEGASAS_SCSI_PCI=y
 CONFIG_RTL8139_PCI=y
 CONFIG_E1000_PCI=y
diff --git a/docs/specs/vmw_pvscsi-spec.txt b/docs/specs/vmw_pvscsi-spec.txt
new file mode 100644
index 0000000..49affb2
--- /dev/null
+++ b/docs/specs/vmw_pvscsi-spec.txt
@@ -0,0 +1,92 @@
+General Description
+===================
+
+This document describes VMWare PVSCSI device interface specification.
+Created by Dmitry Fleytman (dmitry at daynix.com), Daynix Computing LTD.
+Based on source code of PVSCSI Linux driver from kernel 3.0.4
+
+PVSCSI Device Interface Overview
+================================
+
+The interface is based on memory area shared between hypervisor and VM.
+Memory area is obtained by driver as device IO memory resource of
+PVSCSI_MEM_SPACE_SIZE length.
+The shared memory consists of registers area and rings area.
+The registers area is used to raise hypervisor interrupts and issue device
+commands. The rings area is used to transfer data descriptors and SCSI
+commands from VM to hypervisor and to transfer messages produced by
+hypervisor to VM. Data itself is transferred via virtual scatter-gather DMA.
+
+PVSCSI Device Registers
+=======================
+
+The length of the registers area is 1 page (PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES).
+The structure of the registers area is described by the PVSCSIRegOffset enum.
+There are registers to issue device command (with optional short data),
+issue device interrupt, control interrupts masking.
+
+PVSCSI Device Rings
+===================
+
+There are three rings in shared memory:
+
+    1. Request ring (struct PVSCSIRingReqDesc *req_ring)
+        - ring for OS to device requests
+    2. Completion ring (struct PVSCSIRingCmpDesc *cmp_ring)
+        - ring for device request completions
+    3. Message ring (struct PVSCSIRingMsgDesc *msg_ring)
+        - ring for messages from device.
+       This ring is optional and the guest might not configure it.
+There is a control area (struct PVSCSIRingsState *rings_state) used to control
+rings operation.
+
+PVSCSI Device to Host Interrupts
+================================
+There are following interrupt types supported by PVSCSI device:
+    1. Completion interrupts (completion ring notifications):
+        PVSCSI_INTR_CMPL_0
+        PVSCSI_INTR_CMPL_1
+    2. Message interrupts (message ring notifications):
+        PVSCSI_INTR_MSG_0
+        PVSCSI_INTR_MSG_1
+
+Interrupts are controlled via PVSCSI_REG_OFFSET_INTR_MASK register
+Bit set means interrupt enabled, bit cleared - disabled
+
+Interrupt modes supported are legacy, MSI and MSI-X
+In case of legacy interrupts, register PVSCSI_REG_OFFSET_INTR_STATUS
+is used to check which interrupt has arrived.  Interrupts are
+acknowledged when the corresponding bit is written to the interrupt
+status register.
+
+PVSCSI Device Operation Sequences
+=================================
+
+1. Startup sequence:
+    a. Issue PVSCSI_CMD_ADAPTER_RESET command;
+    aa. Windows driver reads interrupt status register here;
+    b. Issue PVSCSI_CMD_SETUP_MSG_RING command with no additional data,
+       check status and disable device messages if error returned;
+       (Omitted if device messages disabled by driver configuration)
+    c. Issue PVSCSI_CMD_SETUP_RINGS command, provide rings configuration
+       as struct PVSCSICmdDescSetupRings;
+    d. Issue PVSCSI_CMD_SETUP_MSG_RING command again, provide
+       rings configuration as struct PVSCSICmdDescSetupMsgRing;
+    e. Unmask completion and message (if device messages enabled) interrupts.
+
+2. Shutdown sequences
+    a. Mask interrupts;
+    b. Flush request ring using PVSCSI_REG_OFFSET_KICK_NON_RW_IO;
+    c. Issue PVSCSI_CMD_ADAPTER_RESET command.
+
+3. Send request
+    a. Fill next free request ring descriptor;
+    b. Issue PVSCSI_REG_OFFSET_KICK_RW_IO for R/W operations;
+       or PVSCSI_REG_OFFSET_KICK_NON_RW_IO for other operations.
+
+4. Abort command
+    a. Issue PVSCSI_CMD_ABORT_CMD command;
+
+5. Request completion processing
+    a. Upon completion interrupt arrival process completion
+       and message (if enabled) rings.
diff --git a/hw/scsi/Makefile.objs b/hw/scsi/Makefile.objs
index aab0e9b..eaec6c8 100644
--- a/hw/scsi/Makefile.objs
+++ b/hw/scsi/Makefile.objs
@@ -2,6 +2,7 @@ common-obj-y += scsi-disk.o
 common-obj-y += scsi-generic.o scsi-bus.o
 common-obj-$(CONFIG_LSI_SCSI_PCI) += lsi53c895a.o
 common-obj-$(CONFIG_MEGASAS_SCSI_PCI) += megasas.o
+common-obj-$(CONFIG_VMW_PVSCSI_SCSI_PCI) += vmw_pvscsi.o
 common-obj-$(CONFIG_ESP) += esp.o
 common-obj-$(CONFIG_ESP_PCI) += esp-pci.o
 obj-$(CONFIG_PSERIES) += spapr_vscsi.o
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
new file mode 100644
index 0000000..4b4a58f
--- /dev/null
+++ b/hw/scsi/vmw_pvscsi.c
@@ -0,0 +1,1216 @@
+/*
+ * QEMU VMWARE PVSCSI paravirtual SCSI bus
+ *
+ * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Based on implementation by Paolo Bonzini
+ * http://lists.gnu.org/archive/html/qemu-devel/2011-08/msg00729.html
+ *
+ * Authors:
+ * Paolo Bonzini <pbonzini at redhat.com>
+ * Dmitry Fleytman <dmitry at daynix.com>
+ * Yan Vugenfirer <yan at daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ * See the COPYING file in the top-level directory.
+ *
+ * NOTE about MSI-X:
+ * MSI-X support has been removed for the moment because it leads Windows OS
+ * to crash on startup. The crash happens because Windows driver requires
+ * MSI-X shared memory to be part of the same BAR used for rings state
+ * registers, etc. This is not supported by QEMU infrastructure so separate
+ * BAR created from MSI-X purposes. Windows driver fails to deal with 2 BARs.
+ *
+ */
+
+#include "hw/scsi/scsi.h"
+#include <block/scsi.h>
+#include "hw/pci/msi.h"
+#include "vmw_pvscsi.h"
+#include "trace.h"
+
+
+#define PVSCSI_MSI_OFFSET        (0x50)
+#define PVSCSI_USE_64BIT         (true)
+#define PVSCSI_PER_VECTOR_MASK   (false)
+
+#define PVSCSI_MAX_DEVS                   (64)
+#define PVSCSI_MSIX_NUM_VECTORS           (1)
+
+#define PVSCSI_MAX_CMD_DATA_WORDS \
+    (sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
+
+#define RS_GET_FIELD(rs_pa, field) \
+    (ldl_le_phys(rs_pa + offsetof(struct PVSCSIRingsState, field)))
+#define RS_SET_FIELD(rs_pa, field, val) \
+    (stl_le_phys(rs_pa + offsetof(struct PVSCSIRingsState, field), val))
+
+#define TYPE_PVSCSI "pvscsi"
+#define PVSCSI(obj) OBJECT_CHECK(PVSCSIState, (obj), TYPE_PVSCSI)
+
+typedef struct PVSCSIRingInfo {
+    uint64_t            rs_pa;
+    uint32_t            txr_len_mask;
+    uint32_t            rxr_len_mask;
+    uint32_t            msg_len_mask;
+    uint64_t            req_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+    uint64_t            cmp_ring_pages_pa[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+    uint64_t            msg_ring_pages_pa[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
+    uint64_t            consumed_ptr;
+    uint64_t            filled_cmp_ptr;
+    uint64_t            filled_msg_ptr;
+} PVSCSIRingInfo;
+
+typedef struct PVSCSISGState {
+    hwaddr elemAddr;
+    hwaddr dataAddr;
+    uint32_t resid;
+} PVSCSISGState;
+
+typedef QTAILQ_HEAD(, PVSCSIRequest) PVSCSIRequestList;
+
+typedef struct {
+    PCIDevice parent_obj;
+    MemoryRegion io_space;
+    SCSIBus bus;
+    QEMUBH *completion_worker;
+    PVSCSIRequestList pending_queue;
+    PVSCSIRequestList completion_queue;
+
+    uint64_t reg_interrupt_status;        /* Interrupt status register value */
+    uint64_t reg_interrupt_enabled;       /* Interrupt mask register value   */
+    uint64_t reg_command_status;          /* Command status register value   */
+
+    /* Command data adoption mechanism */
+    uint64_t curr_cmd;                   /* Last command arrived             */
+    uint32_t curr_cmd_data_cntr;         /* Amount of data for last command  */
+
+    /* Collector for current command data */
+    uint32_t curr_cmd_data[PVSCSI_MAX_CMD_DATA_WORDS];
+
+    uint8_t rings_info_valid;            /* Whether data rings initialized   */
+    uint8_t msg_ring_info_valid;         /* Whether message ring initialized */
+    uint8_t use_msg;                     /* Whether to use message ring      */
+
+    uint8_t msi_used;    /* Whether MSI support was installed successfully   */
+
+    PVSCSIRingInfo rings;                /* Data transfer rings manager      */
+    uint32_t resetting;                  /* Reset in progress                */
+} PVSCSIState;
+
+typedef struct PVSCSIRequest {
+    SCSIRequest *sreq;
+    PVSCSIState *dev;
+    uint8_t sense_key;
+    uint8_t completed;
+    int lun;
+    QEMUSGList sgl;
+    PVSCSISGState sg;
+    struct PVSCSIRingReqDesc req;
+    struct PVSCSIRingCmpDesc cmp;
+    QTAILQ_ENTRY(PVSCSIRequest) next;
+} PVSCSIRequest;
+
+/* Integer binary logarithm */
+static int
+pvscsi_log2(uint32_t input)
+{
+    int log = 0;
+    assert(input > 0);
+    while (input >> ++log) {
+    }
+    return log;
+}
+
+static void
+pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
+{
+    int i;
+    uint32_t txr_len_log2, rxr_len_log2;
+    uint32_t req_ring_size, cmp_ring_size;
+    m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
+
+    req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
+    cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
+    txr_len_log2 = pvscsi_log2(req_ring_size - 1);
+    rxr_len_log2 = pvscsi_log2(cmp_ring_size - 1);
+
+    m->txr_len_mask = MASK(txr_len_log2);
+    m->rxr_len_mask = MASK(rxr_len_log2);
+
+    m->consumed_ptr = 0;
+    m->filled_cmp_ptr = 0;
+
+    for (i = 0; i < ri->reqRingNumPages; i++) {
+        m->req_ring_pages_pa[i] = ri->reqRingPPNs[i] << VMW_PAGE_SHIFT;
+    }
+
+    for (i = 0; i < ri->cmpRingNumPages; i++) {
+        m->cmp_ring_pages_pa[i] = ri->cmpRingPPNs[i] << VMW_PAGE_SHIFT;
+    }
+
+    RS_SET_FIELD(m->rs_pa, reqProdIdx, 0);
+    RS_SET_FIELD(m->rs_pa, reqConsIdx, 0);
+    RS_SET_FIELD(m->rs_pa, reqNumEntriesLog2, txr_len_log2);
+
+    RS_SET_FIELD(m->rs_pa, cmpProdIdx, 0);
+    RS_SET_FIELD(m->rs_pa, cmpConsIdx, 0);
+    RS_SET_FIELD(m->rs_pa, cmpNumEntriesLog2, rxr_len_log2);
+
+    trace_pvscsi_ring_init_data(txr_len_log2, rxr_len_log2);
+
+    /* Flush ring state page changes */
+    smp_wmb();
+}
+
+static void
+pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
+{
+    int i;
+    uint32_t len_log2;
+    uint32_t ring_size;
+
+    ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
+    len_log2 = pvscsi_log2(ring_size - 1);
+
+    m->msg_len_mask = MASK(len_log2);
+
+    m->filled_msg_ptr = 0;
+
+    for (i = 0; i < ri->numPages; i++) {
+        m->msg_ring_pages_pa[i] = ri->ringPPNs[i] << VMW_PAGE_SHIFT;
+    }
+
+    RS_SET_FIELD(m->rs_pa, msgProdIdx, 0);
+    RS_SET_FIELD(m->rs_pa, msgConsIdx, 0);
+    RS_SET_FIELD(m->rs_pa, msgNumEntriesLog2, len_log2);
+
+    trace_pvscsi_ring_init_msg(len_log2);
+
+    /* Flush ring state page changes */
+    smp_wmb();
+}
+
+static void
+pvscsi_ring_cleanup(PVSCSIRingInfo *mgr)
+{
+    mgr->rs_pa = 0;
+    mgr->txr_len_mask = 0;
+    mgr->rxr_len_mask = 0;
+    mgr->msg_len_mask = 0;
+    mgr->consumed_ptr = 0;
+    mgr->filled_cmp_ptr = 0;
+    mgr->filled_msg_ptr = 0;
+    memset(mgr->req_ring_pages_pa, 0, sizeof(mgr->req_ring_pages_pa));
+    memset(mgr->cmp_ring_pages_pa, 0, sizeof(mgr->cmp_ring_pages_pa));
+    memset(mgr->msg_ring_pages_pa, 0, sizeof(mgr->msg_ring_pages_pa));
+}
+
+static hwaddr
+pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
+{
+    uint32_t ready_ptr = RS_GET_FIELD(mgr->rs_pa, reqProdIdx);
+
+    if (ready_ptr != mgr->consumed_ptr) {
+        uint32_t next_ready_ptr =
+            mgr->consumed_ptr++ & mgr->txr_len_mask;
+        uint32_t next_ready_page =
+            next_ready_ptr / PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
+        uint32_t inpage_idx =
+            next_ready_ptr % PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
+
+        return mgr->req_ring_pages_pa[next_ready_page] +
+               inpage_idx * sizeof(PVSCSIRingReqDesc);
+    } else {
+        return 0;
+    }
+}
+
+static void
+pvscsi_ring_flush_req(PVSCSIRingInfo *mgr)
+{
+    RS_SET_FIELD(mgr->rs_pa, reqConsIdx, mgr->consumed_ptr);
+}
+
+static hwaddr
+pvscsi_ring_pop_cmp_descr(PVSCSIRingInfo *mgr)
+{
+    /*
+     * According to Linux driver code it explicitly verifies that number
+     * of requests being processed by device is less then the size of
+     * completion queue, so device may omit completion queue overflow
+     * conditions check. We assume that this is true for other (Windows)
+     * drivers as well.
+     */
+
+    uint32_t free_cmp_ptr =
+        mgr->filled_cmp_ptr++ & mgr->rxr_len_mask;
+    uint32_t free_cmp_page =
+        free_cmp_ptr / PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
+    uint32_t inpage_idx =
+        free_cmp_ptr % PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
+    return mgr->cmp_ring_pages_pa[free_cmp_page] +
+           inpage_idx * sizeof(PVSCSIRingCmpDesc);
+}
+
+static hwaddr
+pvscsi_ring_pop_msg_descr(PVSCSIRingInfo *mgr)
+{
+    uint32_t free_msg_ptr =
+        mgr->filled_msg_ptr++ & mgr->msg_len_mask;
+    uint32_t free_msg_page =
+        free_msg_ptr / PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
+    uint32_t inpage_idx =
+        free_msg_ptr % PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
+    return mgr->msg_ring_pages_pa[free_msg_page] +
+           inpage_idx * sizeof(PVSCSIRingMsgDesc);
+}
+
+static void
+pvscsi_ring_flush_cmp(PVSCSIRingInfo *mgr)
+{
+    /* Flush descriptor changes */
+    smp_wmb();
+
+    trace_pvscsi_ring_flush_cmp(mgr->filled_cmp_ptr);
+
+    RS_SET_FIELD(mgr->rs_pa, cmpProdIdx, mgr->filled_cmp_ptr);
+}
+
+static bool
+pvscsi_ring_msg_has_room(PVSCSIRingInfo *mgr)
+{
+    uint32_t prodIdx = RS_GET_FIELD(mgr->rs_pa, msgProdIdx);
+    uint32_t consIdx = RS_GET_FIELD(mgr->rs_pa, msgConsIdx);
+
+    return (prodIdx - consIdx) < (mgr->msg_len_mask + 1);
+}
+
+static void
+pvscsi_ring_flush_msg(PVSCSIRingInfo *mgr)
+{
+    /* Flush descriptor changes */
+    smp_wmb();
+
+    trace_pvscsi_ring_flush_msg(mgr->filled_msg_ptr);
+
+    RS_SET_FIELD(mgr->rs_pa, msgProdIdx, mgr->filled_msg_ptr);
+}
+
+static void
+pvscsi_reset_state(PVSCSIState *s)
+{
+    s->curr_cmd = PVSCSI_CMD_FIRST;
+    s->curr_cmd_data_cntr = 0;
+    s->reg_command_status = PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+    s->reg_interrupt_status = 0;
+    pvscsi_ring_cleanup(&s->rings);
+    s->rings_info_valid = FALSE;
+    s->msg_ring_info_valid = FALSE;
+    QTAILQ_INIT(&s->pending_queue);
+    QTAILQ_INIT(&s->completion_queue);
+}
+
+static void
+pvscsi_update_irq_status(PVSCSIState *s)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+    bool should_raise = s->reg_interrupt_enabled & s->reg_interrupt_status;
+
+    trace_pvscsi_update_irq_level(should_raise, s->reg_interrupt_enabled,
+                                  s->reg_interrupt_status);
+
+    if (s->msi_used && msi_enabled(d)) {
+        if (should_raise) {
+            trace_pvscsi_update_irq_msi();
+            msi_notify(d, PVSCSI_VECTOR_COMPLETION);
+        }
+        return;
+    }
+
+    qemu_set_irq(d->irq[0], !!should_raise);
+}
+
+static void
+pvscsi_raise_completion_interrupt(PVSCSIState *s)
+{
+    s->reg_interrupt_status |= PVSCSI_INTR_CMPL_0;
+
+    /* Memory barrier to flush interrupt status register changes*/
+    smp_wmb();
+
+    pvscsi_update_irq_status(s);
+}
+
+static void
+pvscsi_raise_message_interrupt(PVSCSIState *s)
+{
+    s->reg_interrupt_status |= PVSCSI_INTR_MSG_0;
+
+    /* Memory barrier to flush interrupt status register changes*/
+    smp_wmb();
+
+    pvscsi_update_irq_status(s);
+}
+
+static void
+pvscsi_cmp_ring_put(PVSCSIState *s, struct PVSCSIRingCmpDesc *cmp_desc)
+{
+    hwaddr cmp_descr_pa;
+
+    cmp_descr_pa = pvscsi_ring_pop_cmp_descr(&s->rings);
+    trace_pvscsi_cmp_ring_put(cmp_descr_pa);
+    cpu_physical_memory_write(cmp_descr_pa, (void *)cmp_desc,
+                              sizeof(*cmp_desc));
+}
+
+static void
+pvscsi_msg_ring_put(PVSCSIState *s, struct PVSCSIRingMsgDesc *msg_desc)
+{
+    hwaddr msg_descr_pa;
+
+    msg_descr_pa = pvscsi_ring_pop_msg_descr(&s->rings);
+    trace_pvscsi_msg_ring_put(msg_descr_pa);
+    cpu_physical_memory_write(msg_descr_pa, (void *)msg_desc,
+                              sizeof(*msg_desc));
+}
+
+static void
+pvscsi_process_completion_queue(void *opaque)
+{
+    PVSCSIState *s = opaque;
+    PVSCSIRequest *pvscsi_req;
+    bool has_completed = false;
+
+    while (!QTAILQ_EMPTY(&s->completion_queue)) {
+        pvscsi_req = QTAILQ_FIRST(&s->completion_queue);
+        QTAILQ_REMOVE(&s->completion_queue, pvscsi_req, next);
+        pvscsi_cmp_ring_put(s, &pvscsi_req->cmp);
+        g_free(pvscsi_req);
+        has_completed++;
+    }
+
+    if (has_completed) {
+        pvscsi_ring_flush_cmp(&s->rings);
+        pvscsi_raise_completion_interrupt(s);
+    }
+}
+
+static void
+pvscsi_reset_adapter(PVSCSIState *s)
+{
+    s->resetting++;
+    qbus_reset_all_fn(&s->bus);
+    s->resetting--;
+    pvscsi_process_completion_queue(s);
+    assert(QTAILQ_EMPTY(&s->pending_queue));
+    pvscsi_reset_state(s);
+}
+
+static void
+pvscsi_schedule_completion_processing(PVSCSIState *s)
+{
+    /* Try putting more complete requests on the ring. */
+    if (!QTAILQ_EMPTY(&s->completion_queue)) {
+        qemu_bh_schedule(s->completion_worker);
+    }
+}
+
+static void
+pvscsi_complete_request(PVSCSIState *s, PVSCSIRequest *r)
+{
+    assert(!r->completed);
+
+    trace_pvscsi_complete_request(r->cmp.context, r->cmp.dataLen,
+                                  r->sense_key);
+    if (r->sreq != NULL) {
+        scsi_req_unref(r->sreq);
+        r->sreq = NULL;
+    }
+    r->completed = 1;
+    QTAILQ_REMOVE(&s->pending_queue, r, next);
+    QTAILQ_INSERT_TAIL(&s->completion_queue, r, next);
+    pvscsi_schedule_completion_processing(s);
+}
+
+static QEMUSGList *pvscsi_get_sg_list(SCSIRequest *r)
+{
+    PVSCSIRequest *req = r->hba_private;
+
+    trace_pvscsi_get_sg_list(req->sgl.nsg, req->sgl.size);
+
+    return &req->sgl;
+}
+
+static void
+pvscsi_get_next_sg_elem(PVSCSISGState *sg)
+{
+    struct PVSCSISGElement elem;
+
+    cpu_physical_memory_read(sg->elemAddr, (void *)&elem, sizeof(elem));
+    if ((elem.flags & ~PVSCSI_KNOWN_FLAGS) != 0) {
+        /*
+            * There is PVSCSI_SGE_FLAG_CHAIN_ELEMENT flag described in
+            * header file but its value is unknown. This flag requires
+            * additional processing, so we put warning here to catch it
+            * some day and make proper implementation
+            */
+        trace_pvscsi_get_next_sg_elem(elem.flags);
+    }
+
+    sg->elemAddr += sizeof(elem);
+    sg->dataAddr = elem.addr;
+    sg->resid = elem.length;
+}
+
+static void
+pvscsi_write_sense(PVSCSIRequest *r, uint8_t *sense, int len)
+{
+    r->cmp.senseLen = MIN(r->req.senseLen, len);
+    r->sense_key = sense[(sense[0] & 2) ? 1 : 2];
+    cpu_physical_memory_write(r->req.senseAddr, sense, r->cmp.senseLen);
+}
+
+static void
+pvscsi_command_complete(SCSIRequest *req, uint32_t status, size_t resid)
+{
+    PVSCSIRequest *pvscsi_req = req->hba_private;
+    PVSCSIState *s = pvscsi_req->dev;
+
+    if (!pvscsi_req) {
+        trace_pvscsi_command_complete_not_found(req->tag);
+        return;
+    }
+
+    if (resid) {
+        /* Short transfer.  */
+        trace_pvscsi_command_complete_data_run();
+        pvscsi_req->cmp.hostStatus = BTSTAT_DATARUN;
+    }
+
+    pvscsi_req->cmp.scsiStatus = status;
+    if (pvscsi_req->cmp.scsiStatus == CHECK_CONDITION) {
+        uint8_t sense[SCSI_SENSE_BUF_SIZE];
+        int sense_len =
+            scsi_req_get_sense(pvscsi_req->sreq, sense, sizeof(sense));
+
+        trace_pvscsi_command_complete_sense_len(sense_len);
+        pvscsi_write_sense(pvscsi_req, sense, sense_len);
+    }
+    qemu_sglist_destroy(&pvscsi_req->sgl);
+    pvscsi_complete_request(s, pvscsi_req);
+}
+
+static void
+pvscsi_send_msg(PVSCSIState *s, SCSIDevice *dev, uint32_t msg_type)
+{
+    if (s->msg_ring_info_valid && pvscsi_ring_msg_has_room(&s->rings)) {
+        PVSCSIMsgDescDevStatusChanged msg = {0};
+
+        msg.type = msg_type;
+        msg.bus = dev->channel;
+        msg.target = dev->id;
+        msg.lun[1] = dev->lun;
+
+        pvscsi_msg_ring_put(s, (PVSCSIRingMsgDesc *)&msg);
+        pvscsi_ring_flush_msg(&s->rings);
+        pvscsi_raise_message_interrupt(s);
+    }
+}
+
+static void
+pvscsi_hotplug(SCSIBus *bus, SCSIDevice *dev)
+{
+    PVSCSIState *s = container_of(bus, PVSCSIState, bus);
+    pvscsi_send_msg(s, dev, PVSCSI_MSG_DEV_ADDED);
+}
+
+static void
+pvscsi_hot_unplug(SCSIBus *bus, SCSIDevice *dev)
+{
+    PVSCSIState *s = container_of(bus, PVSCSIState, bus);
+    pvscsi_send_msg(s, dev, PVSCSI_MSG_DEV_REMOVED);
+}
+
+static void
+pvscsi_request_cancelled(SCSIRequest *req)
+{
+    PVSCSIRequest *pvscsi_req = req->hba_private;
+    PVSCSIState *s = pvscsi_req->dev;
+
+    if (pvscsi_req->completed) {
+        return;
+    }
+
+   if (pvscsi_req->dev->resetting) {
+       pvscsi_req->cmp.hostStatus = BTSTAT_BUSRESET;
+    } else {
+       pvscsi_req->cmp.hostStatus = BTSTAT_ABORTQUEUE;
+    }
+
+    pvscsi_complete_request(s, pvscsi_req);
+}
+
+static SCSIDevice*
+pvscsi_device_find(PVSCSIState *s, int channel, int target,
+                   uint8_t *requested_lun, uint8_t *target_lun)
+{
+    if (requested_lun[0] || requested_lun[2] || requested_lun[3] ||
+        requested_lun[4] || requested_lun[5] || requested_lun[6] ||
+        requested_lun[7] || (target > PVSCSI_MAX_DEVS)) {
+        return NULL;
+    } else {
+        *target_lun = requested_lun[1];
+        return scsi_device_find(&s->bus, channel, target, *target_lun);
+    }
+}
+
+static PVSCSIRequest *
+pvscsi_queue_pending_descriptor(PVSCSIState *s, SCSIDevice **d,
+                                struct PVSCSIRingReqDesc *descr)
+{
+    PVSCSIRequest *pvscsi_req;
+    uint8_t lun;
+
+    pvscsi_req = g_malloc0(sizeof(*pvscsi_req));
+    pvscsi_req->dev = s;
+    pvscsi_req->req = *descr;
+    pvscsi_req->cmp.context = pvscsi_req->req.context;
+    QTAILQ_INSERT_TAIL(&s->pending_queue, pvscsi_req, next);
+
+    *d = pvscsi_device_find(s, descr->bus, descr->target, descr->lun, &lun);
+    if (*d) {
+        pvscsi_req->lun = lun;
+    }
+
+    return pvscsi_req;
+}
+
+static void
+pvscsi_convert_sglist(PVSCSIRequest *r)
+{
+    int chunk_size;
+    uint64_t data_length = r->req.dataLen;
+    PVSCSISGState sg = r->sg;
+    while (data_length) {
+        while (!sg.resid) {
+            pvscsi_get_next_sg_elem(&sg);
+            trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
+                                        r->sg.resid);
+        }
+        assert(data_length > 0);
+        chunk_size = MIN((unsigned) data_length, sg.resid);
+        if (chunk_size) {
+            qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
+        }
+
+        sg.dataAddr += chunk_size;
+        data_length -= chunk_size;
+        sg.resid -= chunk_size;
+    }
+}
+
+static void
+pvscsi_build_sglist(PVSCSIState *s, PVSCSIRequest *r)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+
+    qemu_sglist_init(&r->sgl, 1, pci_dma_context(d));
+    if (r->req.flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
+        pvscsi_convert_sglist(r);
+    } else {
+        qemu_sglist_add(&r->sgl, r->req.dataAddr, r->req.dataLen);
+    }
+}
+
+static void
+pvscsi_process_request_descriptor(PVSCSIState *s,
+                                  struct PVSCSIRingReqDesc *descr)
+{
+    SCSIDevice *d;
+    PVSCSIRequest *r = pvscsi_queue_pending_descriptor(s, &d, descr);
+    int64_t n;
+
+    trace_pvscsi_process_req_descr(descr->cdb[0], descr->context);
+
+    if (!d) {
+        r->cmp.hostStatus = BTSTAT_SELTIMEO;
+        trace_pvscsi_process_req_descr_unknown_device();
+        pvscsi_complete_request(s, r);
+        return;
+    }
+
+    if (descr->flags & PVSCSI_FLAG_CMD_WITH_SG_LIST) {
+        r->sg.elemAddr = descr->dataAddr;
+    }
+
+    r->sreq = scsi_req_new(d, descr->context, r->lun, descr->cdb, r);
+    if (r->sreq->cmd.mode == SCSI_XFER_FROM_DEV &&
+        (descr->flags & PVSCSI_FLAG_CMD_DIR_TODEVICE)) {
+        r->cmp.hostStatus = BTSTAT_BADMSG;
+        trace_pvscsi_process_req_descr_invalid_dir();
+        scsi_req_cancel(r->sreq);
+        return;
+    }
+    if (r->sreq->cmd.mode == SCSI_XFER_TO_DEV &&
+        (descr->flags & PVSCSI_FLAG_CMD_DIR_TOHOST)) {
+        r->cmp.hostStatus = BTSTAT_BADMSG;
+        trace_pvscsi_process_req_descr_invalid_dir();
+        scsi_req_cancel(r->sreq);
+        return;
+    }
+
+    pvscsi_build_sglist(s, r);
+    n = scsi_req_enqueue(r->sreq);
+
+    if (n) {
+        scsi_req_continue(r->sreq);
+    }
+}
+
+static void
+pvscsi_process_io(PVSCSIState *s)
+{
+    PVSCSIRingReqDesc descr;
+    hwaddr next_descr_pa;
+
+    assert(s->rings_info_valid);
+    while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
+
+        /* Only read after production index verification */
+        smp_rmb();
+
+        trace_pvscsi_process_io(next_descr_pa);
+        cpu_physical_memory_read(next_descr_pa, &descr, sizeof(descr));
+        pvscsi_process_request_descriptor(s, &descr);
+    }
+
+    pvscsi_ring_flush_req(&s->rings);
+}
+
+static void
+pvscsi_dbg_dump_tx_rings_config(PVSCSICmdDescSetupRings *rc)
+{
+    int i;
+    trace_pvscsi_tx_rings_ppn("Rings State", rc->ringsStatePPN);
+
+    trace_pvscsi_tx_rings_num_pages("Request Ring", rc->reqRingNumPages);
+    for (i = 0; i < rc->reqRingNumPages; i++) {
+        trace_pvscsi_tx_rings_ppn("Request Ring", rc->reqRingPPNs[i]);
+    }
+
+    trace_pvscsi_tx_rings_num_pages("Confirm Ring", rc->cmpRingNumPages);
+    for (i = 0; i < rc->cmpRingNumPages; i++) {
+        trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->reqRingPPNs[i]);
+    }
+}
+
+static uint64_t
+pvscsi_on_cmd_config(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_CONFIG");
+    return PVSCSI_COMMAND_PROCESSING_FAILED;
+}
+
+static uint64_t
+pvscsi_on_cmd_unplug(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_DEVICE_UNPLUG");
+    return PVSCSI_COMMAND_PROCESSING_FAILED;
+}
+
+static uint64_t
+pvscsi_on_issue_scsi(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_noimpl("PVSCSI_CMD_ISSUE_SCSI");
+    return PVSCSI_COMMAND_PROCESSING_FAILED;
+}
+
+static uint64_t
+pvscsi_on_cmd_setup_rings(PVSCSIState *s)
+{
+    PVSCSICmdDescSetupRings *rc =
+        (PVSCSICmdDescSetupRings *) s->curr_cmd_data;
+
+    trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
+
+    pvscsi_dbg_dump_tx_rings_config(rc);
+    pvscsi_ring_init_data(&s->rings, rc);
+    s->rings_info_valid = TRUE;
+    return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+}
+
+static uint64_t
+pvscsi_on_cmd_abort(PVSCSIState *s)
+{
+    PVSCSICmdDescAbortCmd *cmd = (PVSCSICmdDescAbortCmd *) s->curr_cmd_data;
+    PVSCSIRequest *r, *next;
+
+    trace_pvscsi_on_cmd_abort(cmd->context, cmd->target);
+
+    QTAILQ_FOREACH_SAFE(r, &s->pending_queue, next, next) {
+        if (r->req.context == cmd->context) {
+            break;
+        }
+    }
+    if (r) {
+        assert(!r->completed);
+        r->cmp.hostStatus = BTSTAT_ABORTQUEUE;
+        scsi_req_cancel(r->sreq);
+    }
+
+    return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+}
+
+static uint64_t
+pvscsi_on_cmd_unknown(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_unknown_data(s->curr_cmd_data[0]);
+    return PVSCSI_COMMAND_PROCESSING_FAILED;
+}
+
+static uint64_t
+pvscsi_on_cmd_reset_device(PVSCSIState *s)
+{
+    uint8_t target_lun = 0;
+    struct PVSCSICmdDescResetDevice *cmd =
+        (struct PVSCSICmdDescResetDevice *) s->curr_cmd_data;
+    SCSIDevice *sdev;
+
+    sdev = pvscsi_device_find(s, 0, cmd->target, cmd->lun, &target_lun);
+
+    trace_pvscsi_on_cmd_reset_dev(cmd->target, (int) target_lun, sdev);
+
+    if (sdev != NULL) {
+        s->resetting++;
+        device_reset(&sdev->qdev);
+        s->resetting--;
+        return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+    }
+
+    return PVSCSI_COMMAND_PROCESSING_FAILED;
+}
+
+static uint64_t
+pvscsi_on_cmd_reset_bus(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_RESET_BUS");
+
+    s->resetting++;
+    qbus_reset_all_fn(&s->bus);
+    s->resetting--;
+    return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+}
+
+static uint64_t
+pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)
+{
+    PVSCSICmdDescSetupMsgRing *rc =
+        (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;
+
+    trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");
+
+    if (!s->use_msg) {
+        return PVSCSI_COMMAND_PROCESSING_FAILED;
+    }
+
+    if (s->rings_info_valid) {
+        pvscsi_ring_init_msg(&s->rings, rc);
+        s->msg_ring_info_valid = TRUE;
+    }
+    return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);
+}
+
+static uint64_t
+pvscsi_on_cmd_adapter_reset(PVSCSIState *s)
+{
+    trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_ADAPTER_RESET");
+
+    pvscsi_reset_adapter(s);
+    return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
+}
+
+static const struct {
+    int       data_size;
+    uint64_t  (*handler_fn)(PVSCSIState *s);
+} pvscsi_commands[] = {
+    [PVSCSI_CMD_FIRST] = {
+        .data_size = 0,
+        .handler_fn = pvscsi_on_cmd_unknown,
+    },
+
+    /* Not implemented, data size defined based on what arrives on windows */
+    [PVSCSI_CMD_CONFIG] = {
+        .data_size = 6 * sizeof(uint32_t),
+        .handler_fn = pvscsi_on_cmd_config,
+    },
+
+    /* Command not implemented, data size is unknown */
+    [PVSCSI_CMD_ISSUE_SCSI] = {
+        .data_size = 0,
+        .handler_fn = pvscsi_on_issue_scsi,
+    },
+
+    /* Command not implemented, data size is unknown */
+    [PVSCSI_CMD_DEVICE_UNPLUG] = {
+        .data_size = 0,
+        .handler_fn = pvscsi_on_cmd_unplug,
+    },
+
+    [PVSCSI_CMD_SETUP_RINGS] = {
+        .data_size = sizeof(PVSCSICmdDescSetupRings),
+        .handler_fn = pvscsi_on_cmd_setup_rings,
+    },
+
+    [PVSCSI_CMD_RESET_DEVICE] = {
+        .data_size = sizeof(struct PVSCSICmdDescResetDevice),
+        .handler_fn = pvscsi_on_cmd_reset_device,
+    },
+
+    [PVSCSI_CMD_RESET_BUS] = {
+        .data_size = 0,
+        .handler_fn = pvscsi_on_cmd_reset_bus,
+    },
+
+    [PVSCSI_CMD_SETUP_MSG_RING] = {
+        .data_size = sizeof(PVSCSICmdDescSetupMsgRing),
+        .handler_fn = pvscsi_on_cmd_setup_msg_ring,
+    },
+
+    [PVSCSI_CMD_ADAPTER_RESET] = {
+        .data_size = 0,
+        .handler_fn = pvscsi_on_cmd_adapter_reset,
+    },
+
+    [PVSCSI_CMD_ABORT_CMD] = {
+        .data_size = sizeof(struct PVSCSICmdDescAbortCmd),
+        .handler_fn = pvscsi_on_cmd_abort,
+    },
+};
+
+static void
+pvscsi_do_command_processing(PVSCSIState *s)
+{
+    size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
+
+    assert(s->curr_cmd < PVSCSI_CMD_LAST);
+    if (bytes_arrived >= pvscsi_commands[s->curr_cmd].data_size) {
+        s->reg_command_status = pvscsi_commands[s->curr_cmd].handler_fn(s);
+        s->curr_cmd = PVSCSI_CMD_FIRST;
+        s->curr_cmd_data_cntr   = 0;
+    }
+}
+
+static void
+pvscsi_on_command_data(PVSCSIState *s, uint32_t value)
+{
+    size_t bytes_arrived = s->curr_cmd_data_cntr * sizeof(uint32_t);
+
+    assert(bytes_arrived < sizeof(s->curr_cmd_data));
+    s->curr_cmd_data[s->curr_cmd_data_cntr++] = value;
+
+    pvscsi_do_command_processing(s);
+}
+
+static void
+pvscsi_on_command(PVSCSIState *s, uint64_t cmd_id)
+{
+    if ((cmd_id > PVSCSI_CMD_FIRST) && (cmd_id < PVSCSI_CMD_LAST)) {
+        s->curr_cmd = cmd_id;
+    } else {
+        s->curr_cmd = PVSCSI_CMD_FIRST;
+        trace_pvscsi_on_cmd_unknown(cmd_id);
+    }
+
+    s->curr_cmd_data_cntr = 0;
+    s->reg_command_status = PVSCSI_COMMAND_NOT_ENOUGH_DATA;
+
+    pvscsi_do_command_processing(s);
+}
+
+static void
+pvscsi_io_write(void *opaque, hwaddr addr,
+                uint64_t val, unsigned size)
+{
+    PVSCSIState *s = opaque;
+
+    switch (addr) {
+    case PVSCSI_REG_OFFSET_COMMAND:
+        pvscsi_on_command(s, val);
+        break;
+
+    case PVSCSI_REG_OFFSET_COMMAND_DATA:
+        pvscsi_on_command_data(s, (uint32_t) val);
+        break;
+
+    case PVSCSI_REG_OFFSET_INTR_STATUS:
+        trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_STATUS", val);
+        s->reg_interrupt_status &= ~val;
+        pvscsi_update_irq_status(s);
+        pvscsi_schedule_completion_processing(s);
+        break;
+
+    case PVSCSI_REG_OFFSET_INTR_MASK:
+        trace_pvscsi_io_write("PVSCSI_REG_OFFSET_INTR_MASK", val);
+        s->reg_interrupt_enabled = val;
+        pvscsi_update_irq_status(s);
+        break;
+
+    case PVSCSI_REG_OFFSET_KICK_NON_RW_IO:
+        trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_NON_RW_IO", val);
+        pvscsi_process_io(s);
+        break;
+
+    case PVSCSI_REG_OFFSET_KICK_RW_IO:
+        trace_pvscsi_io_write("PVSCSI_REG_OFFSET_KICK_RW_IO", val);
+        pvscsi_process_io(s);
+        break;
+
+    case PVSCSI_REG_OFFSET_DEBUG:
+        trace_pvscsi_io_write("PVSCSI_REG_OFFSET_DEBUG", val);
+        break;
+
+    default:
+        trace_pvscsi_io_write_unknown(addr, size, val);
+        break;
+    }
+
+}
+
+static uint64_t
+pvscsi_io_read(void *opaque, hwaddr addr, unsigned size)
+{
+    PVSCSIState *s = opaque;
+
+    switch (addr) {
+    case PVSCSI_REG_OFFSET_INTR_STATUS:
+        trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_STATUS",
+                             s->reg_interrupt_status);
+        return s->reg_interrupt_status;
+
+    case PVSCSI_REG_OFFSET_INTR_MASK:
+        trace_pvscsi_io_read("PVSCSI_REG_OFFSET_INTR_MASK",
+                             s->reg_interrupt_status);
+        return s->reg_interrupt_enabled;
+
+    case PVSCSI_REG_OFFSET_COMMAND_STATUS:
+        trace_pvscsi_io_read("PVSCSI_REG_OFFSET_COMMAND_STATUS",
+                             s->reg_interrupt_status);
+        return s->reg_command_status;
+
+    default:
+        trace_pvscsi_io_read_unknown(addr, size);
+        return 0;
+    }
+}
+
+
+static bool
+pvscsi_init_msi(PVSCSIState *s)
+{
+    int res;
+    PCIDevice *d = PCI_DEVICE(s);
+
+    res = msi_init(d, PVSCSI_MSI_OFFSET, PVSCSI_MSIX_NUM_VECTORS,
+                   PVSCSI_USE_64BIT, PVSCSI_PER_VECTOR_MASK);
+    if (res < 0) {
+        trace_pvscsi_init_msi_fail(res);
+        s->msi_used = false;
+    } else {
+        s->msi_used = true;
+    }
+
+    return s->msi_used;
+}
+
+static void
+pvscsi_cleanup_msi(PVSCSIState *s)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+
+    if (s->msi_used) {
+        msi_uninit(d);
+    }
+}
+
+static const MemoryRegionOps pvscsi_ops = {
+        .read = pvscsi_io_read,
+        .write = pvscsi_io_write,
+        .endianness = DEVICE_LITTLE_ENDIAN,
+        .impl = {
+                .min_access_size = 4,
+                .max_access_size = 4,
+        },
+};
+
+static const struct SCSIBusInfo pvscsi_scsi_info = {
+        .tcq = true,
+        .max_target = PVSCSI_MAX_DEVS,
+        .max_channel = 0,
+        .max_lun = 0,
+
+        .get_sg_list = pvscsi_get_sg_list,
+        .complete = pvscsi_command_complete,
+        .cancel = pvscsi_request_cancelled,
+        .hotplug = pvscsi_hotplug,
+        .hot_unplug = pvscsi_hot_unplug,
+};
+
+static int
+pvscsi_init(PCIDevice *pci_dev)
+{
+    PVSCSIState *s = PVSCSI(pci_dev);
+
+    trace_pvscsi_state("init");
+
+    /* PCI subsystem ID */
+    pci_dev->config[PCI_SUBSYSTEM_ID] = 0x00;
+    pci_dev->config[PCI_SUBSYSTEM_ID + 1] = 0x10;
+
+    /* PCI latency timer = 255 */
+    pci_dev->config[PCI_LATENCY_TIMER] = 0xff;
+
+    /* Interrupt pin A */
+    pci_config_set_interrupt_pin(pci_dev->config, 1);
+
+    memory_region_init_io(&s->io_space, &pvscsi_ops, s,
+                          "pvscsi-io", PVSCSI_MEM_SPACE_SIZE);
+    pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->io_space);
+
+    pvscsi_init_msi(s);
+
+    s->completion_worker = qemu_bh_new(pvscsi_process_completion_queue, s);
+    if (!s->completion_worker) {
+        pvscsi_cleanup_msi(s);
+        memory_region_destroy(&s->io_space);
+        return -ENOMEM;
+    }
+
+    scsi_bus_new(&s->bus, &pci_dev->qdev, &pvscsi_scsi_info);
+    pvscsi_reset_state(s);
+
+    return 0;
+}
+
+static void
+pvscsi_uninit(PCIDevice *pci_dev)
+{
+    PVSCSIState *s = PVSCSI(pci_dev);
+
+    trace_pvscsi_state("uninit");
+    qemu_bh_delete(s->completion_worker);
+
+    pvscsi_cleanup_msi(s);
+
+    memory_region_destroy(&s->io_space);
+}
+
+static void
+pvscsi_reset(DeviceState *dev)
+{
+    PCIDevice *d = PCI_DEVICE(dev);
+    PVSCSIState *s = PVSCSI(d);
+
+    trace_pvscsi_state("reset");
+    pvscsi_reset_adapter(s);
+}
+
+static void
+pvscsi_pre_save(void *opaque)
+{
+    PVSCSIState *s = (PVSCSIState *) opaque;
+
+    trace_pvscsi_state("presave");
+
+    assert(QTAILQ_EMPTY(&s->pending_queue));
+    assert(QTAILQ_EMPTY(&s->completion_queue));
+}
+
+static int
+pvscsi_post_load(void *opaque, int version_id)
+{
+    trace_pvscsi_state("postload");
+    return 0;
+}
+
+static const VMStateDescription vmstate_pvscsi = {
+    .name = TYPE_PVSCSI,
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .minimum_version_id_old = 0,
+    .pre_save = pvscsi_pre_save,
+    .post_load = pvscsi_post_load,
+    .fields      = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(parent_obj, PVSCSIState),
+        VMSTATE_UINT8(msi_used, PVSCSIState),
+        VMSTATE_UINT32(resetting, PVSCSIState),
+        VMSTATE_UINT64(reg_interrupt_status, PVSCSIState),
+        VMSTATE_UINT64(reg_interrupt_enabled, PVSCSIState),
+        VMSTATE_UINT64(reg_command_status, PVSCSIState),
+        VMSTATE_UINT64(curr_cmd, PVSCSIState),
+        VMSTATE_UINT32(curr_cmd_data_cntr, PVSCSIState),
+        VMSTATE_UINT32_ARRAY(curr_cmd_data, PVSCSIState,
+                             ARRAY_SIZE(((PVSCSIState *)NULL)->curr_cmd_data)),
+        VMSTATE_UINT8(rings_info_valid, PVSCSIState),
+        VMSTATE_UINT8(msg_ring_info_valid, PVSCSIState),
+        VMSTATE_UINT8(use_msg, PVSCSIState),
+
+        VMSTATE_UINT64(rings.rs_pa, PVSCSIState),
+        VMSTATE_UINT32(rings.txr_len_mask, PVSCSIState),
+        VMSTATE_UINT32(rings.rxr_len_mask, PVSCSIState),
+        VMSTATE_UINT64_ARRAY(rings.req_ring_pages_pa, PVSCSIState,
+                             PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
+        VMSTATE_UINT64_ARRAY(rings.cmp_ring_pages_pa, PVSCSIState,
+                             PVSCSI_SETUP_RINGS_MAX_NUM_PAGES),
+        VMSTATE_UINT64(rings.consumed_ptr, PVSCSIState),
+        VMSTATE_UINT64(rings.filled_cmp_ptr, PVSCSIState),
+
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void
+pvscsi_write_config(PCIDevice *pci, uint32_t addr, uint32_t val, int len)
+{
+    pci_default_write_config(pci, addr, val, len);
+    msi_write_config(pci, addr, val, len);
+}
+
+static Property pvscsi_properties[] = {
+    DEFINE_PROP_UINT8("use_msg", PVSCSIState, use_msg, 1),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvscsi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->init = pvscsi_init;
+    k->exit = pvscsi_uninit;
+    k->vendor_id = PCI_VENDOR_ID_VMWARE;
+    k->device_id = PCI_DEVICE_ID_VMWARE_PVSCSI;
+    k->class_id = PCI_CLASS_STORAGE_SCSI;
+    k->subsystem_id = 0x1000;
+    dc->reset = pvscsi_reset;
+    dc->vmsd = &vmstate_pvscsi;
+    dc->props = pvscsi_properties;
+    k->config_write = pvscsi_write_config;
+}
+
+static const TypeInfo pvscsi_info = {
+    .name          = "pvscsi",
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PVSCSIState),
+    .class_init    = pvscsi_class_init,
+};
+
+static void
+pvscsi_register_types(void)
+{
+    type_register_static(&pvscsi_info);
+}
+
+type_init(pvscsi_register_types);
diff --git a/hw/scsi/vmw_pvscsi.h b/hw/scsi/vmw_pvscsi.h
new file mode 100644
index 0000000..17fcf66
--- /dev/null
+++ b/hw/scsi/vmw_pvscsi.h
@@ -0,0 +1,434 @@
+/*
+ * VMware PVSCSI header file
+ *
+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Arvind Kumar <arvindkumar at vmware.com>
+ *
+ */
+
+#ifndef VMW_PVSCSI_H
+#define VMW_PVSCSI_H
+
+#define VMW_PAGE_SIZE  (4096)
+#define VMW_PAGE_SHIFT (12)
+
+#define MASK(n)        ((1 << (n)) - 1)        /* make an n-bit mask */
+
+/*
+ * host adapter status/error codes
+ */
+enum HostBusAdapterStatus {
+   BTSTAT_SUCCESS       = 0x00,  /* CCB complete normally with no errors */
+   BTSTAT_LINKED_COMMAND_COMPLETED           = 0x0a,
+   BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG = 0x0b,
+   BTSTAT_DATA_UNDERRUN = 0x0c,
+   BTSTAT_SELTIMEO      = 0x11,  /* SCSI selection timeout */
+   BTSTAT_DATARUN       = 0x12,  /* data overrun/underrun */
+   BTSTAT_BUSFREE       = 0x13,  /* unexpected bus free */
+   BTSTAT_INVPHASE      = 0x14,  /* invalid bus phase or sequence */
+                                 /* requested by target           */
+   BTSTAT_LUNMISMATCH   = 0x17,  /* linked CCB has different LUN  */
+                                 /* from first CCB                */
+   BTSTAT_SENSFAILED    = 0x1b,  /* auto request sense failed */
+   BTSTAT_TAGREJECT     = 0x1c,  /* SCSI II tagged queueing message */
+                                 /* rejected by target              */
+   BTSTAT_BADMSG        = 0x1d,  /* unsupported message received by */
+                                 /* the host adapter                */
+   BTSTAT_HAHARDWARE    = 0x20,  /* host adapter hardware failed */
+   BTSTAT_NORESPONSE    = 0x21,  /* target did not respond to SCSI ATN, */
+                                 /* sent a SCSI RST                     */
+   BTSTAT_SENTRST       = 0x22,  /* host adapter asserted a SCSI RST */
+   BTSTAT_RECVRST       = 0x23,  /* other SCSI devices asserted a SCSI RST */
+   BTSTAT_DISCONNECT    = 0x24,  /* target device reconnected improperly */
+                                 /* (w/o tag)                            */
+   BTSTAT_BUSRESET      = 0x25,  /* host adapter issued BUS device reset */
+   BTSTAT_ABORTQUEUE    = 0x26,  /* abort queue generated */
+   BTSTAT_HASOFTWARE    = 0x27,  /* host adapter software error */
+   BTSTAT_HATIMEOUT     = 0x30,  /* host adapter hardware timeout error */
+   BTSTAT_SCSIPARITY    = 0x34,  /* SCSI parity error detected */
+};
+
+/*
+ * Register offsets.
+ *
+ * These registers are accessible both via i/o space and mm i/o.
+ */
+
+enum PVSCSIRegOffset {
+    PVSCSI_REG_OFFSET_COMMAND        =    0x0,
+    PVSCSI_REG_OFFSET_COMMAND_DATA   =    0x4,
+    PVSCSI_REG_OFFSET_COMMAND_STATUS =    0x8,
+    PVSCSI_REG_OFFSET_LAST_STS_0     =  0x100,
+    PVSCSI_REG_OFFSET_LAST_STS_1     =  0x104,
+    PVSCSI_REG_OFFSET_LAST_STS_2     =  0x108,
+    PVSCSI_REG_OFFSET_LAST_STS_3     =  0x10c,
+    PVSCSI_REG_OFFSET_INTR_STATUS    = 0x100c,
+    PVSCSI_REG_OFFSET_INTR_MASK      = 0x2010,
+    PVSCSI_REG_OFFSET_KICK_NON_RW_IO = 0x3014,
+    PVSCSI_REG_OFFSET_DEBUG          = 0x3018,
+    PVSCSI_REG_OFFSET_KICK_RW_IO     = 0x4018,
+};
+
+/*
+ * Virtual h/w commands.
+ */
+
+enum PVSCSICommands {
+    PVSCSI_CMD_FIRST             = 0, /* has to be first */
+
+    PVSCSI_CMD_ADAPTER_RESET     = 1,
+    PVSCSI_CMD_ISSUE_SCSI        = 2,
+    PVSCSI_CMD_SETUP_RINGS       = 3,
+    PVSCSI_CMD_RESET_BUS         = 4,
+    PVSCSI_CMD_RESET_DEVICE      = 5,
+    PVSCSI_CMD_ABORT_CMD         = 6,
+    PVSCSI_CMD_CONFIG            = 7,
+    PVSCSI_CMD_SETUP_MSG_RING    = 8,
+    PVSCSI_CMD_DEVICE_UNPLUG     = 9,
+
+    PVSCSI_CMD_LAST              = 10  /* has to be last */
+};
+
+#define PVSCSI_COMMAND_PROCESSING_SUCCEEDED   (0)
+#define PVSCSI_COMMAND_PROCESSING_FAILED     (-1)
+#define PVSCSI_COMMAND_NOT_ENOUGH_DATA       (-2)
+
+/*
+ * Command descriptor for PVSCSI_CMD_RESET_DEVICE --
+ */
+
+struct PVSCSICmdDescResetDevice {
+    uint32_t    target;
+    uint8_t     lun[8];
+} QEMU_PACKED;
+
+typedef struct PVSCSICmdDescResetDevice PVSCSICmdDescResetDevice;
+
+/*
+ * Command descriptor for PVSCSI_CMD_ABORT_CMD --
+ *
+ * - currently does not support specifying the LUN.
+ * - pad should be 0.
+ */
+
+struct PVSCSICmdDescAbortCmd {
+    uint64_t    context;
+    uint32_t    target;
+    uint32_t    pad;
+} QEMU_PACKED;
+
+typedef struct PVSCSICmdDescAbortCmd PVSCSICmdDescAbortCmd;
+
+/*
+ * Command descriptor for PVSCSI_CMD_SETUP_RINGS --
+ *
+ * Notes:
+ * - reqRingNumPages and cmpRingNumPages need to be power of two.
+ * - reqRingNumPages and cmpRingNumPages need to be different from 0,
+ * - reqRingNumPages and cmpRingNumPages need to be inferior to
+ *   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES.
+ */
+
+#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES        32
+struct PVSCSICmdDescSetupRings {
+    uint32_t    reqRingNumPages;
+    uint32_t    cmpRingNumPages;
+    uint64_t    ringsStatePPN;
+    uint64_t    reqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+    uint64_t    cmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+} QEMU_PACKED;
+
+typedef struct PVSCSICmdDescSetupRings PVSCSICmdDescSetupRings;
+
+/*
+ * Command descriptor for PVSCSI_CMD_SETUP_MSG_RING --
+ *
+ * Notes:
+ * - this command was not supported in the initial revision of the h/w
+ *   interface. Before using it, you need to check that it is supported by
+ *   writing PVSCSI_CMD_SETUP_MSG_RING to the 'command' register, then
+ *   immediately after read the 'command status' register:
+ *       * a value of -1 means that the cmd is NOT supported,
+ *       * a value != -1 means that the cmd IS supported.
+ *   If it's supported the 'command status' register should return:
+ *      sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t).
+ * - this command should be issued _after_ the usual SETUP_RINGS so that the
+ *   RingsState page is already setup. If not, the command is a nop.
+ * - numPages needs to be a power of two,
+ * - numPages needs to be different from 0,
+ * - pad should be zero.
+ */
+
+#define PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES  16
+
+struct PVSCSICmdDescSetupMsgRing {
+    uint32_t    numPages;
+    uint32_t    pad;
+    uint64_t    ringPPNs[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
+} QEMU_PACKED;
+
+typedef struct PVSCSICmdDescSetupMsgRing PVSCSICmdDescSetupMsgRing;
+
+enum PVSCSIMsgType {
+    PVSCSI_MSG_DEV_ADDED          = 0,
+    PVSCSI_MSG_DEV_REMOVED        = 1,
+    PVSCSI_MSG_LAST               = 2,
+};
+
+/*
+ * Msg descriptor.
+ *
+ * sizeof(struct PVSCSIRingMsgDesc) == 128.
+ *
+ * - type is of type enum PVSCSIMsgType.
+ * - the content of args depend on the type of event being delivered.
+ */
+
+struct PVSCSIRingMsgDesc {
+    uint32_t    type;
+    uint32_t    args[31];
+} QEMU_PACKED;
+
+typedef struct PVSCSIRingMsgDesc PVSCSIRingMsgDesc;
+
+struct PVSCSIMsgDescDevStatusChanged {
+    uint32_t    type;  /* PVSCSI_MSG_DEV _ADDED / _REMOVED */
+    uint32_t    bus;
+    uint32_t    target;
+    uint8_t     lun[8];
+    uint32_t    pad[27];
+} QEMU_PACKED;
+
+typedef struct PVSCSIMsgDescDevStatusChanged PVSCSIMsgDescDevStatusChanged;
+
+/*
+ * Rings state.
+ *
+ * - the fields:
+ *    . msgProdIdx,
+ *    . msgConsIdx,
+ *    . msgNumEntriesLog2,
+ *   .. are only used once the SETUP_MSG_RING cmd has been issued.
+ * - 'pad' helps to ensure that the msg related fields are on their own
+ *   cache-line.
+ */
+
+struct PVSCSIRingsState {
+    uint32_t    reqProdIdx;
+    uint32_t    reqConsIdx;
+    uint32_t    reqNumEntriesLog2;
+
+    uint32_t    cmpProdIdx;
+    uint32_t    cmpConsIdx;
+    uint32_t    cmpNumEntriesLog2;
+
+    uint8_t     pad[104];
+
+    uint32_t    msgProdIdx;
+    uint32_t    msgConsIdx;
+    uint32_t    msgNumEntriesLog2;
+} QEMU_PACKED;
+
+typedef struct PVSCSIRingsState PVSCSIRingsState;
+
+/*
+ * Request descriptor.
+ *
+ * sizeof(RingReqDesc) = 128
+ *
+ * - context: is a unique identifier of a command. It could normally be any
+ *   64bit value, however we currently store it in the serialNumber variable
+ *   of struct SCSI_Command, so we have the following restrictions due to the
+ *   way this field is handled in the vmkernel storage stack:
+ *    * this value can't be 0,
+ *    * the upper 32bit need to be 0 since serialNumber is as a uint32_t.
+ *   Currently tracked as PR 292060.
+ * - dataLen: contains the total number of bytes that need to be transferred.
+ * - dataAddr:
+ *   * if PVSCSI_FLAG_CMD_WITH_SG_LIST is set: dataAddr is the PA of the first
+ *     s/g table segment, each s/g segment is entirely contained on a single
+ *     page of physical memory,
+ *   * if PVSCSI_FLAG_CMD_WITH_SG_LIST is NOT set, then dataAddr is the PA of
+ *     the buffer used for the DMA transfer,
+ * - flags:
+ *   * PVSCSI_FLAG_CMD_WITH_SG_LIST: see dataAddr above,
+ *   * PVSCSI_FLAG_CMD_DIR_NONE: no DMA involved,
+ *   * PVSCSI_FLAG_CMD_DIR_TOHOST: transfer from device to main memory,
+ *   * PVSCSI_FLAG_CMD_DIR_TODEVICE: transfer from main memory to device,
+ *   * PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB: reserved to handle CDBs larger than
+ *     16bytes. To be specified.
+ * - vcpuHint: vcpuId of the processor that will be most likely waiting for the
+ *   completion of the i/o. For guest OSes that use lowest priority message
+ *   delivery mode (such as windows), we use this "hint" to deliver the
+ *   completion action to the proper vcpu. For now, we can use the vcpuId of
+ *   the processor that initiated the i/o as a likely candidate for the vcpu
+ *   that will be waiting for the completion..
+ * - bus should be 0: we currently only support bus 0 for now.
+ * - unused should be zero'd.
+ */
+
+#define PVSCSI_FLAG_CMD_WITH_SG_LIST        (1 << 0)
+#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB     (1 << 1)
+#define PVSCSI_FLAG_CMD_DIR_NONE            (1 << 2)
+#define PVSCSI_FLAG_CMD_DIR_TOHOST          (1 << 3)
+#define PVSCSI_FLAG_CMD_DIR_TODEVICE        (1 << 4)
+
+#define PVSCSI_KNOWN_FLAGS \
+  (PVSCSI_FLAG_CMD_WITH_SG_LIST     | \
+   PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB  | \
+   PVSCSI_FLAG_CMD_DIR_NONE         | \
+   PVSCSI_FLAG_CMD_DIR_TOHOST       | \
+   PVSCSI_FLAG_CMD_DIR_TODEVICE)
+
+struct PVSCSIRingReqDesc {
+    uint64_t    context;
+    uint64_t    dataAddr;
+    uint64_t    dataLen;
+    uint64_t    senseAddr;
+    uint32_t    senseLen;
+    uint32_t    flags;
+    uint8_t     cdb[16];
+    uint8_t     cdbLen;
+    uint8_t     lun[8];
+    uint8_t     tag;
+    uint8_t     bus;
+    uint8_t     target;
+    uint8_t     vcpuHint;
+    uint8_t     unused[59];
+} QEMU_PACKED;
+
+typedef struct PVSCSIRingReqDesc PVSCSIRingReqDesc;
+
+/*
+ * Scatter-gather list management.
+ *
+ * As described above, when PVSCSI_FLAG_CMD_WITH_SG_LIST is set in the
+ * RingReqDesc.flags, then RingReqDesc.dataAddr is the PA of the first s/g
+ * table segment.
+ *
+ * - each segment of the s/g table contain a succession of struct
+ *   PVSCSISGElement.
+ * - each segment is entirely contained on a single physical page of memory.
+ * - a "chain" s/g element has the flag PVSCSI_SGE_FLAG_CHAIN_ELEMENT set in
+ *   PVSCSISGElement.flags and in this case:
+ *     * addr is the PA of the next s/g segment,
+ *     * length is undefined, assumed to be 0.
+ */
+
+struct PVSCSISGElement {
+    uint64_t    addr;
+    uint32_t    length;
+    uint32_t    flags;
+} QEMU_PACKED;
+
+typedef struct PVSCSISGElement PVSCSISGElement;
+
+/*
+ * Completion descriptor.
+ *
+ * sizeof(RingCmpDesc) = 32
+ *
+ * - context: identifier of the command. The same thing that was specified
+ *   under "context" as part of struct RingReqDesc at initiation time,
+ * - dataLen: number of bytes transferred for the actual i/o operation,
+ * - senseLen: number of bytes written into the sense buffer,
+ * - hostStatus: adapter status,
+ * - scsiStatus: device status,
+ * - pad should be zero.
+ */
+
+struct PVSCSIRingCmpDesc {
+    uint64_t    context;
+    uint64_t    dataLen;
+    uint32_t    senseLen;
+    uint16_t    hostStatus;
+    uint16_t    scsiStatus;
+    uint32_t    pad[2];
+} QEMU_PACKED;
+
+typedef struct PVSCSIRingCmpDesc PVSCSIRingCmpDesc;
+
+/*
+ * Interrupt status / IRQ bits.
+ */
+
+#define PVSCSI_INTR_CMPL_0                 (1 << 0)
+#define PVSCSI_INTR_CMPL_1                 (1 << 1)
+#define PVSCSI_INTR_CMPL_MASK              MASK(2)
+
+#define PVSCSI_INTR_MSG_0                  (1 << 2)
+#define PVSCSI_INTR_MSG_1                  (1 << 3)
+#define PVSCSI_INTR_MSG_MASK               (MASK(2) << 2)
+
+#define PVSCSI_INTR_ALL_SUPPORTED          MASK(4)
+
+/*
+ * Number of MSI-X vectors supported.
+ */
+#define PVSCSI_MAX_INTRS        24
+
+/*
+ * Enumeration of supported MSI-X vectors
+ */
+#define PVSCSI_VECTOR_COMPLETION   0
+
+/*
+ * Misc constants for the rings.
+ */
+
+#define PVSCSI_MAX_NUM_PAGES_REQ_RING   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
+#define PVSCSI_MAX_NUM_PAGES_CMP_RING   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
+#define PVSCSI_MAX_NUM_PAGES_MSG_RING   PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES
+
+#define PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE \
+                (VMW_PAGE_SIZE / sizeof(struct PVSCSIRingReqDesc))
+
+#define PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE \
+                (VMW_PAGE_SIZE / sizeof(PVSCSIRingCmpDesc))
+
+#define PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE \
+                (VMW_PAGE_SIZE / sizeof(PVSCSIRingMsgDesc))
+
+#define PVSCSI_MAX_REQ_QUEUE_DEPTH \
+    (PVSCSI_MAX_NUM_PAGES_REQ_RING * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE)
+
+#define PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES     1
+#define PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES 1
+#define PVSCSI_MEM_SPACE_MISC_NUM_PAGES        2
+#define PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES     2
+#define PVSCSI_MEM_SPACE_MSIX_NUM_PAGES        2
+
+enum PVSCSIMemSpace {
+    PVSCSI_MEM_SPACE_COMMAND_PAGE       = 0,
+    PVSCSI_MEM_SPACE_INTR_STATUS_PAGE   = 1,
+    PVSCSI_MEM_SPACE_MISC_PAGE          = 2,
+    PVSCSI_MEM_SPACE_KICK_IO_PAGE       = 4,
+    PVSCSI_MEM_SPACE_MSIX_TABLE_PAGE    = 6,
+    PVSCSI_MEM_SPACE_MSIX_PBA_PAGE      = 7,
+};
+
+#define PVSCSI_MEM_SPACE_NUM_PAGES \
+    (PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES +       \
+     PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES +   \
+     PVSCSI_MEM_SPACE_MISC_NUM_PAGES +          \
+     PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES +       \
+     PVSCSI_MEM_SPACE_MSIX_NUM_PAGES)
+
+#define PVSCSI_MEM_SPACE_SIZE    (PVSCSI_MEM_SPACE_NUM_PAGES * VMW_PAGE_SIZE)
+
+#endif /* VMW_PVSCSI_H */
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 05315c0..2c138b1 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -59,6 +59,7 @@
 #define PCI_DEVICE_ID_VMWARE_SVGA        0x0710
 #define PCI_DEVICE_ID_VMWARE_NET         0x0720
 #define PCI_DEVICE_ID_VMWARE_SCSI        0x0730
+#define PCI_DEVICE_ID_VMWARE_PVSCSI      0x07C0
 #define PCI_DEVICE_ID_VMWARE_IDE         0x1729
 #define PCI_DEVICE_ID_VMWARE_VMXNET3     0x07B0
 
diff --git a/trace-events b/trace-events
index 581d67a..e587487 100644
--- a/trace-events
+++ b/trace-events
@@ -766,6 +766,41 @@ pc87312_info_ide(uint32_t base) "base 0x%x"
 pc87312_info_parallel(uint32_t base, uint32_t irq) "base 0x%x, irq %u"
 pc87312_info_serial(int n, uint32_t base, uint32_t irq) "id=%d, base 0x%x, irq %u"
 
+# hw/scsi/vmw_pvscsi.c
+pvscsi_ring_init_data(uint32_t txr_len_log2, uint32_t rxr_len_log2) "TX/RX rings logarithms set to %d/%d"
+pvscsi_ring_init_msg(uint32_t len_log2) "MSG ring logarithm set to %d"
+pvscsi_ring_flush_cmp(uint64_t filled_cmp_ptr) "new production counter of completion ring is 0x%"PRIx64""
+pvscsi_ring_flush_msg(uint64_t filled_cmp_ptr) "new production counter of message ring is 0x%"PRIx64""
+pvscsi_update_irq_level(bool raise, uint64_t mask, uint64_t status) "interrupt level set to %d (MASK: 0x%"PRIx64", STATUS: 0x%"PRIx64")"
+pvscsi_update_irq_msi(void) "sending MSI notification"
+pvscsi_cmp_ring_put(unsigned long addr) "got completion descriptor 0x%lx"
+pvscsi_msg_ring_put(unsigned long addr) "got message descriptor 0x%lx"
+pvscsi_complete_request(uint64_t context, uint64_t len, uint8_t sense_key) "completion: ctx: 0x%"PRIx64", len: 0x%"PRIx64", sense key: %u"
+pvscsi_get_sg_list(int nsg, size_t size) "get SG list: depth: %u, size: %lu"
+pvscsi_get_next_sg_elem(uint32_t flags) "unknown flags in SG element (val: 0x%x)"
+pvscsi_command_complete_not_found(uint32_t tag) "can't find request for tag 0x%x"
+pvscsi_command_complete_data_run(void) "not all data required for command transferred"
+pvscsi_command_complete_sense_len(int len) "sense information length is %d bytes"
+pvscsi_convert_sglist(uint64_t context, unsigned long addr, uint32_t resid) "element: ctx: 0x%"PRIx64" addr: 0x%lx, len: %ul"
+pvscsi_process_req_descr(uint8_t cmd, uint64_t ctx) "SCSI cmd 0x%x, ctx: 0x%"PRIx64""
+pvscsi_process_req_descr_unknown_device(void) "command directed to unknown device rejected"
+pvscsi_process_req_descr_invalid_dir(void) "command with invalid transfer direction rejected"
+pvscsi_process_io(unsigned long addr) "got descriptor 0x%lx"
+pvscsi_on_cmd_noimpl(const char* cmd) "unimplemented command %s ignored"
+pvscsi_on_cmd_reset_dev(uint32_t tgt, int lun, void* dev) "PVSCSI_CMD_RESET_DEVICE[target %u lun %d (dev 0x%p)]"
+pvscsi_on_cmd_arrived(const char* cmd) "command %s arrived"
+pvscsi_on_cmd_abort(uint64_t ctx, uint32_t tgt) "command PVSCSI_CMD_ABORT_CMD for ctx 0x%"PRIx64", target %u"
+pvscsi_on_cmd_unknown(uint64_t cmd_id) "unknown command %"PRIx64""
+pvscsi_on_cmd_unknown_data(uint32_t data) "data for unknown command 0x:%x"
+pvscsi_io_write(const char* cmd, uint64_t val) "%s write: %"PRIx64""
+pvscsi_io_write_unknown(unsigned long addr, unsigned sz, uint64_t val) "unknown write address: 0x%lx size: %u bytes value: 0x%"PRIx64""
+pvscsi_io_read(const char* cmd, uint64_t status) "%s read: 0x%"PRIx64""
+pvscsi_io_read_unknown(unsigned long addr, unsigned sz) "unknown read address: 0x%lx size: %u bytes"
+pvscsi_init_msi_fail(int res) "failed to initialize MSI, error %d"
+pvscsi_state(const char* state) "starting %s ..."
+pvscsi_tx_rings_ppn(const char* label, uint64_t ppn) "%s page: %"PRIx64""
+pvscsi_tx_rings_num_pages(const char* label, uint32_t num) "Number of %s pages: %u"
+
 # xen-all.c
 xen_ram_alloc(unsigned long ram_addr, unsigned long size) "requested: %#lx, size %#lx"
 xen_client_set_memory(uint64_t start_addr, unsigned long size, bool log_dirty) "%#"PRIx64" size %#lx, log_dirty %i"
commit ef8489d45927a6d35b214365e4b39ab311b48f2a
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Apr 8 18:50:15 2013 +0200

    scsi: avoid assertion failure on VERIFY command
    
    A verify command is not an actual read (we do not implement
    compare mode) and thus does not have an AIOCB attached.  Do
    not crash in scsi_dma_complete.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index f52bd11..c8d2a99 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -244,14 +244,15 @@ done:
     }
 }
 
-static void scsi_dma_complete(void *opaque, int ret)
+static void scsi_dma_complete_noio(void *opaque, int ret)
 {
     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
 
-    assert(r->req.aiocb != NULL);
-    r->req.aiocb = NULL;
-    bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+    if (r->req.aiocb != NULL) {
+        r->req.aiocb = NULL;
+        bdrv_acct_done(s->qdev.conf.bs, &r->acct);
+    }
     if (r->req.io_canceled) {
         goto done;
     }
@@ -277,6 +278,14 @@ done:
     }
 }
 
+static void scsi_dma_complete(void *opaque, int ret)
+{
+    SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+
+    assert(r->req.aiocb != NULL);
+    scsi_dma_complete_noio(opaque, ret);
+}
+
 static void scsi_read_complete(void * opaque, int ret)
 {
     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
@@ -496,7 +505,7 @@ static void scsi_write_data(SCSIRequest *req)
     if (r->req.cmd.buf[0] == VERIFY_10 || r->req.cmd.buf[0] == VERIFY_12 ||
         r->req.cmd.buf[0] == VERIFY_16) {
         if (r->req.sg) {
-            scsi_dma_complete(r, 0);
+            scsi_dma_complete_noio(r, 0);
         } else {
             scsi_write_complete(r, 0);
         }
commit 03903ffcfb5a7c75e52da97d00eb9d0bb0660f28
Author: Andreas Schwab <schwab at suse.de>
Date:   Tue Apr 9 05:41:33 2013 +0000

    linux-user: fix setgroups/getgroups for non-UID16 archs
    
    Don't assume target_id is a short.
    
    Signed-off-by: Andreas Schwab <schwab at suse.de>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 5a786f2..c705960 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -7743,12 +7743,12 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             if (gidsetsize == 0)
                 break;
             if (!is_error(ret)) {
-                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * 2, 0);
+                target_grouplist = lock_user(VERIFY_WRITE, arg2, gidsetsize * sizeof(target_id), 0);
                 if (!target_grouplist)
                     goto efault;
                 for(i = 0;i < ret; i++)
                     target_grouplist[i] = tswapid(high2lowgid(grouplist[i]));
-                unlock_user(target_grouplist, arg2, gidsetsize * 2);
+                unlock_user(target_grouplist, arg2, gidsetsize * sizeof(target_id));
             }
         }
         break;
@@ -7760,7 +7760,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
             int i;
             if (gidsetsize) {
                 grouplist = alloca(gidsetsize * sizeof(gid_t));
-                target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * 2, 1);
+                target_grouplist = lock_user(VERIFY_READ, arg2, gidsetsize * sizeof(target_id), 1);
                 if (!target_grouplist) {
                     ret = -TARGET_EFAULT;
                     goto fail;
commit 9ab709be595bef9956ea550a95e14e157cb5704e
Author: Andreas Schwab <schwab at suse.de>
Date:   Tue Apr 9 01:02:34 2013 +0000

    linux-user: fix undefined shift in copy_to_user_fdset
    
    If TARGET_ABI_BITS is bigger than 32 we shift by more than the size of int.
    
    Signed-off-by: Andreas Schwab <schwab at suse.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d6d2050..5a786f2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -914,7 +914,7 @@ static inline abi_long copy_to_user_fdset(abi_ulong target_fds_addr,
     for (i = 0; i < nw; i++) {
         v = 0;
         for (j = 0; j < TARGET_ABI_BITS; j++) {
-            v |= ((FD_ISSET(k, fds) != 0) << j);
+            v |= ((abi_ulong)(FD_ISSET(k, fds) != 0) << j);
             k++;
         }
         __put_user(v, &target_fds[i]);
commit c7128c9fd58ee92cae70c7cd1d53acc529cebbbb
Author: Petar Jovanovic <petar.jovanovic at imgtec.com>
Date:   Thu Mar 21 07:57:36 2013 +0000

    linux-user: change do_semop to return target errno when unsuccessful
    
    do_semop() is called from two places, and one of these fails to convert
    return error to target errno when semop fails. This patch changes the
    function to always return target errno in case of an unsuccessful call.
    
    Signed-off-by: Petar Jovanovic <petar.jovanovic at imgtec.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Riku Voipio <riku.voipio at linaro.org>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 1f07621..d6d2050 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2764,7 +2764,7 @@ static inline abi_long do_semop(int semid, abi_long ptr, unsigned nsops)
     if (target_to_host_sembuf(sops, ptr, nsops))
         return -TARGET_EFAULT;
 
-    return semop(semid, sops, nsops);
+    return get_errno(semop(semid, sops, nsops));
 }
 
 struct target_msqid_ds
@@ -6957,7 +6957,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
 #endif
 #ifdef TARGET_NR_semop
     case TARGET_NR_semop:
-        ret = get_errno(do_semop(arg1, arg2, arg3));
+        ret = do_semop(arg1, arg2, arg3);
         break;
 #endif
 #ifdef TARGET_NR_semctl
commit 09dada400328d75daf79e3eca1e48e024fec148d
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:47 2013 +0200

    configure: remove duplicate test
    
    We already had a test to add -march=i486 when needed.  Make the
    existing test independent of vhost-net, so that it is also used
    under Win32.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 1fef9ad..ed49f91 100755
--- a/configure
+++ b/configure
@@ -574,11 +574,6 @@ if test "$mingw32" = "yes" ; then
   QEMU_CFLAGS="-DWIN32_LEAN_AND_MEAN -DWINVER=0x501 $QEMU_CFLAGS"
   # enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later)
   QEMU_CFLAGS="-D__USE_MINGW_ANSI_STDIO=1 $QEMU_CFLAGS"
-  if test "$cpu" = "i386"; then
-    # We need something better than i386 for __sync_val_compare_and_swap
-    # and can expect that QEMU will only run on i686 or later.
-    QEMU_CFLAGS="-march=i686 $QEMU_CFLAGS"
-  fi
   LIBS="-lwinmm -lws2_32 -liphlpapi $LIBS"
 cat > $TMPC << EOF
 int main(void) { return 0; }
@@ -1326,9 +1321,33 @@ EOF
   fi
 fi
 
-#
+##########################################
+# __sync_fetch_and_and requires at least -march=i486. Many toolchains
+# use i686 as default anyway, but for those that don't, an explicit
+# specification is necessary
+
+if test "$cpu" = "i386"; then
+  cat > $TMPC << EOF
+static int sfaa(int *ptr)
+{
+  return __sync_fetch_and_and(ptr, 0);
+}
+
+int main(void)
+{
+  int val = 42;
+  sfaa(&val);
+  return val;
+}
+EOF
+  if ! compile_prog "" "" ; then
+    QEMU_CFLAGS="-march=i486 $QEMU_CFLAGS"
+  fi
+fi
+
+#########################################
 # Solaris specific configure tool chain decisions
-#
+
 if test "$solaris" = "yes" ; then
   if has $install; then
     :
@@ -3169,29 +3188,6 @@ if test "$trace_backend" = "dtrace"; then
 fi
 
 ##########################################
-# __sync_fetch_and_and requires at least -march=i486. Many toolchains
-# use i686 as default anyway, but for those that don't, an explicit
-# specification is necessary
-if test "$vhost_net" = "yes" && test "$cpu" = "i386"; then
-  cat > $TMPC << EOF
-static int sfaa(int *ptr)
-{
-  return __sync_fetch_and_and(ptr, 0);
-}
-
-int main(void)
-{
-  int val = 42;
-  sfaa(&val);
-  return val;
-}
-EOF
-  if ! compile_prog "" "" ; then
-    QEMU_CFLAGS="-march=i486 $QEMU_CFLAGS"
-  fi
-fi
-
-##########################################
 # check and set a backend for coroutine
 
 # We prefer ucontext, but it's not always possible. The fallback
commit 15c08efebde85a564b68285a4b6999f673ce422f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:46 2013 +0200

    configure: CONFIG_NO_XEN is duplicated
    
    We already define it in Makefile.target.  But we need to avoid a
    curious double negation in order to eliminate it.
    
    Tested-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index a71ba6f..1fef9ad 100755
--- a/configure
+++ b/configure
@@ -4299,12 +4299,9 @@ case "$target_arch2" in
       if test "$xen_pci_passthrough" = yes; then
         echo "CONFIG_XEN_PCI_PASSTHROUGH=y" >> "$config_target_mak"
       fi
-    else
-      echo "CONFIG_NO_XEN=y" >> $config_target_mak
     fi
     ;;
   *)
-    echo "CONFIG_NO_XEN=y" >> $config_target_mak
 esac
 case "$target_arch2" in
   arm|i386|x86_64|ppcemb|ppc|ppc64|s390x)
diff --git a/include/hw/xen/xen.h b/include/hw/xen/xen.h
index 6235f91..7451c5a 100644
--- a/include/hw/xen/xen.h
+++ b/include/hw/xen/xen.h
@@ -25,7 +25,7 @@ extern bool xen_allowed;
 
 static inline bool xen_enabled(void)
 {
-#if defined(CONFIG_XEN_BACKEND) && !defined(CONFIG_NO_XEN)
+#if defined(CONFIG_XEN_BACKEND) && defined(CONFIG_XEN)
     return xen_allowed;
 #else
     return 0;
commit 2b6b7099fb17ab9efa51c430e348ee88d6fbcef2
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:45 2013 +0200

    configure: eliminate target_libs_softmmu
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 01d2b12..a71ba6f 100755
--- a/configure
+++ b/configure
@@ -3891,6 +3891,7 @@ fi
 
 if test "$glx" = "yes" ; then
   echo "CONFIG_GLX=y" >> $config_host_mak
+  echo "GLX_LIBS=$glx_libs" >> $config_host_mak
 fi
 
 if test "$libiscsi" = "yes" ; then
@@ -4164,7 +4165,6 @@ bflt="no"
 target_nptl="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_arch2/g"`
 gdb_xml_files=""
-target_libs_softmmu=
 
 TARGET_ARCH="$target_arch2"
 TARGET_BASE_ARCH=""
@@ -4189,7 +4189,6 @@ case "$target_arch2" in
     target_nptl="yes"
   ;;
   lm32)
-    target_libs_softmmu="$glx_libs"
   ;;
   m68k)
     bflt="yes"
@@ -4333,7 +4332,6 @@ if test "$target_bigendian" = "yes" ; then
 fi
 if test "$target_softmmu" = "yes" ; then
   echo "CONFIG_SOFTMMU=y" >> $config_target_mak
-  echo "LIBS+=$target_libs_softmmu" >> $config_target_mak
   case "$target_arch2" in
     i386|x86_64)
       echo "CONFIG_HAVE_CORE_DUMP=y" >> $config_target_mak
diff --git a/default-configs/lm32-softmmu.mak b/default-configs/lm32-softmmu.mak
index ef0f4ba..7df58c8 100644
--- a/default-configs/lm32-softmmu.mak
+++ b/default-configs/lm32-softmmu.mak
@@ -2,6 +2,7 @@
 
 CONFIG_LM32=y
 CONFIG_MILKYMIST=y
+CONFIG_MILKYMIST_TMU2=$(CONFIG_GLX)
 CONFIG_FRAMEBUFFER=y
 CONFIG_PTIMER=y
 CONFIG_PFLASH_CFI01=y
diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index 3f7027d..6e9fb3b 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -18,8 +18,9 @@ common-obj-$(CONFIG_FRAMEBUFFER) += framebuffer.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-vgafb.o
 common-obj-$(CONFIG_ZAURUS) += tc6393xb.o
 
-ifeq ($(CONFIG_GLX),y)
-common-obj-$(CONFIG_MILKYMIST) += milkymist-tmu2.o
+ifeq ($(CONFIG_MILKYMIST_TMU2),y)
+common-obj-y += milkymist-tmu2.o
+libs_softmmu += $(GLX_LIBS)
 endif
 
 obj-$(CONFIG_OMAP) += omap_dss.o
commit f544a488e55d3c504b65b6209199a977df9b24b9
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:44 2013 +0200

    configure: move common libraries to config-host.mak
    
    Move -lm to the end of the line, so that it can be picked up as a
    dependency by pixman in the static build case.
    
    Reviewed-by: Peter Maydell <peter.maydell at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/Makefile.target b/Makefile.target
index 2bd6d14..2636103 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -31,10 +31,6 @@ PROGS+=$(QEMU_PROGW)
 endif
 STPFILES=
 
-ifndef CONFIG_HAIKU
-LIBS+=-lm
-endif
-
 config-target.h: config-target.h-timestamp
 config-target.h-timestamp: config-target.mak
 
@@ -119,7 +115,7 @@ obj-$(CONFIG_HAVE_GET_MEMORY_MAPPING) += memory_mapping.o
 obj-$(CONFIG_HAVE_CORE_DUMP) += dump.o
 obj-$(CONFIG_NO_GET_MEMORY_MAPPING) += memory_mapping-stub.o
 obj-$(CONFIG_NO_CORE_DUMP) += dump-stub.o
-LIBS+=-lz
+LIBS+=$(libs_softmmu)
 
 # xen support
 obj-$(CONFIG_XEN) += xen-all.o xen-mapcache.o
@@ -149,6 +145,10 @@ include $(SRC_PATH)/Makefile.objs
 all-obj-y = $(obj-y)
 all-obj-y += $(addprefix ../, $(common-obj-y))
 
+ifndef CONFIG_HAIKU
+LIBS+=-lm
+endif
+
 ifdef QEMU_PROGW
 # The linker builds a windows executable. Make also a console executable.
 $(QEMU_PROGW): $(all-obj-y) ../libqemuutil.a ../libqemustub.a
diff --git a/configure b/configure
index c274c5f..01d2b12 100755
--- a/configure
+++ b/configure
@@ -1467,6 +1467,7 @@ EOF
             "Make sure to have the zlib libs and headers installed."
     fi
 fi
+libs_softmmu="$libs_softmmu -lz"
 
 ##########################################
 # libseccomp check
@@ -3607,6 +3608,7 @@ echo "qemu_helperdir=$libexecdir" >> $config_host_mak
 echo "extra_cflags=$EXTRA_CFLAGS" >> $config_host_mak
 echo "extra_ldflags=$EXTRA_LDFLAGS" >> $config_host_mak
 echo "qemu_localedir=$qemu_localedir" >> $config_host_mak
+echo "libs_softmmu=$libs_softmmu" >> $config_host_mak
 
 echo "ARCH=$ARCH" >> $config_host_mak
 
@@ -4331,7 +4333,7 @@ if test "$target_bigendian" = "yes" ; then
 fi
 if test "$target_softmmu" = "yes" ; then
   echo "CONFIG_SOFTMMU=y" >> $config_target_mak
-  echo "LIBS+=$libs_softmmu $target_libs_softmmu" >> $config_target_mak
+  echo "LIBS+=$target_libs_softmmu" >> $config_target_mak
   case "$target_arch2" in
     i386|x86_64)
       echo "CONFIG_HAVE_CORE_DUMP=y" >> $config_target_mak
commit 727e52838c709f542d4306849567bf3d8c64479e
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:43 2013 +0200

    configure: move CONFIG_QEMU_LDST_OPTIMIZATION to config-host.mak
    
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 9c10ba8..c274c5f 100755
--- a/configure
+++ b/configure
@@ -3609,6 +3609,15 @@ echo "extra_ldflags=$EXTRA_LDFLAGS" >> $config_host_mak
 echo "qemu_localedir=$qemu_localedir" >> $config_host_mak
 
 echo "ARCH=$ARCH" >> $config_host_mak
+
+case "$cpu" in
+  i386|x86_64|ppc)
+    # The TCG interpreter currently does not support ld/st optimization.
+    if test "$tcg_interpreter" = "no" ; then
+        echo "CONFIG_QEMU_LDST_OPTIMIZATION=y" >> $config_host_mak
+    fi
+  ;;
+esac
 if test "$debug_tcg" = "yes" ; then
   echo "CONFIG_DEBUG_TCG=y" >> $config_host_mak
 fi
@@ -4272,15 +4281,6 @@ upper() {
     echo "$@"| LC_ALL=C tr '[a-z]' '[A-Z]'
 }
 
-case "$cpu" in
-  i386|x86_64|ppc)
-    # The TCG interpreter currently does not support ld/st optimization.
-    if test "$tcg_interpreter" = "no" ; then
-        echo "CONFIG_QEMU_LDST_OPTIMIZATION=y" >> $config_target_mak
-    fi
-  ;;
-esac
-
 echo "TARGET_ARCH=$TARGET_ARCH" >> $config_target_mak
 target_arch_name="`upper $TARGET_ARCH`"
 echo "TARGET_$target_arch_name=y" >> $config_target_mak
commit 918fc54caff20b1810c633a63bf6d6c5499bd5dd
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:42 2013 +0200

    elfload: use abi_llong/ullong instead of target_llong/ullong
    
    The alignment is a characteristic of the ABI, not the CPU.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 4198b4e..9c10ba8 100755
--- a/configure
+++ b/configure
@@ -4153,7 +4153,6 @@ bflt="no"
 target_nptl="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_arch2/g"`
 gdb_xml_files=""
-target_llong_alignment=8
 target_libs_softmmu=
 
 TARGET_ARCH="$target_arch2"
@@ -4174,7 +4173,6 @@ case "$target_arch2" in
     bflt="yes"
     target_nptl="yes"
     gdb_xml_files="arm-core.xml arm-vfp.xml arm-vfp3.xml arm-neon.xml"
-    target_llong_alignment=4
   ;;
   cris)
     target_nptl="yes"
@@ -4185,7 +4183,6 @@ case "$target_arch2" in
   m68k)
     bflt="yes"
     gdb_xml_files="cf-core.xml cf-fp.xml"
-    target_llong_alignment=2
   ;;
   microblaze|microblazeel)
     TARGET_ARCH=microblaze
@@ -4284,7 +4281,6 @@ case "$cpu" in
   ;;
 esac
 
-echo "TARGET_LLONG_ALIGNMENT=$target_llong_alignment" >> $config_target_mak
 echo "TARGET_ARCH=$TARGET_ARCH" >> $config_target_mak
 target_arch_name="`upper $TARGET_ARCH`"
 echo "TARGET_$target_arch_name=y" >> $config_target_mak
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 3cf1272..d8c64e9 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -36,8 +36,6 @@
 
 #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 
-typedef int64_t target_llong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
-typedef uint64_t target_ullong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
 /* target_ulong is the type of a virtual address */
 #if TARGET_LONG_SIZE == 4
 typedef int32_t target_long;
diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index 4b04f6d..008501b 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -11,6 +11,11 @@
 #ifdef TARGET_M68K
 #define ABI_INT_ALIGNMENT 2
 #define ABI_LONG_ALIGNMENT 2
+#define ABI_LLONG_ALIGNMENT 2
+#endif
+
+#ifdef TARGET_ARM
+#define ABI_LLONG_ALIGNMENT 4
 #endif
 
 #ifndef ABI_SHORT_ALIGNMENT
@@ -22,11 +27,16 @@
 #ifndef ABI_LONG_ALIGNMENT
 #define ABI_LONG_ALIGNMENT (TARGET_ABI_BITS / 8)
 #endif
+#ifndef ABI_LLONG_ALIGNMENT
+#define ABI_LLONG_ALIGNMENT 8
+#endif
 
 typedef int16_t abi_short __attribute__ ((aligned(ABI_SHORT_ALIGNMENT)));
 typedef uint16_t abi_ushort __attribute__((aligned(ABI_SHORT_ALIGNMENT)));
 typedef int32_t abi_int __attribute__((aligned(ABI_INT_ALIGNMENT)));
 typedef uint32_t abi_uint __attribute__((aligned(ABI_INT_ALIGNMENT)));
+typedef int64_t abi_llong __attribute__((aligned(ABI_LLONG_ALIGNMENT)));
+typedef uint64_t abi_ullong __attribute__((aligned(ABI_LLONG_ALIGNMENT)));
 
 #ifdef TARGET_ABI32
 typedef uint32_t abi_ulong __attribute__((aligned(ABI_LONG_ALIGNMENT)));
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 14a8ecf..979b57c 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -102,8 +102,8 @@ enum {
 #endif
 
 #ifdef TARGET_ABI_MIPSN32
-typedef target_ulong    target_elf_greg_t;
-#define tswapreg(ptr)   tswapl(ptr)
+typedef abi_ullong      target_elf_greg_t;
+#define tswapreg(ptr)   tswap64(ptr)
 #else
 typedef abi_ulong       target_elf_greg_t;
 #define tswapreg(ptr)   tswapal(ptr)
commit 6cfd9b5251c1d03c60f9ebc95fa98670db8f3e09
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:41 2013 +0200

    elfload: only give abi_long/ulong the alignment specified by the target
    
    Previously, this was done for target_long/ulong, and propagated to
    abi_long/ulong via a typedef.  But target_long/ulong should not
    have any specific alignment, it is never used to access guest
    memory.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 908ba64..4198b4e 100755
--- a/configure
+++ b/configure
@@ -4153,7 +4153,6 @@ bflt="no"
 target_nptl="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_arch2/g"`
 gdb_xml_files=""
-target_long_alignment=4
 target_llong_alignment=8
 target_libs_softmmu=
 
@@ -4166,10 +4165,8 @@ case "$target_arch2" in
   ;;
   x86_64)
     TARGET_BASE_ARCH=i386
-    target_long_alignment=8
   ;;
   alpha)
-    target_long_alignment=8
     target_nptl="yes"
   ;;
   arm|armeb)
@@ -4188,7 +4185,6 @@ case "$target_arch2" in
   m68k)
     bflt="yes"
     gdb_xml_files="cf-core.xml cf-fp.xml"
-    target_long_alignment=2
     target_llong_alignment=2
   ;;
   microblaze|microblazeel)
@@ -4211,7 +4207,6 @@ case "$target_arch2" in
     TARGET_ARCH=mips64
     TARGET_BASE_ARCH=mips
     echo "TARGET_ABI_MIPSN64=y" >> $config_target_mak
-    target_long_alignment=8
   ;;
   moxie)
   ;;
@@ -4233,7 +4228,6 @@ case "$target_arch2" in
     TARGET_BASE_ARCH=ppc
     TARGET_ABI_DIR=ppc
     gdb_xml_files="power64-core.xml power-fpu.xml power-altivec.xml power-spe.xml"
-    target_long_alignment=8
   ;;
   ppc64abi32)
     TARGET_ARCH=ppc64
@@ -4251,7 +4245,6 @@ case "$target_arch2" in
   ;;
   sparc64)
     TARGET_BASE_ARCH=sparc
-    target_long_alignment=8
   ;;
   sparc32plus)
     TARGET_ARCH=sparc64
@@ -4261,7 +4254,6 @@ case "$target_arch2" in
   ;;
   s390x)
     target_nptl="yes"
-    target_long_alignment=8
   ;;
   unicore32)
   ;;
@@ -4292,7 +4284,6 @@ case "$cpu" in
   ;;
 esac
 
-echo "TARGET_LONG_ALIGNMENT=$target_long_alignment" >> $config_target_mak
 echo "TARGET_LLONG_ALIGNMENT=$target_llong_alignment" >> $config_target_mak
 echo "TARGET_ARCH=$TARGET_ARCH" >> $config_target_mak
 target_arch_name="`upper $TARGET_ARCH`"
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 2aa9331..3cf1272 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -40,14 +40,14 @@ typedef int64_t target_llong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
 typedef uint64_t target_ullong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
 /* target_ulong is the type of a virtual address */
 #if TARGET_LONG_SIZE == 4
-typedef int32_t target_long __attribute__((aligned(TARGET_LONG_ALIGNMENT)));
-typedef uint32_t target_ulong __attribute__((aligned(TARGET_LONG_ALIGNMENT)));
+typedef int32_t target_long;
+typedef uint32_t target_ulong;
 #define TARGET_FMT_lx "%08x"
 #define TARGET_FMT_ld "%d"
 #define TARGET_FMT_lu "%u"
 #elif TARGET_LONG_SIZE == 8
-typedef int64_t target_long __attribute__((aligned(TARGET_LONG_ALIGNMENT)));
-typedef uint64_t target_ulong __attribute__((aligned(TARGET_LONG_ALIGNMENT)));
+typedef int64_t target_long;
+typedef uint64_t target_ulong;
 #define TARGET_FMT_lx "%016" PRIx64
 #define TARGET_FMT_ld "%" PRId64
 #define TARGET_FMT_lu "%" PRIu64
diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index 4f3e804..4b04f6d 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -2,8 +2,15 @@
 #define QEMU_TYPES_H
 #include "cpu.h"
 
+#ifdef TARGET_ABI32
+#define TARGET_ABI_BITS 32
+#else
+#define TARGET_ABI_BITS TARGET_LONG_BITS
+#endif
+
 #ifdef TARGET_M68K
 #define ABI_INT_ALIGNMENT 2
+#define ABI_LONG_ALIGNMENT 2
 #endif
 
 #ifndef ABI_SHORT_ALIGNMENT
@@ -12,6 +19,9 @@
 #ifndef ABI_INT_ALIGNMENT
 #define ABI_INT_ALIGNMENT 4
 #endif
+#ifndef ABI_LONG_ALIGNMENT
+#define ABI_LONG_ALIGNMENT (TARGET_ABI_BITS / 8)
+#endif
 
 typedef int16_t abi_short __attribute__ ((aligned(ABI_SHORT_ALIGNMENT)));
 typedef uint16_t abi_ushort __attribute__((aligned(ABI_SHORT_ALIGNMENT)));
@@ -19,12 +29,11 @@ typedef int32_t abi_int __attribute__((aligned(ABI_INT_ALIGNMENT)));
 typedef uint32_t abi_uint __attribute__((aligned(ABI_INT_ALIGNMENT)));
 
 #ifdef TARGET_ABI32
-typedef uint32_t abi_ulong;
-typedef int32_t abi_long;
+typedef uint32_t abi_ulong __attribute__((aligned(ABI_LONG_ALIGNMENT)));
+typedef int32_t abi_long __attribute__((aligned(ABI_LONG_ALIGNMENT)));
 #define TARGET_ABI_FMT_lx "%08x"
 #define TARGET_ABI_FMT_ld "%d"
 #define TARGET_ABI_FMT_lu "%u"
-#define TARGET_ABI_BITS 32
 
 static inline abi_ulong tswapal(abi_ulong v)
 {
@@ -32,12 +41,11 @@ static inline abi_ulong tswapal(abi_ulong v)
 }
 
 #else
-typedef target_ulong abi_ulong;
-typedef target_long abi_long;
+typedef target_ulong abi_ulong __attribute__((aligned(ABI_LONG_ALIGNMENT)));
+typedef target_long abi_long __attribute__((aligned(ABI_LONG_ALIGNMENT)));
 #define TARGET_ABI_FMT_lx TARGET_FMT_lx
 #define TARGET_ABI_FMT_ld TARGET_FMT_ld
 #define TARGET_ABI_FMT_lu TARGET_FMT_lu
-#define TARGET_ABI_BITS TARGET_LONG_BITS
 /* for consistency, define ABI32 too */
 #if TARGET_ABI_BITS == 32
 #define TARGET_ABI32 1
commit f8fd4fc4cd9138576cb1cec15c6ac9416e51eeb8
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:40 2013 +0200

    elfload: use abi_int/uint instead of target_int/uint
    
    The alignment is a characteristic of the ABI, not the CPU.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 6e3d3dd..908ba64 100755
--- a/configure
+++ b/configure
@@ -4153,7 +4153,6 @@ bflt="no"
 target_nptl="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_arch2/g"`
 gdb_xml_files=""
-target_int_alignment=4
 target_long_alignment=4
 target_llong_alignment=8
 target_libs_softmmu=
@@ -4189,7 +4188,6 @@ case "$target_arch2" in
   m68k)
     bflt="yes"
     gdb_xml_files="cf-core.xml cf-fp.xml"
-    target_int_alignment=2
     target_long_alignment=2
     target_llong_alignment=2
   ;;
@@ -4294,7 +4292,6 @@ case "$cpu" in
   ;;
 esac
 
-echo "TARGET_INT_ALIGNMENT=$target_int_alignment" >> $config_target_mak
 echo "TARGET_LONG_ALIGNMENT=$target_long_alignment" >> $config_target_mak
 echo "TARGET_LLONG_ALIGNMENT=$target_llong_alignment" >> $config_target_mak
 echo "TARGET_ARCH=$TARGET_ARCH" >> $config_target_mak
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index d376f0f..2aa9331 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -36,8 +36,6 @@
 
 #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 
-typedef int32_t target_int __attribute__((aligned(TARGET_INT_ALIGNMENT)));
-typedef uint32_t target_uint __attribute__((aligned(TARGET_INT_ALIGNMENT)));
 typedef int64_t target_llong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
 typedef uint64_t target_ullong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
 /* target_ulong is the type of a virtual address */
diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index abaa028..4f3e804 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -2,12 +2,21 @@
 #define QEMU_TYPES_H
 #include "cpu.h"
 
+#ifdef TARGET_M68K
+#define ABI_INT_ALIGNMENT 2
+#endif
+
 #ifndef ABI_SHORT_ALIGNMENT
 #define ABI_SHORT_ALIGNMENT 2
 #endif
+#ifndef ABI_INT_ALIGNMENT
+#define ABI_INT_ALIGNMENT 4
+#endif
 
 typedef int16_t abi_short __attribute__ ((aligned(ABI_SHORT_ALIGNMENT)));
 typedef uint16_t abi_ushort __attribute__((aligned(ABI_SHORT_ALIGNMENT)));
+typedef int32_t abi_int __attribute__((aligned(ABI_INT_ALIGNMENT)));
+typedef uint32_t abi_uint __attribute__((aligned(ABI_INT_ALIGNMENT)));
 
 #ifdef TARGET_ABI32
 typedef uint32_t abi_ulong;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5eca934..14a8ecf 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -113,10 +113,10 @@ typedef abi_ulong       target_elf_greg_t;
 typedef abi_ushort      target_uid_t;
 typedef abi_ushort      target_gid_t;
 #else
-typedef target_uint     target_uid_t;
-typedef target_uint     target_gid_t;
+typedef abi_uint        target_uid_t;
+typedef abi_uint        target_gid_t;
 #endif
-typedef target_int      target_pid_t;
+typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
@@ -2109,9 +2109,9 @@ struct memelfnote {
 };
 
 struct target_elf_siginfo {
-    target_int  si_signo; /* signal number */
-    target_int  si_code;  /* extra code */
-    target_int  si_errno; /* errno */
+    abi_int    si_signo; /* signal number */
+    abi_int    si_code;  /* extra code */
+    abi_int    si_errno; /* errno */
 };
 
 struct target_elf_prstatus {
@@ -2128,7 +2128,7 @@ struct target_elf_prstatus {
     struct target_timeval pr_cutime; /* XXX Cumulative user time */
     struct target_timeval pr_cstime; /* XXX Cumulative system time */
     target_elf_gregset_t      pr_reg;       /* GP registers */
-    target_int         pr_fpvalid;   /* XXX */
+    abi_int            pr_fpvalid;   /* XXX */
 };
 
 #define ELF_PRARGSZ     (80) /* Number of chars for args */
commit 1ddd592fd3b00227a61d5cd890c51b51847a415b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:39 2013 +0200

    elfload: use abi_short/ushort instead of target_short/ushort
    
    The alignment is a characteristic of the ABI, not the CPU.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 20ef50d..6e3d3dd 100755
--- a/configure
+++ b/configure
@@ -4153,7 +4153,6 @@ bflt="no"
 target_nptl="no"
 interp_prefix1=`echo "$interp_prefix" | sed "s/%M/$target_arch2/g"`
 gdb_xml_files=""
-target_short_alignment=2
 target_int_alignment=4
 target_long_alignment=4
 target_llong_alignment=8
@@ -4295,7 +4294,6 @@ case "$cpu" in
   ;;
 esac
 
-echo "TARGET_SHORT_ALIGNMENT=$target_short_alignment" >> $config_target_mak
 echo "TARGET_INT_ALIGNMENT=$target_int_alignment" >> $config_target_mak
 echo "TARGET_LONG_ALIGNMENT=$target_long_alignment" >> $config_target_mak
 echo "TARGET_LLONG_ALIGNMENT=$target_llong_alignment" >> $config_target_mak
diff --git a/include/exec/cpu-defs.h b/include/exec/cpu-defs.h
index 0ae967a..d376f0f 100644
--- a/include/exec/cpu-defs.h
+++ b/include/exec/cpu-defs.h
@@ -36,8 +36,6 @@
 
 #define TARGET_LONG_SIZE (TARGET_LONG_BITS / 8)
 
-typedef int16_t target_short __attribute__ ((aligned(TARGET_SHORT_ALIGNMENT)));
-typedef uint16_t target_ushort __attribute__((aligned(TARGET_SHORT_ALIGNMENT)));
 typedef int32_t target_int __attribute__((aligned(TARGET_INT_ALIGNMENT)));
 typedef uint32_t target_uint __attribute__((aligned(TARGET_INT_ALIGNMENT)));
 typedef int64_t target_llong __attribute__((aligned(TARGET_LLONG_ALIGNMENT)));
diff --git a/include/exec/user/abitypes.h b/include/exec/user/abitypes.h
index fe7f662..abaa028 100644
--- a/include/exec/user/abitypes.h
+++ b/include/exec/user/abitypes.h
@@ -2,6 +2,13 @@
 #define QEMU_TYPES_H
 #include "cpu.h"
 
+#ifndef ABI_SHORT_ALIGNMENT
+#define ABI_SHORT_ALIGNMENT 2
+#endif
+
+typedef int16_t abi_short __attribute__ ((aligned(ABI_SHORT_ALIGNMENT)));
+typedef uint16_t abi_ushort __attribute__((aligned(ABI_SHORT_ALIGNMENT)));
+
 #ifdef TARGET_ABI32
 typedef uint32_t abi_ulong;
 typedef int32_t abi_long;
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index bc2e9f1..5eca934 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -110,8 +110,8 @@ typedef abi_ulong       target_elf_greg_t;
 #endif
 
 #ifdef USE_UID16
-typedef target_ushort   target_uid_t;
-typedef target_ushort   target_gid_t;
+typedef abi_ushort      target_uid_t;
+typedef abi_ushort      target_gid_t;
 #else
 typedef target_uint     target_uid_t;
 typedef target_uint     target_gid_t;
@@ -2116,7 +2116,7 @@ struct target_elf_siginfo {
 
 struct target_elf_prstatus {
     struct target_elf_siginfo pr_info;      /* Info associated with signal */
-    target_short       pr_cursig;    /* Current signal */
+    abi_short          pr_cursig;    /* Current signal */
     abi_ulong          pr_sigpend;   /* XXX */
     abi_ulong          pr_sighold;   /* XXX */
     target_pid_t       pr_pid;
commit 86cd7b2d486b6c80df41f48dffbdcc055a85faa1
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:38 2013 +0200

    elfload: use tswapreg consistently in elf_core_copy_regs
    
    Reviewed-by: Peter Maydell <peter.maydell at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 9d5dbb8..bc2e9f1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -297,25 +297,25 @@ typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
 
 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env)
 {
-    (*regs)[0] = tswapl(env->regs[0]);
-    (*regs)[1] = tswapl(env->regs[1]);
-    (*regs)[2] = tswapl(env->regs[2]);
-    (*regs)[3] = tswapl(env->regs[3]);
-    (*regs)[4] = tswapl(env->regs[4]);
-    (*regs)[5] = tswapl(env->regs[5]);
-    (*regs)[6] = tswapl(env->regs[6]);
-    (*regs)[7] = tswapl(env->regs[7]);
-    (*regs)[8] = tswapl(env->regs[8]);
-    (*regs)[9] = tswapl(env->regs[9]);
-    (*regs)[10] = tswapl(env->regs[10]);
-    (*regs)[11] = tswapl(env->regs[11]);
-    (*regs)[12] = tswapl(env->regs[12]);
-    (*regs)[13] = tswapl(env->regs[13]);
-    (*regs)[14] = tswapl(env->regs[14]);
-    (*regs)[15] = tswapl(env->regs[15]);
-
-    (*regs)[16] = tswapl(cpsr_read((CPUARMState *)env));
-    (*regs)[17] = tswapl(env->regs[0]); /* XXX */
+    (*regs)[0] = tswapreg(env->regs[0]);
+    (*regs)[1] = tswapreg(env->regs[1]);
+    (*regs)[2] = tswapreg(env->regs[2]);
+    (*regs)[3] = tswapreg(env->regs[3]);
+    (*regs)[4] = tswapreg(env->regs[4]);
+    (*regs)[5] = tswapreg(env->regs[5]);
+    (*regs)[6] = tswapreg(env->regs[6]);
+    (*regs)[7] = tswapreg(env->regs[7]);
+    (*regs)[8] = tswapreg(env->regs[8]);
+    (*regs)[9] = tswapreg(env->regs[9]);
+    (*regs)[10] = tswapreg(env->regs[10]);
+    (*regs)[11] = tswapreg(env->regs[11]);
+    (*regs)[12] = tswapreg(env->regs[12]);
+    (*regs)[13] = tswapreg(env->regs[13]);
+    (*regs)[14] = tswapreg(env->regs[14]);
+    (*regs)[15] = tswapreg(env->regs[15]);
+
+    (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env));
+    (*regs)[17] = tswapreg(env->regs[0]); /* XXX */
 }
 
 #define USE_ELF_CORE_DUMP
@@ -681,19 +681,19 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
     target_ulong ccr = 0;
 
     for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
-        (*regs)[i] = tswapl(env->gpr[i]);
+        (*regs)[i] = tswapreg(env->gpr[i]);
     }
 
-    (*regs)[32] = tswapl(env->nip);
-    (*regs)[33] = tswapl(env->msr);
-    (*regs)[35] = tswapl(env->ctr);
-    (*regs)[36] = tswapl(env->lr);
-    (*regs)[37] = tswapl(env->xer);
+    (*regs)[32] = tswapreg(env->nip);
+    (*regs)[33] = tswapreg(env->msr);
+    (*regs)[35] = tswapreg(env->ctr);
+    (*regs)[36] = tswapreg(env->lr);
+    (*regs)[37] = tswapreg(env->xer);
 
     for (i = 0; i < ARRAY_SIZE(env->crf); i++) {
         ccr |= env->crf[i] << (32 - ((i + 1) * 4));
     }
-    (*regs)[38] = tswapl(ccr);
+    (*regs)[38] = tswapreg(ccr);
 }
 
 #define USE_ELF_CORE_DUMP
@@ -801,11 +801,11 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env
     int i, pos = 0;
 
     for (i = 0; i < 32; i++) {
-        (*regs)[pos++] = tswapl(env->regs[i]);
+        (*regs)[pos++] = tswapreg(env->regs[i]);
     }
 
     for (i = 0; i < 6; i++) {
-        (*regs)[pos++] = tswapl(env->sregs[i]);
+        (*regs)[pos++] = tswapreg(env->sregs[i]);
     }
 }
 
@@ -841,11 +841,11 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
     int i;
 
     for (i = 0; i < 32; i++) {
-        (*regs)[i] = tswapl(env->gpr[i]);
+        (*regs)[i] = tswapreg(env->gpr[i]);
     }
 
-    (*regs)[32] = tswapl(env->pc);
-    (*regs)[33] = tswapl(env->sr);
+    (*regs)[32] = tswapreg(env->pc);
+    (*regs)[33] = tswapreg(env->sr);
 }
 #define ELF_HWCAP 0
 #define ELF_PLATFORM NULL
@@ -890,15 +890,15 @@ static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
     int i;
 
     for (i = 0; i < 16; i++) {
-        (*regs[i]) = tswapl(env->gregs[i]);
+        (*regs[i]) = tswapreg(env->gregs[i]);
     }
 
-    (*regs)[TARGET_REG_PC] = tswapl(env->pc);
-    (*regs)[TARGET_REG_PR] = tswapl(env->pr);
-    (*regs)[TARGET_REG_SR] = tswapl(env->sr);
-    (*regs)[TARGET_REG_GBR] = tswapl(env->gbr);
-    (*regs)[TARGET_REG_MACH] = tswapl(env->mach);
-    (*regs)[TARGET_REG_MACL] = tswapl(env->macl);
+    (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
+    (*regs)[TARGET_REG_PR] = tswapreg(env->pr);
+    (*regs)[TARGET_REG_SR] = tswapreg(env->sr);
+    (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr);
+    (*regs)[TARGET_REG_MACH] = tswapreg(env->mach);
+    (*regs)[TARGET_REG_MACL] = tswapreg(env->macl);
     (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */
 }
 
@@ -952,25 +952,25 @@ typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
 
 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env)
 {
-    (*regs)[0] = tswapl(env->dregs[1]);
-    (*regs)[1] = tswapl(env->dregs[2]);
-    (*regs)[2] = tswapl(env->dregs[3]);
-    (*regs)[3] = tswapl(env->dregs[4]);
-    (*regs)[4] = tswapl(env->dregs[5]);
-    (*regs)[5] = tswapl(env->dregs[6]);
-    (*regs)[6] = tswapl(env->dregs[7]);
-    (*regs)[7] = tswapl(env->aregs[0]);
-    (*regs)[8] = tswapl(env->aregs[1]);
-    (*regs)[9] = tswapl(env->aregs[2]);
-    (*regs)[10] = tswapl(env->aregs[3]);
-    (*regs)[11] = tswapl(env->aregs[4]);
-    (*regs)[12] = tswapl(env->aregs[5]);
-    (*regs)[13] = tswapl(env->aregs[6]);
-    (*regs)[14] = tswapl(env->dregs[0]);
-    (*regs)[15] = tswapl(env->aregs[7]);
-    (*regs)[16] = tswapl(env->dregs[0]); /* FIXME: orig_d0 */
-    (*regs)[17] = tswapl(env->sr);
-    (*regs)[18] = tswapl(env->pc);
+    (*regs)[0] = tswapreg(env->dregs[1]);
+    (*regs)[1] = tswapreg(env->dregs[2]);
+    (*regs)[2] = tswapreg(env->dregs[3]);
+    (*regs)[3] = tswapreg(env->dregs[4]);
+    (*regs)[4] = tswapreg(env->dregs[5]);
+    (*regs)[5] = tswapreg(env->dregs[6]);
+    (*regs)[6] = tswapreg(env->dregs[7]);
+    (*regs)[7] = tswapreg(env->aregs[0]);
+    (*regs)[8] = tswapreg(env->aregs[1]);
+    (*regs)[9] = tswapreg(env->aregs[2]);
+    (*regs)[10] = tswapreg(env->aregs[3]);
+    (*regs)[11] = tswapreg(env->aregs[4]);
+    (*regs)[12] = tswapreg(env->aregs[5]);
+    (*regs)[13] = tswapreg(env->aregs[6]);
+    (*regs)[14] = tswapreg(env->dregs[0]);
+    (*regs)[15] = tswapreg(env->aregs[7]);
+    (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
+    (*regs)[17] = tswapreg(env->sr);
+    (*regs)[18] = tswapreg(env->pc);
     (*regs)[19] = 0;  /* FIXME: regs->format | regs->vector */
 }
 
commit a29f998d04a515e389ec4d5aa76ba5f585f4e540
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:37 2013 +0200

    elfload: fix size of registers for N32
    
    Registers are 64-bit in size for the MIPS n32 ABI.  Define
    target_elf_greg_t accordingly, and use the correct function
    to do endian swaps.
    
    Reviewed-by: Peter Maydell <peter.maydell at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d3589ff..9d5dbb8 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -101,7 +101,14 @@ enum {
 #define ELF_DATA        ELFDATA2LSB
 #endif
 
+#ifdef TARGET_ABI_MIPSN32
 typedef target_ulong    target_elf_greg_t;
+#define tswapreg(ptr)   tswapl(ptr)
+#else
+typedef abi_ulong       target_elf_greg_t;
+#define tswapreg(ptr)   tswapal(ptr)
+#endif
+
 #ifdef USE_UID16
 typedef target_ushort   target_uid_t;
 typedef target_ushort   target_gid_t;
@@ -747,17 +754,17 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *e
     (*regs)[TARGET_EF_R0] = 0;
 
     for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
-        (*regs)[TARGET_EF_R0 + i] = tswapl(env->active_tc.gpr[i]);
+        (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
     }
 
     (*regs)[TARGET_EF_R26] = 0;
     (*regs)[TARGET_EF_R27] = 0;
-    (*regs)[TARGET_EF_LO] = tswapl(env->active_tc.LO[0]);
-    (*regs)[TARGET_EF_HI] = tswapl(env->active_tc.HI[0]);
-    (*regs)[TARGET_EF_CP0_EPC] = tswapl(env->active_tc.PC);
-    (*regs)[TARGET_EF_CP0_BADVADDR] = tswapl(env->CP0_BadVAddr);
-    (*regs)[TARGET_EF_CP0_STATUS] = tswapl(env->CP0_Status);
-    (*regs)[TARGET_EF_CP0_CAUSE] = tswapl(env->CP0_Cause);
+    (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
+    (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
+    (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
+    (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
+    (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
+    (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
 }
 
 #define USE_ELF_CORE_DUMP
commit ca98ac830f4e3a7d7729ec1ff22d54d97c86dcbd
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:36 2013 +0200

    elfload: fix size of ABI-dependent fields in core dumps
    
    Some fields in core dumps are 32-bit in 32-or-64 environments (ppc64abi32,
    sparc32plus).  Use abi_long/ulong for those.
    
    Also, the fields of target_elf_siginfo are ints.  Use tswap32 to convert them.
    
    Reviewed-by: Peter Maydell <peter.maydell at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 89db49c..d3589ff 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2110,8 +2110,8 @@ struct target_elf_siginfo {
 struct target_elf_prstatus {
     struct target_elf_siginfo pr_info;      /* Info associated with signal */
     target_short       pr_cursig;    /* Current signal */
-    target_ulong       pr_sigpend;   /* XXX */
-    target_ulong       pr_sighold;   /* XXX */
+    abi_ulong          pr_sigpend;   /* XXX */
+    abi_ulong          pr_sighold;   /* XXX */
     target_pid_t       pr_pid;
     target_pid_t       pr_ppid;
     target_pid_t       pr_pgrp;
@@ -2131,7 +2131,7 @@ struct target_elf_prpsinfo {
     char         pr_sname;       /* char for pr_state */
     char         pr_zomb;        /* zombie */
     char         pr_nice;        /* nice val */
-    target_ulong pr_flag;        /* flags */
+    abi_ulong    pr_flag;        /* flags */
     target_uid_t pr_uid;
     target_gid_t pr_gid;
     target_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid;
@@ -2215,12 +2215,12 @@ static int write_note_info(struct elf_note_info *, int);
 #ifdef BSWAP_NEEDED
 static void bswap_prstatus(struct target_elf_prstatus *prstatus)
 {
-    prstatus->pr_info.si_signo = tswapl(prstatus->pr_info.si_signo);
-    prstatus->pr_info.si_code = tswapl(prstatus->pr_info.si_code);
-    prstatus->pr_info.si_errno = tswapl(prstatus->pr_info.si_errno);
+    prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo);
+    prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code);
+    prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno);
     prstatus->pr_cursig = tswap16(prstatus->pr_cursig);
-    prstatus->pr_sigpend = tswapl(prstatus->pr_sigpend);
-    prstatus->pr_sighold = tswapl(prstatus->pr_sighold);
+    prstatus->pr_sigpend = tswapal(prstatus->pr_sigpend);
+    prstatus->pr_sighold = tswapal(prstatus->pr_sighold);
     prstatus->pr_pid = tswap32(prstatus->pr_pid);
     prstatus->pr_ppid = tswap32(prstatus->pr_ppid);
     prstatus->pr_pgrp = tswap32(prstatus->pr_pgrp);
@@ -2232,7 +2232,7 @@ static void bswap_prstatus(struct target_elf_prstatus *prstatus)
 
 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo)
 {
-    psinfo->pr_flag = tswapl(psinfo->pr_flag);
+    psinfo->pr_flag = tswapal(psinfo->pr_flag);
     psinfo->pr_uid = tswap16(psinfo->pr_uid);
     psinfo->pr_gid = tswap16(psinfo->pr_gid);
     psinfo->pr_pid = tswap32(psinfo->pr_pid);
commit 5b5e30370147ce3495b7509238e88ef9a6d873ec
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Apr 17 16:26:35 2013 +0200

    configure: QEMU_INCLUDES are the same for all subtargets
    
    Reviewed-by: Peter Maydell <peter.maydell at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index 7546799..20ef50d 100755
--- a/configure
+++ b/configure
@@ -4008,6 +4008,19 @@ if test "$trace_default" = "yes"; then
   echo "CONFIG_TRACE_DEFAULT=y" >> $config_host_mak
 fi
 
+if test "$tcg_interpreter" = "yes"; then
+  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/tci $QEMU_INCLUDES"
+elif test "$ARCH" = "sparc64" ; then
+  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/sparc $QEMU_INCLUDES"
+elif test "$ARCH" = "s390x" ; then
+  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/s390 $QEMU_INCLUDES"
+elif test "$ARCH" = "x86_64" ; then
+  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/i386 $QEMU_INCLUDES"
+else
+  QEMU_INCLUDES="-I\$(SRC_PATH)/tcg/\$(ARCH) $QEMU_INCLUDES"
+fi
+QEMU_INCLUDES="-I\$(SRC_PATH)/tcg $QEMU_INCLUDES"
+
 echo "TOOLS=$tools" >> $config_host_mak
 echo "ROMS=$roms" >> $config_host_mak
 echo "MAKE=$make" >> $config_host_mak
@@ -4379,22 +4392,8 @@ fi
 # generate QEMU_CFLAGS/LDFLAGS for targets
 
 cflags=""
-includes=""
 ldflags=""
 
-if test "$tcg_interpreter" = "yes"; then
-  includes="-I\$(SRC_PATH)/tcg/tci $includes"
-elif test "$ARCH" = "sparc64" ; then
-  includes="-I\$(SRC_PATH)/tcg/sparc $includes"
-elif test "$ARCH" = "s390x" ; then
-  includes="-I\$(SRC_PATH)/tcg/s390 $includes"
-elif test "$ARCH" = "x86_64" ; then
-  includes="-I\$(SRC_PATH)/tcg/i386 $includes"
-else
-  includes="-I\$(SRC_PATH)/tcg/\$(ARCH) $includes"
-fi
-includes="-I\$(SRC_PATH)/tcg $includes"
-
 for i in $ARCH $TARGET_BASE_ARCH ; do
   case "$i" in
   alpha)
@@ -4524,7 +4523,6 @@ fi
 
 echo "LDFLAGS+=$ldflags" >> $config_target_mak
 echo "QEMU_CFLAGS+=$cflags" >> $config_target_mak
-echo "QEMU_INCLUDES+=$includes" >> $config_target_mak
 
 done # for target in $targets
 
commit a540f158db41205c3f7bad8b214f9738dc00724d
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Thu Apr 18 14:47:31 2013 +1000

    configure/Make: Build libfdt from submodule DTC
    
    Configure to use the DTC submodule to build libfdt when no system libfdt
    is found. Prompt to install the DTC submodule if --enable-fdt is set but
    no DTC can be found.
    
    DTC has no out-of-tree build capability, so the configure will symlink
    the Makefile and scripts directory in the out of tree build directory
    and pass in all the needed DTC arguments to make out of tree build happen.
    Ideally we fix the DTC make to support out of tree, but did it this way to
    avoid commits to DTC.
    
    Signed-off-by: David Holsgrove <david.holsgrove at xilinx.com>
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/Makefile b/Makefile
index 67f19f2..88375dc 100644
--- a/Makefile
+++ b/Makefile
@@ -145,6 +145,15 @@ pixman/Makefile: $(SRC_PATH)/pixman/configure
 $(SRC_PATH)/pixman/configure:
 	(cd $(SRC_PATH)/pixman; autoreconf -v --install)
 
+DTC_MAKE_ARGS=-I$(SRC_PATH)/dtc VPATH=$(SRC_PATH)/dtc -C dtc V="$(V)" LIBFDT_srcdir=$(SRC_PATH)/dtc/libfdt
+DTC_CFLAGS=$(CFLAGS) $(extra_cflags) -I$(BUILD_DIR)/dtc -I$(SRC_PATH)/dtc -I$(SRC_PATH)/dtc/libfdt
+
+subdir-dtc:dtc/libfdt dtc/tests
+	$(call quiet-command,$(MAKE) $(DTC_MAKE_ARGS) CPPFLAGS="$(DTC_CFLAGS)" LDFLAGS="$(LDFLAGS)" ARFLAGS="$(ARFLAGS)" CC="$(CC)" AR="$(AR)" LD="$(LD)" $(SUBDIR_MAKEFLAGS) libfdt,)
+
+dtc/%:
+	mkdir -p $@
+
 $(SUBDIR_RULES): libqemuutil.a libqemustub.a $(common-obj-y)
 
 ROMSUBDIR_RULES=$(patsubst %,romsubdir-%, $(ROMS))
@@ -262,6 +271,7 @@ distclean: clean
 	rm -rf $$d || exit 1 ; \
         done
 	if test -f pixman/config.log; then make -C pixman distclean; fi
+	if test -f dtc/version_gen.h; then make $(DTC_MAKE_ARGS) clean; fi
 
 KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
diff --git a/configure b/configure
index d5f1516..7546799 100755
--- a/configure
+++ b/configure
@@ -2496,17 +2496,34 @@ if test "$fdt" != "no" ; then
 int main(void) { return 0; }
 EOF
   if compile_prog "" "$fdt_libs" ; then
+    # system DTC is good - use it
     fdt=yes
-    libs_softmmu="$libs_softmmu $fdt_libs"
-  else
-    if test "$fdt" = "yes" ; then
-      feature_not_found "fdt"
+  elif test -d ${source_path}/dtc/libfdt ; then
+    # have submodule DTC - use it
+    fdt=yes
+    dtc_internal="yes"
+    mkdir -p dtc
+    if [ "$source_path" != `pwd` ] ; then
+       symlink "$source_path/dtc/Makefile" "dtc/Makefile"
+       symlink "$source_path/dtc/scripts" "dtc/scripts"
     fi
+    fdt_cflags="-I\$(SRC_PATH)/dtc/libfdt"
+    fdt_libs="-L\$(BUILD_DIR)/dtc/libfdt $fdt_libs"
+  elif test "$fdt" = "yes" ; then
+    # have neither and want - prompt for system/submodule install
+    error_exit "ERROR: DTC not present. Your options:" \
+        "  (1) Preferred: Install the DTC devel package" \
+        "  (2) Fetch the DTC submodule, using:" \
+        "      git submodule update --init dtc"
+  else
+    # don't have and don't want
     fdt_libs=
     fdt=no
   fi
 fi
 
+libs_softmmu="$libs_softmmu $fdt_libs"
+
 ##########################################
 # GLX probe, used by milkymist-tmu2
 if test "$glx" != "no" ; then
@@ -3452,7 +3469,7 @@ if test "$cpu" = "ppc64" -a "$targetos" != "Darwin" ; then
 fi
 
 # add pixman flags after all config tests are done
-QEMU_CFLAGS="$QEMU_CFLAGS $pixman_cflags"
+QEMU_CFLAGS="$QEMU_CFLAGS $pixman_cflags $fdt_cflags"
 libs_softmmu="$libs_softmmu $pixman_libs"
 
 echo "Install prefix    $prefix"
@@ -4515,6 +4532,10 @@ if [ "$pixman" = "internal" ]; then
   echo "config-host.h: subdir-pixman" >> $config_host_mak
 fi
 
+if [ "$dtc_internal" = "yes" ]; then
+  echo "config-host.h: subdir-dtc" >> $config_host_mak
+fi
+
 # build tree in object directory in case the source is not in the current directory
 DIRS="tests tests/tcg tests/tcg/cris tests/tcg/lm32 tests/libqos"
 DIRS="$DIRS pc-bios/optionrom pc-bios/spapr-rtas"
commit 98f6360569b1fbc1d94f6c8d7808577e4e5e0100
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Thu Apr 18 14:46:53 2013 +1000

    dtc: add submodule
    
    Add dtc submodule as a fallback for old distros.
    Picking version 1.3.0. as this is the most recently tagged stable version.
    
    Signed-off-by: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/.gitmodules b/.gitmodules
index cfa2af9..b426ea6 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -22,3 +22,6 @@
 [submodule "pixman"]
 	path = pixman
 	url = git://anongit.freedesktop.org/pixman
+[submodule "dtc"]
+	path = dtc
+	url = git://git.qemu.org/dtc.git
diff --git a/dtc b/dtc
new file mode 160000
index 0000000..bc895d6
--- /dev/null
+++ b/dtc
@@ -0,0 +1 @@
+Subproject commit bc895d6d09695d05ceb8b52486ffe861d6cfbdde
commit 79f3b12f7072d592dcddfe71dd846eab3be310ea
Author: Peter Crosthwaite <peter.crosthwaite at xilinx.com>
Date:   Thu Apr 18 14:46:14 2013 +1000

    configure: Put cross compile flags in EXTRA_CFLAGS
    
    The cross compile CFLAGS are needed to properly build pixman (and any other
    submodules). Only the EXTRA_CFLAGS set is passed to submodules not QEMU_CFLAGS,
    so put the cross compile flags in EXTRA_CFLAGS instead.
    
    Signed-off-by: Peter Crosthwaite peter.crosthwaite at xilinx.com>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias at gmail.com>

diff --git a/configure b/configure
index de93345..d5f1516 100755
--- a/configure
+++ b/configure
@@ -941,33 +941,36 @@ done
 case "$cpu" in
     sparc)
            LDFLAGS="-m32 $LDFLAGS"
-           QEMU_CFLAGS="-m32 -mcpu=ultrasparc $QEMU_CFLAGS"
+           CPU_CFLAGS="-m32 -mcpu=ultrasparc"
            ;;
     sparc64)
            LDFLAGS="-m64 $LDFLAGS"
-           QEMU_CFLAGS="-m64 -mcpu=ultrasparc $QEMU_CFLAGS"
+           CPU_CFLAGS="-m64 -mcpu=ultrasparc"
            ;;
     s390)
-           QEMU_CFLAGS="-m31 -march=z990 $QEMU_CFLAGS"
+           CPU_CFLAGS="-m31 -march=z990"
            LDFLAGS="-m31 $LDFLAGS"
            ;;
     s390x)
-           QEMU_CFLAGS="-m64 -march=z990 $QEMU_CFLAGS"
+           CPU_CFLAGS="-m64 -march=z990"
            LDFLAGS="-m64 $LDFLAGS"
            ;;
     i386)
-           QEMU_CFLAGS="-m32 $QEMU_CFLAGS"
+           CPU_CFLAGS="-m32"
            LDFLAGS="-m32 $LDFLAGS"
            cc_i386='$(CC) -m32'
            ;;
     x86_64)
-           QEMU_CFLAGS="-m64 $QEMU_CFLAGS"
+           CPU_CFLAGS="-m64"
            LDFLAGS="-m64 $LDFLAGS"
            cc_i386='$(CC) -m32'
            ;;
     # No special flags required for other host CPUs
 esac
 
+QEMU_CFLAGS="$CPU_CFLAGS $QEMU_CFLAGS"
+EXTRA_CFLAGS="$CPU_CFLAGS $EXTRA_CFLAGS"
+
 default_target_list=""
 
 # these targets are portable
commit 007e986ff2dd140348e76feb21cde1a51ce6c5b4
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Sun Mar 17 11:45:50 2013 +0100

    vmxcap: Update according to SDM of January 2013
    
    This adds reporting of VMCS shadowing, #VE, IA32_SMBASE, unrestricted
    VMWRITE and fixes the range of the MSEG revision ID.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>

diff --git a/scripts/kvm/vmxcap b/scripts/kvm/vmxcap
index a79f816..c90eda4 100755
--- a/scripts/kvm/vmxcap
+++ b/scripts/kvm/vmxcap
@@ -168,6 +168,8 @@ controls = [
             11: 'RDRAND exiting',
             12: 'Enable INVPCID',
             13: 'Enable VM functions',
+            14: 'VMCS shadowing',
+            18: 'EPT-violation #VE'
             },
         cap_msr = MSR_IA32_VMX_PROCBASED_CTLS2,
         ),
@@ -212,10 +214,12 @@ controls = [
             6: 'HLT activity state',
             7: 'Shutdown activity state',
             8: 'Wait-for-SIPI activity state',
+            15: 'IA32_SMBASE support',
             (16,24): 'Number of CR3-target values',
             (25,27): 'MSR-load/store count recommenation',
             28: 'IA32_SMM_MONITOR_CTL[2] can be set to 1',
-            (32,62): 'MSEG revision identifier',
+            29: 'VMWRITE to VM-exit information fields',
+            (32,63): 'MSEG revision identifier',
             },
         msr = MSR_IA32_VMX_MISC_CTLS,
         ),
commit 917367aa968fd4fef29d340e0c7ec8c608dffaab
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Tue Feb 19 23:27:20 2013 -0300

    target-i386: kvm: save/restore steal time MSR
    
    Read and write steal time MSR, so that reporting is functional across
    migration.
    
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index cf1b05c..a1614e8 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -803,6 +803,7 @@ typedef struct CPUX86State {
 #endif
     uint64_t system_time_msr;
     uint64_t wall_clock_msr;
+    uint64_t steal_time_msr;
     uint64_t async_pf_en_msr;
     uint64_t pv_eoi_en_msr;
 
diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 397afeb..0e7cc81 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -68,6 +68,7 @@ static bool has_msr_tsc_deadline;
 static bool has_msr_async_pf_en;
 static bool has_msr_pv_eoi_en;
 static bool has_msr_misc_enable;
+static bool has_msr_kvm_steal_time;
 static int lm_capable_kernel;
 
 bool kvm_allows_irq0_override(void)
@@ -507,6 +508,8 @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     has_msr_pv_eoi_en = c->eax & (1 << KVM_FEATURE_PV_EOI);
 
+    has_msr_kvm_steal_time = c->eax & (1 << KVM_FEATURE_STEAL_TIME);
+
     cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
 
     for (i = 0; i <= limit; i++) {
@@ -1107,6 +1110,10 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
             kvm_msr_entry_set(&msrs[n++], MSR_KVM_PV_EOI_EN,
                               env->pv_eoi_en_msr);
         }
+        if (has_msr_kvm_steal_time) {
+            kvm_msr_entry_set(&msrs[n++], MSR_KVM_STEAL_TIME,
+                              env->steal_time_msr);
+        }
         if (hyperv_hypercall_available()) {
             kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_GUEST_OS_ID, 0);
             kvm_msr_entry_set(&msrs[n++], HV_X64_MSR_HYPERCALL, 0);
@@ -1360,6 +1367,9 @@ static int kvm_get_msrs(X86CPU *cpu)
     if (has_msr_pv_eoi_en) {
         msrs[n++].index = MSR_KVM_PV_EOI_EN;
     }
+    if (has_msr_kvm_steal_time) {
+        msrs[n++].index = MSR_KVM_STEAL_TIME;
+    }
 
     if (env->mcg_cap) {
         msrs[n++].index = MSR_MCG_STATUS;
@@ -1445,6 +1455,9 @@ static int kvm_get_msrs(X86CPU *cpu)
         case MSR_KVM_PV_EOI_EN:
             env->pv_eoi_en_msr = msrs[i].data;
             break;
+        case MSR_KVM_STEAL_TIME:
+            env->steal_time_msr = msrs[i].data;
+            break;
         }
     }
 
diff --git a/target-i386/machine.c b/target-i386/machine.c
index ee85e57..3659db9 100644
--- a/target-i386/machine.c
+++ b/target-i386/machine.c
@@ -292,6 +292,24 @@ static bool pv_eoi_msr_needed(void *opaque)
     return cpu->env.pv_eoi_en_msr != 0;
 }
 
+static bool steal_time_msr_needed(void *opaque)
+{
+    CPUX86State *cpu = opaque;
+
+    return cpu->steal_time_msr != 0;
+}
+
+static const VMStateDescription vmstate_steal_time_msr = {
+    .name = "cpu/steal_time_msr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(steal_time_msr, CPUX86State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_async_pf_msr = {
     .name = "cpu/async_pf_msr",
     .version_id = 1,
@@ -503,6 +521,9 @@ const VMStateDescription vmstate_x86_cpu = {
             .vmsd = &vmstate_pv_eoi_msr,
             .needed = pv_eoi_msr_needed,
         } , {
+            .vmsd = &vmstate_steal_time_msr,
+            .needed = steal_time_msr_needed,
+        } , {
             .vmsd = &vmstate_fpop_ip_dp,
             .needed = fpop_ip_dp_needed,
         }, {
commit 614413f7f9a88d97ab40ecabd1c7920fb288f820
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Mon Feb 18 07:56:54 2013 +0100

    vmxcap: Report APIC register emulation and RDTSCP control
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>

diff --git a/scripts/kvm/vmxcap b/scripts/kvm/vmxcap
index a1a44a0..a79f816 100755
--- a/scripts/kvm/vmxcap
+++ b/scripts/kvm/vmxcap
@@ -157,10 +157,12 @@ controls = [
             0: 'Virtualize APIC accesses',
             1: 'Enable EPT',
             2: 'Descriptor-table exiting',
+            3: 'Enable RDTSCP',
             4: 'Virtualize x2APIC mode',
             5: 'Enable VPID',
             6: 'WBINVD exiting',
             7: 'Unrestricted guest',
+            8: 'APIC register emulation',
             9: 'Virtual interrupt delivery',
             10: 'PAUSE-loop exiting',
             11: 'RDRAND exiting',
commit ea4ee28399f8ffee4eed2d724c28d2d9879b22fa
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Wed Feb 13 12:44:06 2013 +0100

    vmxcap: Augment reported information
    
    Parse the Basic VMX Information MSR and add the bit for the new posted
    interrupts.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/scripts/kvm/vmxcap b/scripts/kvm/vmxcap
index 6363e73..a1a44a0 100755
--- a/scripts/kvm/vmxcap
+++ b/scripts/kvm/vmxcap
@@ -96,6 +96,19 @@ class Misc(object):
             print '  %-40s %s' % (self.bits[bits], fmt(v))
 
 controls = [
+    Misc(
+        name = 'Basic VMX Information',
+        bits = {
+            (0, 31): 'Revision',
+            (32,44): 'VMCS size',
+            48: 'VMCS restricted to 32 bit addresses',
+            49: 'Dual-monitor support',
+            (50, 53): 'VMCS memory type',
+            54: 'INS/OUTS instruction information',
+            55: 'IA32_VMX_TRUE_*_CTLS support',
+            },
+        msr = MSR_IA32_VMX_BASIC,
+        ),
     Control(
         name = 'pin-based controls',
         bits = {
@@ -103,6 +116,7 @@ controls = [
             3: 'NMI exiting',
             5: 'Virtual NMIs',
             6: 'Activate VMX-preemption timer',
+            7: 'Process posted interrupts',
             },
         cap_msr = MSR_IA32_VMX_PINBASED_CTLS,
         true_cap_msr = MSR_IA32_VMX_TRUE_PINBASED_CTLS,
commit f505a4d74aae6fc8bb5502a6038b5f671aa97713
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Wed Feb 13 12:43:10 2013 +0100

    vmxcap: Open MSR file in unbuffered mode
    
    Python may otherwise decide to to read larger chunks, applying the seek
    only on the software buffer. This will return results from the wrong
    MSRs.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/scripts/kvm/vmxcap b/scripts/kvm/vmxcap
index 0b23f77..6363e73 100755
--- a/scripts/kvm/vmxcap
+++ b/scripts/kvm/vmxcap
@@ -27,9 +27,9 @@ MSR_IA32_VMX_VMFUNC = 0x491
 class msr(object):
     def __init__(self):
         try:
-            self.f = file('/dev/cpu/0/msr')
+            self.f = open('/dev/cpu/0/msr', 'r', 0)
         except:
-            self.f = file('/dev/msr0')
+            self.f = open('/dev/msr0', 'r', 0)
     def read(self, index, default = None):
         import struct
         self.f.seek(index)
commit 22773d6066a7f01a95f78c270edf9dbd2e755ac3
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Mar 31 15:31:14 2013 +0300

    pci: add pci test device
    
    This device is used for kvm unit tests,
    currently it supports testing performance of ioeventfd.
    Using updated kvm unittest, here's an example output:
            mmio-no-eventfd:pci-mem 8796
            mmio-wildcard-eventfd:pci-mem 3609
            mmio-datamatch-eventfd:pci-mem 3685
            portio-no-eventfd:pci-io 5287
            portio-wildcard-eventfd:pci-io 1762
            portio-datamatch-eventfd:pci-io 1777
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/default-configs/pci.mak b/default-configs/pci.mak
index f5f100e..b608f31 100644
--- a/default-configs/pci.mak
+++ b/default-configs/pci.mak
@@ -24,3 +24,4 @@ CONFIG_SERIAL=y
 CONFIG_SERIAL_PCI=y
 CONFIG_IPACK=y
 CONFIG_WDT_IB6300ESB=y
+CONFIG_PCI_TESTDEV=y
diff --git a/docs/specs/pci-testdev.txt b/docs/specs/pci-testdev.txt
new file mode 100644
index 0000000..128ae22
--- /dev/null
+++ b/docs/specs/pci-testdev.txt
@@ -0,0 +1,26 @@
+pci-test is a device used for testing low level IO
+
+device implements up to two BARs: BAR0 and BAR1.
+Each BAR can be memory or IO. Guests must detect
+BAR type and act accordingly.
+
+Each BAR size is up to 4K bytes.
+Each BAR starts with the following header:
+
+typedef struct PCITestDevHdr {
+    uint8_t test;  <- write-only, starts a given test number
+    uint8_t width_type; <- read-only, type and width of access for a given test.
+                           1,2,4 for byte,word or long write.
+                           any other value if test not supported on this BAR
+    uint8_t pad0[2];
+    uint32_t offset; <- read-only, offset in this BAR for a given test
+    uint32_t data;    <- read-only, data to use for a given test
+    uint32_t count;  <- for debugging. number of writes detected.
+    uint8_t name[]; <- for debugging. 0-terminated ASCII string.
+} PCITestDevHdr;
+
+All registers are little endian.
+
+device is expected to always implement tests 0 to N on each BAR, and to add new
+tests with higher numbers.  In this way a guest can scan test numbers until it
+detects an access type that it does not support on this BAR, then stop.
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 03699c3..11b18a4 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -4,6 +4,7 @@ common-obj-$(CONFIG_TMP105) += tmp105.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
+common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
 
 obj-$(CONFIG_VMPORT) += vmport.o
 
diff --git a/hw/misc/pci-testdev.c b/hw/misc/pci-testdev.c
new file mode 100644
index 0000000..71ce5a3
--- /dev/null
+++ b/hw/misc/pci-testdev.c
@@ -0,0 +1,325 @@
+/*
+ * QEMU PCI test device
+ *
+ * Copyright (c) 2012 Red Hat Inc.
+ * Author: Michael S. Tsirkin <mst at redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#include "hw/hw.h"
+#include "hw/pci/pci.h"
+#include "qemu/event_notifier.h"
+#include "qemu/osdep.h"
+
+typedef struct PCITestDevHdr {
+    uint8_t test;
+    uint8_t width;
+    uint8_t pad0[2];
+    uint32_t offset;
+    uint8_t data;
+    uint8_t pad1[3];
+    uint32_t count;
+    uint8_t name[];
+} PCITestDevHdr;
+
+typedef struct IOTest {
+    MemoryRegion *mr;
+    EventNotifier notifier;
+    bool hasnotifier;
+    unsigned size;
+    bool match_data;
+    PCITestDevHdr *hdr;
+    unsigned bufsize;
+} IOTest;
+
+#define IOTEST_DATAMATCH 0xFA
+#define IOTEST_NOMATCH   0xCE
+
+#define IOTEST_IOSIZE 128
+#define IOTEST_MEMSIZE 2048
+
+static const char *iotest_test[] = {
+    "no-eventfd",
+    "wildcard-eventfd",
+    "datamatch-eventfd"
+};
+
+static const char *iotest_type[] = {
+    "mmio",
+    "portio"
+};
+
+#define IOTEST_TEST(i) (iotest_test[((i) % ARRAY_SIZE(iotest_test))])
+#define IOTEST_TYPE(i) (iotest_type[((i) / ARRAY_SIZE(iotest_test))])
+#define IOTEST_MAX_TEST (ARRAY_SIZE(iotest_test))
+#define IOTEST_MAX_TYPE (ARRAY_SIZE(iotest_type))
+#define IOTEST_MAX (IOTEST_MAX_TEST * IOTEST_MAX_TYPE)
+
+enum {
+    IOTEST_ACCESS_NAME,
+    IOTEST_ACCESS_DATA,
+    IOTEST_ACCESS_MAX,
+};
+
+#define IOTEST_ACCESS_TYPE uint8_t
+#define IOTEST_ACCESS_WIDTH (sizeof(uint8_t))
+
+typedef struct PCITestDevState {
+    PCIDevice dev;
+    MemoryRegion mmio;
+    MemoryRegion portio;
+    IOTest *tests;
+    int current;
+} PCITestDevState;
+
+#define IOTEST_IS_MEM(i) (strcmp(IOTEST_TYPE(i), "portio"))
+#define IOTEST_REGION(d, i) (IOTEST_IS_MEM(i) ?  &(d)->mmio : &(d)->portio)
+#define IOTEST_SIZE(i) (IOTEST_IS_MEM(i) ? IOTEST_MEMSIZE : IOTEST_IOSIZE)
+#define IOTEST_PCI_BAR(i) (IOTEST_IS_MEM(i) ? PCI_BASE_ADDRESS_SPACE_MEMORY : \
+                           PCI_BASE_ADDRESS_SPACE_IO)
+
+static int pci_testdev_start(IOTest *test)
+{
+    test->hdr->count = 0;
+    if (!test->hasnotifier) {
+        return 0;
+    }
+    event_notifier_test_and_clear(&test->notifier);
+    memory_region_add_eventfd(test->mr,
+                              le32_to_cpu(test->hdr->offset),
+                              test->size,
+                              test->match_data,
+                              test->hdr->data,
+                              &test->notifier);
+    return 0;
+}
+
+static void pci_testdev_stop(IOTest *test)
+{
+    if (!test->hasnotifier) {
+        return;
+    }
+    memory_region_del_eventfd(test->mr,
+                              le32_to_cpu(test->hdr->offset),
+                              test->size,
+                              test->match_data,
+                              test->hdr->data,
+                              &test->notifier);
+}
+
+static void
+pci_testdev_reset(PCITestDevState *d)
+{
+    if (d->current == -1) {
+        return;
+    }
+    pci_testdev_stop(&d->tests[d->current]);
+    d->current = -1;
+}
+
+static void pci_testdev_inc(IOTest *test, unsigned inc)
+{
+    uint32_t c = le32_to_cpu(test->hdr->count);
+    test->hdr->count = cpu_to_le32(c + inc);
+}
+
+static void
+pci_testdev_write(void *opaque, hwaddr addr, uint64_t val,
+                  unsigned size, int type)
+{
+    PCITestDevState *d = opaque;
+    IOTest *test;
+    int t, r;
+
+    if (addr == offsetof(PCITestDevHdr, test)) {
+        pci_testdev_reset(d);
+        if (val >= IOTEST_MAX_TEST) {
+            return;
+        }
+        t = type * IOTEST_MAX_TEST + val;
+        r = pci_testdev_start(&d->tests[t]);
+        if (r < 0) {
+            return;
+        }
+        d->current = t;
+        return;
+    }
+    if (d->current < 0) {
+        return;
+    }
+    test = &d->tests[d->current];
+    if (addr != le32_to_cpu(test->hdr->offset)) {
+        return;
+    }
+    if (test->match_data && test->size != size) {
+        return;
+    }
+    if (test->match_data && val != test->hdr->data) {
+        return;
+    }
+    pci_testdev_inc(test, 1);
+}
+
+static uint64_t
+pci_testdev_read(void *opaque, hwaddr addr, unsigned size)
+{
+    PCITestDevState *d = opaque;
+    const char *buf;
+    IOTest *test;
+    if (d->current < 0) {
+        return 0;
+    }
+    test = &d->tests[d->current];
+    buf = (const char *)test->hdr;
+    if (addr + size >= test->bufsize) {
+        return 0;
+    }
+    if (test->hasnotifier) {
+        event_notifier_test_and_clear(&test->notifier);
+    }
+    return buf[addr];
+}
+
+static void
+pci_testdev_mmio_write(void *opaque, hwaddr addr, uint64_t val,
+                       unsigned size)
+{
+    pci_testdev_write(opaque, addr, val, size, 0);
+}
+
+static void
+pci_testdev_pio_write(void *opaque, hwaddr addr, uint64_t val,
+                       unsigned size)
+{
+    pci_testdev_write(opaque, addr, val, size, 1);
+}
+
+static const MemoryRegionOps pci_testdev_mmio_ops = {
+    .read = pci_testdev_read,
+    .write = pci_testdev_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static const MemoryRegionOps pci_testdev_pio_ops = {
+    .read = pci_testdev_read,
+    .write = pci_testdev_pio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 1,
+        .max_access_size = 1,
+    },
+};
+
+static int pci_testdev_init(PCIDevice *pci_dev)
+{
+    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev, pci_dev);
+    uint8_t *pci_conf;
+    char *name;
+    int r, i;
+
+    pci_conf = d->dev.config;
+
+    pci_conf[PCI_INTERRUPT_PIN] = 0; /* no interrupt pin */
+
+    memory_region_init_io(&d->mmio, &pci_testdev_mmio_ops, d,
+                          "pci-testdev-mmio", IOTEST_MEMSIZE * 2);
+    memory_region_init_io(&d->portio, &pci_testdev_pio_ops, d,
+                          "pci-testdev-portio", IOTEST_IOSIZE * 2);
+    pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
+    pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->portio);
+
+    d->current = -1;
+    d->tests = g_malloc0(IOTEST_MAX * sizeof *d->tests);
+    for (i = 0; i < IOTEST_MAX; ++i) {
+        IOTest *test = &d->tests[i];
+        name = g_strdup_printf("%s-%s", IOTEST_TYPE(i), IOTEST_TEST(i));
+        test->bufsize = sizeof(PCITestDevHdr) + strlen(name) + 1;
+        test->hdr = g_malloc0(test->bufsize);
+        memcpy(test->hdr->name, name, strlen(name) + 1);
+        g_free(name);
+        test->hdr->offset = cpu_to_le32(IOTEST_SIZE(i) + i * IOTEST_ACCESS_WIDTH);
+        test->size = IOTEST_ACCESS_WIDTH;
+        test->match_data = strcmp(IOTEST_TEST(i), "wildcard-eventfd");
+        test->hdr->test = i;
+        test->hdr->data = test->match_data ? IOTEST_DATAMATCH : IOTEST_NOMATCH;
+        test->hdr->width = IOTEST_ACCESS_WIDTH;
+        test->mr = IOTEST_REGION(d, i);
+        if (!strcmp(IOTEST_TEST(i), "no-eventfd")) {
+            test->hasnotifier = false;
+            continue;
+        }
+        r = event_notifier_init(&test->notifier, 0);
+        assert(r >= 0);
+        test->hasnotifier = true;
+    }
+
+    return 0;
+}
+
+static void
+pci_testdev_uninit(PCIDevice *dev)
+{
+    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev, dev);
+    int i;
+
+    pci_testdev_reset(d);
+    for (i = 0; i < IOTEST_MAX; ++i) {
+        if (d->tests[i].hasnotifier) {
+            event_notifier_cleanup(&d->tests[i].notifier);
+        }
+        g_free(d->tests[i].hdr);
+    }
+    g_free(d->tests);
+    memory_region_destroy(&d->mmio);
+    memory_region_destroy(&d->portio);
+}
+
+static void qdev_pci_testdev_reset(DeviceState *dev)
+{
+    PCITestDevState *d = DO_UPCAST(PCITestDevState, dev.qdev, dev);
+    pci_testdev_reset(d);
+}
+
+static void pci_testdev_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->init = pci_testdev_init;
+    k->exit = pci_testdev_uninit;
+    k->vendor_id = PCI_VENDOR_ID_REDHAT;
+    k->device_id = PCI_DEVICE_ID_REDHAT_TEST;
+    k->revision = 0x00;
+    k->class_id = PCI_CLASS_OTHERS;
+    dc->desc = "PCI Test Device";
+    dc->reset = qdev_pci_testdev_reset;
+}
+
+static const TypeInfo pci_testdev_info = {
+    .name          = "pci-testdev",
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PCITestDevState),
+    .class_init    = pci_testdev_class_init,
+};
+
+static void pci_testdev_register_types(void)
+{
+    type_register_static(&pci_testdev_info);
+}
+
+type_init(pci_testdev_register_types)
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 05315c0..7053d5b 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -85,6 +85,7 @@
 #define PCI_DEVICE_ID_REDHAT_SERIAL      0x0002
 #define PCI_DEVICE_ID_REDHAT_SERIAL2     0x0003
 #define PCI_DEVICE_ID_REDHAT_SERIAL4     0x0004
+#define PCI_DEVICE_ID_REDHAT_TEST        0x0005
 #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
 
 #define FMT_PCIBUS                      PRIx64
commit 97ebbab0e324831dff47dbfa4bed55808cb3ec74
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 16:14:48 2013 +0200

    nbd: set TCP_NODELAY
    
    Disable the Nagle algorithm to reduce latency.  Note this means we must
    also use TCP_CORK when sending header followed by payload to avoid
    fragmenting lots of little packets.  The previous patch took care of
    that.
    
    Suggested-by: Nick Thomas <nick at bytemark.co.uk>
    Tested-by: Nick Thomas <nick at bytemark.co.uk>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/nbd.c b/block/nbd.c
index 485bbf0..d9dc454 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -406,6 +406,9 @@ static int nbd_establish_connection(BlockDriverState *bs)
         sock = unix_socket_outgoing(qemu_opt_get(s->socket_opts, "path"));
     } else {
         sock = tcp_socket_outgoing_opts(s->socket_opts);
+        if (sock >= 0) {
+            socket_set_nodelay(sock);
+        }
     }
 
     /* Failed to establish connection */
commit 0fcece25c0b1b79b39d1dff5c2c55b88feae7eef
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 16:14:47 2013 +0200

    nbd: use TCP_CORK in nbd_co_send_request()
    
    Use TCP_CORK to defer packet transmission until both the header and the
    payload have been written.
    
    Suggested-by: Nick Thomas <nick at bytemark.co.uk>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/nbd.c b/block/nbd.c
index 662df16..485bbf0 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -334,13 +334,23 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
     s->send_coroutine = qemu_coroutine_self();
     qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write,
                             nbd_have_request, s);
-    rc = nbd_send_request(s->sock, request);
-    if (rc >= 0 && qiov) {
-        ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
-                            offset, request->len);
-        if (ret != request->len) {
-            rc = -EIO;
+    if (qiov) {
+        if (!s->is_unix) {
+            socket_set_cork(s->sock, 1);
         }
+        rc = nbd_send_request(s->sock, request);
+        if (rc >= 0) {
+            ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
+                                offset, request->len);
+            if (ret != request->len) {
+                rc = -EIO;
+            }
+        }
+        if (!s->is_unix) {
+            socket_set_cork(s->sock, 0);
+        }
+    } else {
+        rc = nbd_send_request(s->sock, request);
     }
     qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
                             nbd_have_request, s);
commit 6760c47aa42ce30efdd12c132f73c8749c575995
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Mon Apr 15 16:14:46 2013 +0200

    nbd: unlock mutex in nbd_co_send_request() error path
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/block/nbd.c b/block/nbd.c
index eff683c..662df16 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -339,7 +339,7 @@ static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request,
         ret = qemu_co_sendv(s->sock, qiov->iov, qiov->niov,
                             offset, request->len);
         if (ret != request->len) {
-            return -EIO;
+            rc = -EIO;
         }
     }
     qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL,
commit 41cb62c2d9a5a2668165fdd6f195f54ad30e5396
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Apr 2 16:52:25 2013 +0300

    kvm: support non datamatch ioeventfd
    
    Adding restrictions just adds code.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/kvm-all.c b/kvm-all.c
index 589e37c..ce823f9 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -501,21 +501,24 @@ int kvm_check_extension(KVMState *s, unsigned int extension)
 }
 
 static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val,
-                                  bool assign, uint32_t size)
+                                  bool assign, uint32_t size, bool datamatch)
 {
     int ret;
     struct kvm_ioeventfd iofd;
 
-    iofd.datamatch = val;
+    iofd.datamatch = datamatch ? val : 0;
     iofd.addr = addr;
     iofd.len = size;
-    iofd.flags = KVM_IOEVENTFD_FLAG_DATAMATCH;
+    iofd.flags = 0;
     iofd.fd = fd;
 
     if (!kvm_enabled()) {
         return -ENOSYS;
     }
 
+    if (datamatch) {
+        iofd.flags |= KVM_IOEVENTFD_FLAG_DATAMATCH;
+    }
     if (!assign) {
         iofd.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
     }
@@ -530,19 +533,22 @@ static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val,
 }
 
 static int kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint16_t val,
-                                 bool assign, uint32_t size)
+                                 bool assign, uint32_t size, bool datamatch)
 {
     struct kvm_ioeventfd kick = {
-        .datamatch = val,
+        .datamatch = datamatch ? val : 0,
         .addr = addr,
+        .flags = KVM_IOEVENTFD_FLAG_PIO,
         .len = size,
-        .flags = KVM_IOEVENTFD_FLAG_DATAMATCH | KVM_IOEVENTFD_FLAG_PIO,
         .fd = fd,
     };
     int r;
     if (!kvm_enabled()) {
         return -ENOSYS;
     }
+    if (datamatch) {
+        kick.flags |= KVM_IOEVENTFD_FLAG_DATAMATCH;
+    }
     if (!assign) {
         kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
     }
@@ -571,7 +577,7 @@ static int kvm_check_many_ioeventfds(void)
         if (ioeventfds[i] < 0) {
             break;
         }
-        ret = kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, true, 2);
+        ret = kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, true, 2, true);
         if (ret < 0) {
             close(ioeventfds[i]);
             break;
@@ -582,7 +588,7 @@ static int kvm_check_many_ioeventfds(void)
     ret = i == ARRAY_SIZE(ioeventfds);
 
     while (i-- > 0) {
-        kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, false, 2);
+        kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, false, 2, true);
         close(ioeventfds[i]);
     }
     return ret;
@@ -802,10 +808,8 @@ static void kvm_mem_ioeventfd_add(MemoryListener *listener,
     int fd = event_notifier_get_fd(e);
     int r;
 
-    assert(match_data && section->size <= 8);
-
     r = kvm_set_ioeventfd_mmio(fd, section->offset_within_address_space,
-                               data, true, section->size);
+                               data, true, section->size, match_data);
     if (r < 0) {
         abort();
     }
@@ -820,7 +824,7 @@ static void kvm_mem_ioeventfd_del(MemoryListener *listener,
     int r;
 
     r = kvm_set_ioeventfd_mmio(fd, section->offset_within_address_space,
-                               data, false, section->size);
+                               data, false, section->size, match_data);
     if (r < 0) {
         abort();
     }
@@ -834,10 +838,8 @@ static void kvm_io_ioeventfd_add(MemoryListener *listener,
     int fd = event_notifier_get_fd(e);
     int r;
 
-    assert(match_data && section->size <= 8);
-
     r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
-                              data, true, section->size);
+                              data, true, section->size, match_data);
     if (r < 0) {
         abort();
     }
@@ -853,7 +855,7 @@ static void kvm_io_ioeventfd_del(MemoryListener *listener,
     int r;
 
     r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
-                              data, false, section->size);
+                              data, false, section->size, match_data);
     if (r < 0) {
         abort();
     }
commit 44c3f8f7c77ff24edbd4e682c12a8f1f50a20ae9
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Apr 2 00:54:45 2013 +0300

    kvm: support any size for pio eventfd
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/kvm-all.c b/kvm-all.c
index ca9775d..589e37c 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -500,8 +500,8 @@ int kvm_check_extension(KVMState *s, unsigned int extension)
     return ret;
 }
 
-static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val, bool assign,
-                                  uint32_t size)
+static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val,
+                                  bool assign, uint32_t size)
 {
     int ret;
     struct kvm_ioeventfd iofd;
@@ -529,13 +529,13 @@ static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val, bool assi
     return 0;
 }
 
-static int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val,
-                                      bool assign)
+static int kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint16_t val,
+                                 bool assign, uint32_t size)
 {
     struct kvm_ioeventfd kick = {
         .datamatch = val,
         .addr = addr,
-        .len = 2,
+        .len = size,
         .flags = KVM_IOEVENTFD_FLAG_DATAMATCH | KVM_IOEVENTFD_FLAG_PIO,
         .fd = fd,
     };
@@ -571,7 +571,7 @@ static int kvm_check_many_ioeventfds(void)
         if (ioeventfds[i] < 0) {
             break;
         }
-        ret = kvm_set_ioeventfd_pio_word(ioeventfds[i], 0, i, true);
+        ret = kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, true, 2);
         if (ret < 0) {
             close(ioeventfds[i]);
             break;
@@ -582,7 +582,7 @@ static int kvm_check_many_ioeventfds(void)
     ret = i == ARRAY_SIZE(ioeventfds);
 
     while (i-- > 0) {
-        kvm_set_ioeventfd_pio_word(ioeventfds[i], 0, i, false);
+        kvm_set_ioeventfd_pio(ioeventfds[i], 0, i, false, 2);
         close(ioeventfds[i]);
     }
     return ret;
@@ -834,10 +834,10 @@ static void kvm_io_ioeventfd_add(MemoryListener *listener,
     int fd = event_notifier_get_fd(e);
     int r;
 
-    assert(match_data && section->size == 2);
+    assert(match_data && section->size <= 8);
 
-    r = kvm_set_ioeventfd_pio_word(fd, section->offset_within_address_space,
-                                   data, true);
+    r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
+                              data, true, section->size);
     if (r < 0) {
         abort();
     }
@@ -852,8 +852,8 @@ static void kvm_io_ioeventfd_del(MemoryListener *listener,
     int fd = event_notifier_get_fd(e);
     int r;
 
-    r = kvm_set_ioeventfd_pio_word(fd, section->offset_within_address_space,
-                                   data, false);
+    r = kvm_set_ioeventfd_pio(fd, section->offset_within_address_space,
+                              data, false, section->size);
     if (r < 0) {
         abort();
     }
commit 500ffd4a29bda2109ab07fadc0f767473dab6010
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Apr 2 00:05:21 2013 +0300

    kvm: remove unused APIs
    
    There are only used internally now, move them
    out of header and out of stub.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index f2d97b5..4a65d9f 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -283,10 +283,6 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram_addr,
 #endif
 
 #endif
-int kvm_set_ioeventfd_mmio(int fd, uint32_t adr, uint32_t val, bool assign,
-                           uint32_t size);
-
-int kvm_set_ioeventfd_pio_word(int fd, uint16_t adr, uint16_t val, bool assign);
 
 int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg);
 int kvm_irqchip_update_msi_route(KVMState *s, int virq, MSIMessage msg);
diff --git a/kvm-all.c b/kvm-all.c
index 9b433d3..ca9775d 100644
--- a/kvm-all.c
+++ b/kvm-all.c
@@ -500,6 +500,60 @@ int kvm_check_extension(KVMState *s, unsigned int extension)
     return ret;
 }
 
+static int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val, bool assign,
+                                  uint32_t size)
+{
+    int ret;
+    struct kvm_ioeventfd iofd;
+
+    iofd.datamatch = val;
+    iofd.addr = addr;
+    iofd.len = size;
+    iofd.flags = KVM_IOEVENTFD_FLAG_DATAMATCH;
+    iofd.fd = fd;
+
+    if (!kvm_enabled()) {
+        return -ENOSYS;
+    }
+
+    if (!assign) {
+        iofd.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
+    }
+
+    ret = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &iofd);
+
+    if (ret < 0) {
+        return -errno;
+    }
+
+    return 0;
+}
+
+static int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val,
+                                      bool assign)
+{
+    struct kvm_ioeventfd kick = {
+        .datamatch = val,
+        .addr = addr,
+        .len = 2,
+        .flags = KVM_IOEVENTFD_FLAG_DATAMATCH | KVM_IOEVENTFD_FLAG_PIO,
+        .fd = fd,
+    };
+    int r;
+    if (!kvm_enabled()) {
+        return -ENOSYS;
+    }
+    if (!assign) {
+        kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
+    }
+    r = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
+    if (r < 0) {
+        return r;
+    }
+    return 0;
+}
+
+
 static int kvm_check_many_ioeventfds(void)
 {
     /* Userspace can use ioeventfd for io notification.  This requires a host
@@ -1971,59 +2025,6 @@ int kvm_set_signal_mask(CPUArchState *env, const sigset_t *sigset)
 
     return r;
 }
-
-int kvm_set_ioeventfd_mmio(int fd, uint32_t addr, uint32_t val, bool assign,
-                           uint32_t size)
-{
-    int ret;
-    struct kvm_ioeventfd iofd;
-
-    iofd.datamatch = val;
-    iofd.addr = addr;
-    iofd.len = size;
-    iofd.flags = KVM_IOEVENTFD_FLAG_DATAMATCH;
-    iofd.fd = fd;
-
-    if (!kvm_enabled()) {
-        return -ENOSYS;
-    }
-
-    if (!assign) {
-        iofd.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
-    }
-
-    ret = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &iofd);
-
-    if (ret < 0) {
-        return -errno;
-    }
-
-    return 0;
-}
-
-int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val, bool assign)
-{
-    struct kvm_ioeventfd kick = {
-        .datamatch = val,
-        .addr = addr,
-        .len = 2,
-        .flags = KVM_IOEVENTFD_FLAG_DATAMATCH | KVM_IOEVENTFD_FLAG_PIO,
-        .fd = fd,
-    };
-    int r;
-    if (!kvm_enabled()) {
-        return -ENOSYS;
-    }
-    if (!assign) {
-        kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
-    }
-    r = kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
-    if (r < 0) {
-        return r;
-    }
-    return 0;
-}
-
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
 {
     return kvm_arch_on_sigbus_vcpu(cpu, code, addr);
diff --git a/kvm-stub.c b/kvm-stub.c
index 760aadc..ef1f201 100644
--- a/kvm-stub.c
+++ b/kvm-stub.c
@@ -102,16 +102,6 @@ int kvm_set_signal_mask(CPUArchState *env, const sigset_t *sigset)
 }
 #endif
 
-int kvm_set_ioeventfd_pio_word(int fd, uint16_t addr, uint16_t val, bool assign)
-{
-    return -ENOSYS;
-}
-
-int kvm_set_ioeventfd_mmio(int fd, uint32_t adr, uint32_t val, bool assign, uint32_t len)
-{
-    return -ENOSYS;
-}
-
 int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
 {
     return 1;


More information about the Spice-commits mailing list