[Spice-commits] 178 commits - .travis.yml MAINTAINERS Makefile VERSION arch_init.c audio/ossaudio.c backends/rng-egd.c block.c block/Makefile.objs block/qcow2-cluster.c block/raw-posix.c block/raw-win32.c block/vhdx-endian.c block/vhdx-log.c block/vhdx.c block/vhdx.h block/vpc.c blockdev.c configure exec.c hw/char hw/core hw/display hw/i386 hw/mips hw/misc hw/net hw/nvram hw/openrisc hw/pci hw/pci-host hw/ppc hw/s390x hw/scsi hw/sparc hw/usb hw/virtio include/hw include/net include/qemu include/sysemu linux-user/syscall.c linux-user/syscall_defs.h net/net.c pc-bios/QEMU, tcx.bin pc-bios/README pc-bios/keymaps pc-bios/slof.bin qapi-schema.json qemu-img.c qemu-options.hx qemu.nsi qga/commands-posix.c qga/commands-win32.c qga/guest-agent-core.h qga/vss-win32 qom/object.c roms/SLOF savevm.c scripts/qapi-visit.py target-i386/cpu.c target-i386/helper.h target-i386/kvm-stub.c target-i386/kvm.c target-i386/misc_helper.c target-i386/translate.c target-openrisc/cpu.h target-openrisc/interrupt. c target-openrisc/mmu.c target-openrisc/sys_helper.c target-openrisc/translate.c target-xtensa/core-dc233c.c tcg/ia64 tests/Makefile tests/blockdev-test.c tests/boot-order-test.c tests/endianness-test.c tests/fdc-test.c tests/fw_cfg-test.c tests/hd-geo-test.c tests/i440fx-test.c tests/ide-test.c tests/libqtest.c tests/libqtest.h tests/m48t59-test.c tests/qdev-monitor-test.c tests/qemu-iotests tests/qom-test.c tests/rtc-test.c tests/tcg tests/tmp105-test.c ui/console.c ui/curses.c ui/keymaps.c ui/vnc_keysym.h util/qemu-config.c vl.c

Gerd Hoffmann kraxel at kemper.freedesktop.org
Mon Dec 2 06:55:00 PST 2013


 .travis.yml                                                      |   71 
 MAINTAINERS                                                      |   46 
 Makefile                                                         |   13 
 VERSION                                                          |    2 
 arch_init.c                                                      |    8 
 audio/ossaudio.c                                                 |    6 
 backends/rng-egd.c                                               |    5 
 block.c                                                          |   13 
 block/Makefile.objs                                              |    2 
 block/qcow2-cluster.c                                            |    2 
 block/raw-posix.c                                                |    4 
 block/raw-win32.c                                                |    1 
 block/vhdx-endian.c                                              |  216 +
 block/vhdx-log.c                                                 | 1010 ++++++++
 block/vhdx.c                                                     | 1220 ++++++++--
 block/vhdx.h                                                     |  178 +
 block/vpc.c                                                      |    9 
 blockdev.c                                                       |   35 
 configure                                                        |   57 
 exec.c                                                           |   13 
 hw/char/spapr_vty.c                                              |    1 
 hw/core/qdev-properties-system.c                                 |    9 
 hw/display/tcx.c                                                 |   26 
 hw/i386/Makefile.objs                                            |    2 
 hw/i386/acpi-build.c                                             |   25 
 hw/i386/bios-linker-loader.c                                     |    8 
 hw/i386/kvm/pci-assign.c                                         |   92 
 hw/i386/pc_piix.c                                                |    9 
 hw/i386/pc_q35.c                                                 |    9 
 hw/mips/mips_jazz.c                                              |   24 
 hw/misc/pvpanic.c                                                |    5 
 hw/misc/vfio.c                                                   |    7 
 hw/net/e1000.c                                                   |    2 
 hw/net/rtl8139.c                                                 |    5 
 hw/net/smc91c111.c                                               |    1 
 hw/net/spapr_llan.c                                              |    1 
 hw/net/virtio-net.c                                              |   11 
 hw/nvram/spapr_nvram.c                                           |    1 
 hw/openrisc/cputimer.c                                           |   29 
 hw/pci-host/piix.c                                               |    9 
 hw/pci-host/q35.c                                                |   10 
 hw/pci/pci.c                                                     |   34 
 hw/ppc/ppc440_bamboo.c                                           |    3 
 hw/ppc/ppc_booke.c                                               |   49 
 hw/s390x/ipl.c                                                   |   17 
 hw/scsi/spapr_vscsi.c                                            |    1 
 hw/sparc/sun4m.c                                                 |   17 
 hw/usb/dev-network.c                                             |    1 
 hw/virtio/virtio-rng.c                                           |    6 
 include/hw/i386/pc.h                                             |   17 
 include/hw/loader.h                                              |    2 
 include/hw/pci-host/q35.h                                        |    1 
 include/hw/pci/pci_bus.h                                         |    1 
 include/net/eth.h                                                |    6 
 include/qemu/atomic.h                                            |    6 
 include/qemu/config-file.h                                       |    1 
 include/sysemu/sysemu.h                                          |    2 
 linux-user/syscall.c                                             |    6 
 linux-user/syscall_defs.h                                        |   14 
 net/net.c                                                        |    7 
 pc-bios/QEMU,tcx.bin                                             |binary
 pc-bios/README                                                   |    6 
 pc-bios/keymaps/cz                                               |   94 
 pc-bios/slof.bin                                                 |binary
 qapi-schema.json                                                 |    5 
 qemu-img.c                                                       |    6 
 qemu-options.hx                                                  |    6 
 qemu.nsi                                                         |    6 
 qga/commands-posix.c                                             |   10 
 qga/commands-win32.c                                             |    4 
 qga/guest-agent-core.h                                           |    2 
 qga/vss-win32/install.cpp                                        |   16 
 qga/vss-win32/requester.h                                        |    1 
 qom/object.c                                                     |    5 
 roms/SLOF                                                        |    2 
 savevm.c                                                         |    2 
 scripts/qapi-visit.py                                            |   17 
 target-i386/cpu.c                                                |   14 
 target-i386/helper.h                                             |    1 
 target-i386/kvm-stub.c                                           |   12 
 target-i386/kvm.c                                                |   13 
 target-i386/misc_helper.c                                        |   22 
 target-i386/translate.c                                          |   97 
 target-openrisc/cpu.h                                            |    1 
 target-openrisc/interrupt.c                                      |   25 
 target-openrisc/mmu.c                                            |    4 
 target-openrisc/sys_helper.c                                     |   54 
 target-openrisc/translate.c                                      |   95 
 target-xtensa/core-dc233c.c                                      |    1 
 tcg/ia64/tcg-target.c                                            |  755 +++---
 tcg/ia64/tcg-target.h                                            |    4 
 tests/Makefile                                                   |    4 
 tests/blockdev-test.c                                            |   59 
 tests/boot-order-test.c                                          |    6 
 tests/endianness-test.c                                          |    6 
 tests/fdc-test.c                                                 |   15 
 tests/fw_cfg-test.c                                              |    3 
 tests/hd-geo-test.c                                              |    2 
 tests/i440fx-test.c                                              |    2 
 tests/ide-test.c                                                 |   10 
 tests/libqtest.c                                                 |   73 
 tests/libqtest.h                                                 |   51 
 tests/m48t59-test.c                                              |    2 
 tests/qdev-monitor-test.c                                        |   81 
 tests/qemu-iotests/017                                           |    2 
 tests/qemu-iotests/019                                           |    6 
 tests/qemu-iotests/039                                           |    2 
 tests/qemu-iotests/041                                           |   41 
 tests/qemu-iotests/041.out                                       |    4 
 tests/qemu-iotests/048                                           |   34 
 tests/qemu-iotests/048.out                                       |   27 
 tests/qemu-iotests/051                                           |   15 
 tests/qemu-iotests/051.out                                       |   11 
 tests/qemu-iotests/061                                           |    6 
 tests/qemu-iotests/064                                           |   11 
 tests/qemu-iotests/064.out                                       |   14 
 tests/qemu-iotests/067                                           |    2 
 tests/qemu-iotests/067.out                                       |   10 
 tests/qemu-iotests/069.out                                       |    2 
 tests/qemu-iotests/070                                           |   67 
 tests/qemu-iotests/070.out                                       |    8 
 tests/qemu-iotests/073                                           |  166 +
 tests/qemu-iotests/073.out                                       |  118 
 tests/qemu-iotests/common                                        |    1 
 tests/qemu-iotests/common.pattern                                |   12 
 tests/qemu-iotests/common.rc                                     |   18 
 tests/qemu-iotests/group                                         |    2 
 tests/qemu-iotests/sample_images/iotest-dirtylog-10G-4M.vhdx.bz2 |binary
 tests/qom-test.c                                                 |    2 
 tests/rtc-test.c                                                 |    2 
 tests/tcg/openrisc/test_addc.c                                   |    8 
 tests/tcg/openrisc/test_addic.c                                  |   10 
 tests/tmp105-test.c                                              |    2 
 ui/console.c                                                     |   33 
 ui/curses.c                                                      |   44 
 ui/keymaps.c                                                     |    6 
 ui/vnc_keysym.h                                                  |  373 +++
 util/qemu-config.c                                               |   77 
 vl.c                                                             |    4 
 139 files changed, 5022 insertions(+), 1100 deletions(-)

New commits:
commit 7dc65c02fe3fb8f3146ce0b9ff5fec5945329f0e
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 27 14:02:45 2013 -0800

    Open 2.0 development tree
    
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/VERSION b/VERSION
index bd8bf88..536bc46 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.7.0
+1.7.50
commit 0e7b9f06a6cc032be6ca2ac55a27592abd374179
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 27 11:30:46 2013 -0800

    Update version for 1.7.0 release
    
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/VERSION b/VERSION
index b9e17f3..bd8bf88 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.6.92
+1.7.0
commit 171d64319c9604228429b0580edf764a69b67c75
Author: Max Reitz <mreitz at redhat.com>
Date:   Mon Nov 25 20:28:56 2013 +0100

    qemu-iotests: Fix test 041
    
    Performing multiple drive-mirror blockjobs on the same qemu instance
    results in the image file used for the block device being replaced by
    the newly mirrored file, which is not what we want.
    
    Fix this by performing one dedicated test per sync mode.
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1385407736-13941-3-git-send-email-mreitz at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 5d40265..ec470b2 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -691,16 +691,32 @@ class TestUnbackedSource(ImageMirroringTestCase):
         os.remove(test_img)
         os.remove(target_img)
 
-    def test_absolute_paths(self):
+    def test_absolute_paths_full(self):
+        self.assert_no_active_block_jobs()
+        result = self.vm.qmp('drive-mirror', device='drive0',
+                             sync='full', target=target_img,
+                             mode='absolute-paths')
+        self.assert_qmp(result, 'return', {})
+        self.complete_and_wait()
+        self.assert_no_active_block_jobs()
+
+    def test_absolute_paths_top(self):
+        self.assert_no_active_block_jobs()
+        result = self.vm.qmp('drive-mirror', device='drive0',
+                             sync='top', target=target_img,
+                             mode='absolute-paths')
+        self.assert_qmp(result, 'return', {})
+        self.complete_and_wait()
         self.assert_no_active_block_jobs()
 
-        for sync_mode in ['full', 'top', 'none']:
-            result = self.vm.qmp('drive-mirror', device='drive0',
-                                 sync=sync_mode, target=target_img,
-                                 mode='absolute-paths')
-            self.assert_qmp(result, 'return', {})
-            self.complete_and_wait()
-            self.assert_no_active_block_jobs()
+    def test_absolute_paths_none(self):
+        self.assert_no_active_block_jobs()
+        result = self.vm.qmp('drive-mirror', device='drive0',
+                             sync='none', target=target_img,
+                             mode='absolute-paths')
+        self.assert_qmp(result, 'return', {})
+        self.complete_and_wait()
+        self.assert_no_active_block_jobs()
 
 if __name__ == '__main__':
     iotests.main(supported_fmts=['qcow2', 'qed'])
diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out
index 4fd1c2d..6d9bee1 100644
--- a/tests/qemu-iotests/041.out
+++ b/tests/qemu-iotests/041.out
@@ -1,5 +1,5 @@
-.........................
+...........................
 ----------------------------------------------------------------------
-Ran 25 tests
+Ran 27 tests
 
 OK
commit 117e0c82881f05d88902d4059a3171bc6cd02df0
Author: Max Reitz <mreitz at redhat.com>
Date:   Mon Nov 25 20:28:55 2013 +0100

    block/drive-mirror: Reuse backing HD for sync=none
    
    For "none" sync mode in "absolute-paths" mode, the current image should
    be used as the backing file for the newly created image.
    
    The current behavior is:
    a) If the image to be mirrored has a backing file, use that (which is
       wrong, since the operations recorded by "none" are applied to the
       image itself, not to its backing file).
    b) If the image to be mirrored lacks a backing file, the target doesn't
       have one either (which is not really wrong, but not really right,
       either; "none" records a set of operations executed on the image
       file, therefore having no backing file to apply these operations on
       seems rather pointless).
    
    For a, this is clearly a bugfix. For b, it is still a bugfix, although
    it might break existing API - but since that case crashed qemu just
    three weeks ago (before 1452686495922b81d6cf43edf025c1aef15965c0), we
    can safely assume there is no such API relying on that case yet.
    
    Suggested-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Message-id: 1385407736-13941-2-git-send-email-mreitz at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/blockdev.c b/blockdev.c
index 330aa4a..44755e1 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -2021,6 +2021,9 @@ void qmp_drive_mirror(const char *device, const char *target,
     if (!source && sync == MIRROR_SYNC_MODE_TOP) {
         sync = MIRROR_SYNC_MODE_FULL;
     }
+    if (sync == MIRROR_SYNC_MODE_NONE) {
+        source = bs;
+    }
 
     size = bdrv_getlength(bs);
     if (size < 0) {
commit 7457fe9541b5162f285454947448d553a5d5a531
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Mon Nov 25 20:37:12 2013 -0800

    Update version for v1.7.0-rc2 release

diff --git a/VERSION b/VERSION
index 56b4609..b9e17f3 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.6.91
+1.6.92
commit 032ac6f8bfb68746cb0eea407b1cd2b22a78898f
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Fri Nov 22 15:35:03 2013 +0100

    curses: fixup SIGWINCH handler mess
    
    Don't run code in the signal handler, only set a flag.
    Use sigaction(2) to avoid non-portable signal(2) semantics.
    Make #ifdefs less messy.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Laszlo Ersek <lersek at redhat.com>
    Message-id: 1385130903-20531-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/ui/curses.c b/ui/curses.c
index 289a955..dbc3d5e 100644
--- a/ui/curses.c
+++ b/ui/curses.c
@@ -106,9 +106,9 @@ static void curses_resize(DisplayChangeListener *dcl,
     curses_calc_pad();
 }
 
-#ifndef _WIN32
-#if defined(SIGWINCH) && defined(KEY_RESIZE)
-static void curses_winch_handler(int signum)
+#if !defined(_WIN32) && defined(SIGWINCH) && defined(KEY_RESIZE)
+static volatile sig_atomic_t got_sigwinch;
+static void curses_winch_check(void)
 {
     struct winsize {
         unsigned short ws_row;
@@ -117,18 +117,34 @@ static void curses_winch_handler(int signum)
         unsigned short ws_ypixel;   /* unused */
     } ws;
 
-    /* terminal size changed */
-    if (ioctl(1, TIOCGWINSZ, &ws) == -1)
+    if (!got_sigwinch) {
+        return;
+    }
+    got_sigwinch = false;
+
+    if (ioctl(1, TIOCGWINSZ, &ws) == -1) {
         return;
+    }
 
     resize_term(ws.ws_row, ws.ws_col);
-    curses_calc_pad();
     invalidate = 1;
+}
 
-    /* some systems require this */
-    signal(SIGWINCH, curses_winch_handler);
+static void curses_winch_handler(int signum)
+{
+    got_sigwinch = true;
 }
-#endif
+
+static void curses_winch_init(void)
+{
+    struct sigaction old, winch = {
+        .sa_handler  = curses_winch_handler,
+    };
+    sigaction(SIGWINCH, &winch, &old);
+}
+#else
+static void curses_winch_check(void) {}
+static void curses_winch_init(void) {}
 #endif
 
 static void curses_cursor_position(DisplayChangeListener *dcl,
@@ -163,6 +179,8 @@ static void curses_refresh(DisplayChangeListener *dcl)
 {
     int chr, nextchr, keysym, keycode, keycode_alt;
 
+    curses_winch_check();
+
     if (invalidate) {
         clear();
         refresh();
@@ -349,13 +367,7 @@ void curses_display_init(DisplayState *ds, int full_screen)
     curses_keyboard_setup();
     atexit(curses_atexit);
 
-#ifndef _WIN32
-#if defined(SIGWINCH) && defined(KEY_RESIZE)
-    /* some curses implementations provide a handler, but we
-     * want to be sure this is handled regardless of the library */
-    signal(SIGWINCH, curses_winch_handler);
-#endif
-#endif
+    curses_winch_init();
 
     dcl = (DisplayChangeListener *) g_malloc0(sizeof(DisplayChangeListener));
     dcl->ops = &dcl_ops;
commit 16f4e8fa737b58b7b0461b33581e43ac06991110
Author: Stefan Weil <sw at weilnetz.de>
Date:   Mon Nov 25 20:54:17 2013 +0100

    qga: Fix two format strings for MinGW
    
    Both code locations cause a compiler warning. Using "%s" instead of "%lu"
    would result in a program crash if the wrong code were executed.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Message-id: 1385409257-2522-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index 7a37f5c..a6a0af2 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -110,7 +110,7 @@ void qmp_guest_shutdown(bool has_mode, const char *mode, Error **err)
     }
 
     if (!ExitWindowsEx(shutdown_flag, SHTDN_REASON_FLAG_PLANNED)) {
-        slog("guest-shutdown failed: %d", GetLastError());
+        slog("guest-shutdown failed: %lu", GetLastError());
         error_set(err, QERR_UNDEFINED_ERROR);
     }
 }
@@ -301,7 +301,7 @@ static DWORD WINAPI do_suspend(LPVOID opaque)
     DWORD ret = 0;
 
     if (!SetSuspendState(*mode == GUEST_SUSPEND_MODE_DISK, TRUE, TRUE)) {
-        slog("failed to suspend guest, %s", GetLastError());
+        slog("failed to suspend guest, %lu", GetLastError());
         ret = -1;
     }
     g_free(mode);
commit 84dc96e1e51c74ebf40b6c5e0c383769402e1a2d
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Nov 25 22:46:55 2013 +0100

    PPC: BookE: Make FIT/WDT timers at best millisecond grained
    
    The default granularity for the FIT timer on 440 is on every 0x1000th
    transition of TB from 0 to 1. Translated that means 48828 times a second.
    
    Since interrupts are quite expensive for 440 and we don't really care
    about the accuracy of the FIT to that significance, let's force FIT and
    WDT to at best millisecond granularity.
    
    This basically restores behavior as it was in QEMU 1.6, where timers
    could only deal with millisecond granularities at all.
    
    This patch greatly improves performance with the 440 target and restores
    roughly the same performance level that QEMU 1.6 had for me.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Message-id: 1385416015-22775-3-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index 56c4196..b421620 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -174,6 +174,12 @@ static void booke_update_fixed_timer(CPUPPCState         *env,
 
     if (*next == now) {
         (*next)++;
+    } else {
+        /*
+         * There's no point to fake any granularity that's more fine grained
+         * than milliseconds. Anything beyond that just overloads the system.
+         */
+        *next = MAX(*next, now + SCALE_MS);
     }
 
     /* Fire the next timer */
commit 455df3f32341a3dff00f1726ff0749b3dd783bdf
Author: Alexander Graf <agraf at suse.de>
Date:   Mon Nov 25 22:46:54 2013 +0100

    PPC: Make BookE FIT/WDT timers more lazy
    
    Today we fire FIT and WDT timer events every time the respective bit
    position in TB flips from 0 -> 1.
    
    However, there is no need to do this if the end result would be that
    we're changing a TSR bit that is set to 1 to 1 again. No guest visible
    change would have occured.
    
    So whenever we see that the TSR bit to our timer is already set, don't
    even bother to update the timer that would potentially fire it off.
    
    However, we do need to make sure that we update our timer that notifies
    us of the TB flip when the respective TSR bit gets unset. In that case
    we do care about the flip and need to notify the guest again. So add
    a callback into our timer handlers when TSR bits get unset.
    
    This improves performance for me when the guest is busy processing things.
    
    Signed-off-by: Alexander Graf <agraf at suse.de>
    Message-id: 1385416015-22775-2-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index 8bbfc72..56c4196 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -128,7 +128,8 @@ static uint8_t booke_get_wdt_target(CPUPPCState *env, ppc_tb_t *tb_env)
 static void booke_update_fixed_timer(CPUPPCState         *env,
                                      uint8_t           target_bit,
                                      uint64_t          *next,
-                                     struct QEMUTimer *timer)
+                                     QEMUTimer         *timer,
+                                     int               tsr_bit)
 {
     ppc_tb_t *tb_env = env->tb_env;
     uint64_t delta_tick, ticks = 0;
@@ -136,6 +137,14 @@ static void booke_update_fixed_timer(CPUPPCState         *env,
     uint64_t period;
     uint64_t now;
 
+    if (!(env->spr[SPR_BOOKE_TSR] & tsr_bit)) {
+        /*
+         * Don't arm the timer again when the guest has the current
+         * interrupt still pending. Wait for it to ack it.
+         */
+        return;
+    }
+
     now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     tb  = cpu_ppc_get_tb(tb_env, now, tb_env->tb_offset);
     period = 1ULL << target_bit;
@@ -167,6 +176,7 @@ static void booke_update_fixed_timer(CPUPPCState         *env,
         (*next)++;
     }
 
+    /* Fire the next timer */
     timer_mod(timer, *next);
 }
 
@@ -200,7 +210,8 @@ static void booke_fit_cb(void *opaque)
     booke_update_fixed_timer(env,
                              booke_get_fit_target(env, tb_env),
                              &booke_timer->fit_next,
-                             booke_timer->fit_timer);
+                             booke_timer->fit_timer,
+                             TSR_FIS);
 }
 
 static void booke_wdt_cb(void *opaque)
@@ -220,15 +231,35 @@ static void booke_wdt_cb(void *opaque)
     booke_update_fixed_timer(env,
                              booke_get_wdt_target(env, tb_env),
                              &booke_timer->wdt_next,
-                             booke_timer->wdt_timer);
+                             booke_timer->wdt_timer,
+                             TSR_WIS);
 }
 
 void store_booke_tsr(CPUPPCState *env, target_ulong val)
 {
     PowerPCCPU *cpu = ppc_env_get_cpu(env);
+    ppc_tb_t *tb_env = env->tb_env;
+    booke_timer_t *booke_timer = tb_env->opaque;
 
     env->spr[SPR_BOOKE_TSR] &= ~val;
     kvmppc_clear_tsr_bits(cpu, val);
+
+    if (val & TSR_FIS) {
+        booke_update_fixed_timer(env,
+                                 booke_get_fit_target(env, tb_env),
+                                 &booke_timer->fit_next,
+                                 booke_timer->fit_timer,
+                                 TSR_FIS);
+    }
+
+    if (val & TSR_WIS) {
+        booke_update_fixed_timer(env,
+                                 booke_get_wdt_target(env, tb_env),
+                                 &booke_timer->wdt_next,
+                                 booke_timer->wdt_timer,
+                                 TSR_WIS);
+    }
+
     booke_update_irq(cpu);
 }
 
@@ -247,12 +278,14 @@ void store_booke_tcr(CPUPPCState *env, target_ulong val)
     booke_update_fixed_timer(env,
                              booke_get_fit_target(env, tb_env),
                              &booke_timer->fit_next,
-                             booke_timer->fit_timer);
+                             booke_timer->fit_timer,
+                             TSR_FIS);
 
     booke_update_fixed_timer(env,
                              booke_get_wdt_target(env, tb_env),
                              &booke_timer->wdt_next,
-                             booke_timer->wdt_timer);
+                             booke_timer->wdt_timer,
+                             TSR_WIS);
 }
 
 static void ppc_booke_timer_reset_handle(void *opaque)
commit 134d42d614768b2803e551621f6654dab1fdc2d2
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Tue Nov 26 00:00:39 2013 +0200

    acpi-build: fix support for glib < 2.22
    
    glib < 2.22 does not have g_array_get_element_size,
    limit it's use (to check all elements are 1 byte
    in size) to newer glib.
    
    This fixes build on RHEL 5.3.
    
    Reported-by: Richard Henderson <rth at redhat.com>
    Reported-by: Erik Rull <erik.rull at rdsoftware.de>
    Tested-by: Richard Henderson <rth at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Message-id: 20131125220039.GA16386 at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 5f36e7e..1f22fb6 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -425,7 +425,7 @@ static inline void *acpi_data_push(GArray *table_data, unsigned size)
 
 static unsigned acpi_data_len(GArray *table)
 {
-#if GLIB_CHECK_VERSION(2, 14, 0)
+#if GLIB_CHECK_VERSION(2, 22, 0)
     assert(g_array_get_element_size(table) == 1);
 #endif
     return table->len;
@@ -436,9 +436,7 @@ static void acpi_align_size(GArray *blob, unsigned align)
     /* Align size to multiple of given size. This reduces the chance
      * we need to change size in the future (breaking cross version migration).
      */
-    g_array_set_size(blob, (ROUND_UP(acpi_data_len(blob), align) +
-                            g_array_get_element_size(blob) - 1) /
-                             g_array_get_element_size(blob));
+    g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
 }
 
 /* Get pointer within table in a safe manner */
commit c0caec178eadbbac4c672110c3914313091e0588
Merge: d916ada e007dbe
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Mon Nov 25 09:49:42 2013 -0800

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pc very last minute fixes for 1.7
    
    This has a fix for a crasher bug with pci bridges,
    boot failure fix for s390 on 32 bit hosts,
    and fixes build for hosts with old glib.
    
    There's also a fix for --iasl configure flag - it can be used
    to work around broken iasl on some systems either
    by using a non-standard iasl or by disabling it.
    
    I've also reverted a e1000/rtl mac programming change
    that seems slightly wrong and too risky for 1.8.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Mon 25 Nov 2013 03:40:07 AM PST using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By Michael S. Tsirkin (5) and Bandan Das (1)
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      configure: make --iasl option actually work
      Revert "e1000/rtl8139: update HMP NIC when every bit is written"
      acpi-build: fix build on glib < 2.14
      acpi-build: fix build on glib < 2.22
      pci: unregister vmstate_pcibus on unplug
      s390x: fix flat file load on 32 bit systems
    
    Message-id: 1385379990-32093-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit d916adaa606dd1b871316acb295d5979361133b7
Merge: 833637d d607a52
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Mon Nov 25 09:41:24 2013 -0800

    Merge remote-tracking branch 'bonzini/tags/for-anthony' into staging
    
    Here are a bunch of 1.7-tagged patches that I was afraid
    were getting forgotten or that did not have a clear maintainer responsible
    for making a pull request.
    
    # gpg: Signature made Thu 21 Nov 2013 08:40:59 AM PST using RSA key ID 9B4D86F2
    # gpg: Can't check signature: public key not found
    
    # By Peter Maydell (3) and others
    # Via Paolo Bonzini
    * bonzini/tags/for-anthony:
      qga: Fix compiler warnings (missing format attribute, wrong format strings)
      mips jazz: do not raise data bus exception when accessing invalid addresses
      target-i386: yield to another VCPU on PAUSE
      rng-egd: offset the point when repeatedly read from the buffer
      rng-egd: remove redundant free
      target-i386: Fix build by providing stub kvm_arch_get_supported_cpuid()
      vfio-pci: Fix multifunction=on
      atomic.h: Fix build with clang
      pc: get rid of builtin pvpanic for "-M pc-1.5"
      configure: Explicitly set ARFLAGS so we can build with GNU Make 4.0
      sun4m: Add FCode ROM for TCX framebuffer
    
    Message-id: 1385052578-32352-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 833637d46dd5a0859abdff085352ae7d48dc8189
Merge: 0ff1e1d bca4bf1
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Mon Nov 25 09:37:44 2013 -0800

    Merge remote-tracking branch 'mdroth/qga-pull-2013-11-22' into staging
    
    # By Tomoki Sekiyama
    # Via Michael Roth
    * mdroth/qga-pull-2013-11-22:
      qemu-ga: vss-win32: Install VSS provider COM+ application service
    
    Message-id: 1385154505-15145-1-git-send-email-mdroth at linux.vnet.ibm.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 0ff1e1dac4b6bccefc4b8a861ec2a643ecfb6e9d
Merge: 607bb02 30c367e
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Mon Nov 25 09:37:27 2013 -0800

    Merge remote-tracking branch 'stefanha/net' into staging
    
    # By Vlad Yasevich
    # Via Stefan Hajnoczi
    * stefanha/net:
      qdev-properties-system.c: Allow vlan or netdev for -device, not both
    
    Message-id: 1385118544-28482-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit e007dbece5fc4e55e10116c6cb42753e35a945bf
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Nov 24 11:38:05 2013 +0200

    configure: make --iasl option actually work
    
    --iasl option was added to CC option parsing section by mistake,
    it's not effective there and attempts to use cause
    an 'unknown option' error.
    
    Fix this up.
    
    Tested-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/configure b/configure
index 508f6a5..9b9b9fa 100755
--- a/configure
+++ b/configure
@@ -272,8 +272,6 @@ for opt do
   ;;
   --cxx=*) CXX="$optarg"
   ;;
-  --iasl=*) iasl="$optarg"
-  ;;
   --source-path=*) source_path="$optarg"
   ;;
   --cpu=*) cpu="$optarg"
@@ -649,6 +647,8 @@ for opt do
   ;;
   --cxx=*)
   ;;
+  --iasl=*) iasl="$optarg"
+  ;;
   --objcc=*) objcc="$optarg"
   ;;
   --make=*) make="$optarg"
commit bca4bf1028b332f55502bc7f50345fa5ea1c4f40
Author: Tomoki Sekiyama <tomoki.sekiyama at hds.com>
Date:   Fri Nov 1 17:47:25 2013 -0400

    qemu-ga: vss-win32: Install VSS provider COM+ application service
    
    Currently, qemu-ga for Windows fails to execute guset-fsfreeze-freeze when
    no user is logging in to Windows, with an error message:
      {"error":{"class":"GenericError",
                "desc":"failed to add C:\\ to snapshotset:  (error: 8004230f)"}}
    
    To enable guest-fsfreeze-freeze/thaw without logging in users, this installs
    a service to execute qemu-ga VSS provider COM+ application that has full
    access privileges to the local system. The service will automatically be
    removed when the COM+ application is deregistered.
    
    This patch replaces ICOMAdminCatalog interface with ICOMAdminCatalog2
    interface that contains CreateServiceForApplication() method in addition.
    
    Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama at hds.com>
    Reviewed-by: Gal Hammer <ghammer at redhat.com>
    Reviewed-by: Yan Vugenfirer <yvugenfi at redhat.com>
    Tested-by: Yan Vugenfirer <yvugenfi at redhat.com>
    Signed-off-by: Michael Roth <mdroth at linux.vnet.ibm.com>

diff --git a/qga/vss-win32/install.cpp b/qga/vss-win32/install.cpp
index 37731a7..b791a6c 100644
--- a/qga/vss-win32/install.cpp
+++ b/qga/vss-win32/install.cpp
@@ -25,8 +25,8 @@ extern HINSTANCE g_hinstDll;
 
 const GUID CLSID_COMAdminCatalog = { 0xF618C514, 0xDFB8, 0x11d1,
     {0xA2, 0xCF, 0x00, 0x80, 0x5F, 0xC7, 0x92, 0x35} };
-const GUID IID_ICOMAdminCatalog = { 0xDD662187, 0xDFC2, 0x11d1,
-    {0xA2, 0xCF, 0x00, 0x80, 0x5F, 0xC7, 0x92, 0x35} };
+const GUID IID_ICOMAdminCatalog2 = { 0x790C6E0B, 0x9194, 0x4cc9,
+    {0x94, 0x26, 0xA4, 0x8A, 0x63, 0x18, 0x56, 0x96} };
 const GUID CLSID_WbemLocator = { 0x4590f811, 0x1d3a, 0x11d0,
     {0x89, 0x1f, 0x00, 0xaa, 0x00, 0x4b, 0x2e, 0x24} };
 const GUID IID_IWbemLocator = { 0xdc12a687, 0x737f, 0x11cf,
@@ -141,7 +141,7 @@ static HRESULT QGAProviderFind(
     HRESULT hr;
     COMInitializer initializer;
     COMPointer<IUnknown> pUnknown;
-    COMPointer<ICOMAdminCatalog> pCatalog;
+    COMPointer<ICOMAdminCatalog2> pCatalog;
     COMPointer<ICatalogCollection> pColl;
     COMPointer<ICatalogObject> pObj;
     _variant_t var;
@@ -149,7 +149,7 @@ static HRESULT QGAProviderFind(
 
     chk(CoCreateInstance(CLSID_COMAdminCatalog, NULL, CLSCTX_INPROC_SERVER,
                          IID_IUnknown, (void **)pUnknown.replace()));
-    chk(pUnknown->QueryInterface(IID_ICOMAdminCatalog,
+    chk(pUnknown->QueryInterface(IID_ICOMAdminCatalog2,
                                  (void **)pCatalog.replace()));
     chk(pCatalog->GetCollection(_bstr_t(L"Applications"),
                                 (IDispatch **)pColl.replace()));
@@ -206,7 +206,7 @@ STDAPI COMRegister(void)
     HRESULT hr;
     COMInitializer initializer;
     COMPointer<IUnknown> pUnknown;
-    COMPointer<ICOMAdminCatalog> pCatalog;
+    COMPointer<ICOMAdminCatalog2> pCatalog;
     COMPointer<ICatalogCollection> pApps, pRoles, pUsersInRole;
     COMPointer<ICatalogObject> pObj;
     long n;
@@ -229,7 +229,7 @@ STDAPI COMRegister(void)
 
     chk(CoCreateInstance(CLSID_COMAdminCatalog, NULL, CLSCTX_INPROC_SERVER,
                          IID_IUnknown, (void **)pUnknown.replace()));
-    chk(pUnknown->QueryInterface(IID_ICOMAdminCatalog,
+    chk(pUnknown->QueryInterface(IID_ICOMAdminCatalog2,
                                  (void **)pCatalog.replace()));
 
     /* Install COM+ Component */
@@ -273,6 +273,10 @@ STDAPI COMRegister(void)
         goto out;
     }
 
+    chk(pCatalog->CreateServiceForApplication(
+            _bstr_t(QGA_PROVIDER_LNAME), _bstr_t(QGA_PROVIDER_LNAME),
+            _bstr_t(L"SERVICE_AUTO_START"), _bstr_t(L"SERVICE_ERROR_NORMAL"),
+            _bstr_t(L""), _bstr_t(L".\\localsystem"), _bstr_t(L""), FALSE));
     chk(pCatalog->InstallComponent(_bstr_t(QGA_PROVIDER_LNAME),
                                    _bstr_t(dllPath), _bstr_t(tlbPath),
                                    _bstr_t("")));
commit 30c367ed446b6ea53245589a5cf373578ac075d7
Author: Vlad Yasevich <vyasevic at redhat.com>
Date:   Thu Nov 7 21:13:09 2013 -0500

    qdev-properties-system.c: Allow vlan or netdev for -device, not both
    
    It is currently possible to specify things like:
    	-device e1000,netdev=foo,vlan=1
    With this usage, whichever argument was specified last (vlan or netdev)
    overwrites what was previousely set and results in a non-working
    configuration.  Even worse, when used with multiqueue devices,
    it causes a segmentation fault on exit in qemu_free_net_client.
    
    That patch treates the above command line options as invalid and
    generates an error at start-up.
    
    Signed-off-by: Vlad Yasevich <vyasevic at redhat.com>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 0eada32..729efa8 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -205,6 +205,11 @@ static int parse_netdev(DeviceState *dev, const char *str, void **ptr)
             goto err;
         }
 
+        if (ncs[i]) {
+            ret = -EINVAL;
+            goto err;
+        }
+
         ncs[i] = peers[i];
         ncs[i]->queue_index = i;
     }
@@ -301,6 +306,10 @@ static void set_vlan(Object *obj, Visitor *v, void *opaque,
         *ptr = NULL;
         return;
     }
+    if (*ptr) {
+        error_set_from_qdev_prop_error(errp, -EINVAL, dev, prop, name);
+        return;
+    }
 
     hubport = net_hub_port_find(id);
     if (!hubport) {
commit d607a52364e7bfc1cd6d3e425b898e86be4e525d
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Nov 17 19:19:52 2013 +0100

    qga: Fix compiler warnings (missing format attribute, wrong format strings)
    
    gcc 4.8.2 reports this warning when extra warnings are enabled (-Wextra):
    
      CC    qga/commands.o
    qga/commands.c: In function ‘slog’:
    qga/commands.c:28:5: error:
     function might be possible candidate for ‘gnu_printf’ format attribute [-Werror=suggest-attribute=format]
         g_logv("syslog", G_LOG_LEVEL_INFO, fmt, ap);
         ^
    
    gcc 4.8.2 reports this warning when slog is declared with the
    gnu_printf format attribute:
    
    qga/commands-posix.c: In function ‘qmp_guest_file_open’:
    qga/commands-posix.c:404:5: warning:
     format ‘%d’ expects argument of type ‘int’, but argument 2 has type ‘int64_t’ [-Wformat=]
         slog("guest-file-open, handle: %d", handle);
         ^
    
    On 32 bit hosts there are three more warnings which are also fixed here.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 10682f5..8100bee 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -401,7 +401,7 @@ int64_t qmp_guest_file_open(const char *path, bool has_mode, const char *mode, E
         return -1;
     }
 
-    slog("guest-file-open, handle: %d", handle);
+    slog("guest-file-open, handle: %" PRId64, handle);
     return handle;
 }
 
@@ -410,7 +410,7 @@ void qmp_guest_file_close(int64_t handle, Error **err)
     GuestFileHandle *gfh = guest_file_handle_find(handle, err);
     int ret;
 
-    slog("guest-file-close called, handle: %ld", handle);
+    slog("guest-file-close called, handle: %" PRId64, handle);
     if (!gfh) {
         return;
     }
@@ -451,7 +451,7 @@ struct GuestFileRead *qmp_guest_file_read(int64_t handle, bool has_count,
     read_count = fread(buf, 1, count, fh);
     if (ferror(fh)) {
         error_setg_errno(err, errno, "failed to read file");
-        slog("guest-file-read failed, handle: %ld", handle);
+        slog("guest-file-read failed, handle: %" PRId64, handle);
     } else {
         buf[read_count] = 0;
         read_data = g_malloc0(sizeof(GuestFileRead));
@@ -496,7 +496,7 @@ GuestFileWrite *qmp_guest_file_write(int64_t handle, const char *buf_b64,
     write_count = fwrite(buf, 1, count, fh);
     if (ferror(fh)) {
         error_setg_errno(err, errno, "failed to write to file");
-        slog("guest-file-write failed, handle: %ld", handle);
+        slog("guest-file-write failed, handle: %" PRId64, handle);
     } else {
         write_data = g_malloc0(sizeof(GuestFileWrite));
         write_data->count = write_count;
diff --git a/qga/guest-agent-core.h b/qga/guest-agent-core.h
index 624a559..e422208 100644
--- a/qga/guest-agent-core.h
+++ b/qga/guest-agent-core.h
@@ -29,7 +29,7 @@ GACommandState *ga_command_state_new(void);
 bool ga_logging_enabled(GAState *s);
 void ga_disable_logging(GAState *s);
 void ga_enable_logging(GAState *s);
-void slog(const gchar *fmt, ...);
+void GCC_FMT_ATTR(1, 2) slog(const gchar *fmt, ...);
 void ga_set_response_delimited(GAState *s);
 bool ga_is_frozen(GAState *s);
 void ga_set_frozen(GAState *s);
commit b6a06e72ef5e66e539012f63fca52c161c0d2496
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Mon Nov 4 23:26:17 2013 +0100

    mips jazz: do not raise data bus exception when accessing invalid addresses
    
    MIPS Jazz chipset doesn't seem to raise data bus exceptions on invalid accesses.
    However, there is no easy way to prevent them. Creating a big memory region
    for the whole address space doesn't prevent memory core to directly call
    unassigned_mem_read/write which in turn call cpu->do_unassigned_access,
    which (for MIPS CPU) raise an data bus exception.
    
    This fixes a MIPS Jazz regression introduced in c658b94f6e8c206c59d02aa6fbac285b86b53d2c.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 49bdd02..5f6dd9f 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -108,6 +108,18 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     }
 }
 
+static CPUUnassignedAccess real_do_unassigned_access;
+static void mips_jazz_do_unassigned_access(CPUState *cpu, hwaddr addr,
+                                           bool is_write, bool is_exec,
+                                           int opaque, unsigned size)
+{
+    if (!is_exec) {
+        /* ignore invalid access (ie do not raise exception) */
+        return;
+    }
+    (*real_do_unassigned_access)(cpu, addr, is_write, is_exec, opaque, size);
+}
+
 static void mips_jazz_init(MemoryRegion *address_space,
                            MemoryRegion *address_space_io,
                            ram_addr_t ram_size,
@@ -117,6 +129,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
     char *filename;
     int bios_size, n;
     MIPSCPU *cpu;
+    CPUClass *cc;
     CPUMIPSState *env;
     qemu_irq *rc4030, *i8259;
     rc4030_dma *dmas;
@@ -154,6 +167,17 @@ static void mips_jazz_init(MemoryRegion *address_space,
     env = &cpu->env;
     qemu_register_reset(main_cpu_reset, cpu);
 
+    /* Chipset returns 0 in invalid reads and do not raise data exceptions.
+     * However, we can't simply add a global memory region to catch
+     * everything, as memory core directly call unassigned_mem_read/write
+     * on some invalid accesses, which call do_unassigned_access on the
+     * CPU, which raise an exception.
+     * Handle that case by hijacking the do_unassigned_access method on
+     * the CPU, and do not raise exceptions for data access. */
+    cc = CPU_GET_CLASS(cpu);
+    real_do_unassigned_access = cc->do_unassigned_access;
+    cc->do_unassigned_access = mips_jazz_do_unassigned_access;
+
     /* allocate RAM */
     memory_region_init_ram(ram, NULL, "mips_jazz.ram", ram_size);
     vmstate_register_ram_global(ram);
commit b5fc314bcbb80f76b8deaf23a4c45767b87f750b
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Nov 20 12:54:02 2013 +0100

    target-i386: yield to another VCPU on PAUSE
    
    After commit b1bbfe7 (aio / timers: On timer modification, qemu_notify
    or aio_notify, 2013-08-21) FreeBSD guests report a huge slowdown.
    
    The problem shows up as soon as FreeBSD turns out its periodic (~1 ms)
    tick, but the timers are only the trigger for a pre-existing problem.
    
    Before the offending patch, setting a timer did a timer_settime system call.
    
    After, setting the timer exits the event loop (which uses poll) and
    reenters it with a new deadline.  This does not cause any slowdown; the
    difference is between one system call (timer_settime and a signal
    delivery (SIGALRM) before the patch, and two system calls afterwards
    (write to a pipe or eventfd + calling poll again when re-entering the
    event loop).
    
    Unfortunately, the exit/enter causes the main loop to grab the iothread
    lock, which in turns kicks the VCPU thread out of execution.  This
    causes TCG to execute the next VCPU in its round-robin scheduling of
    VCPUS.  When the second VCPU is mostly unused, FreeBSD runs a "pause"
    instruction in its idle loop which only burns cycles without any
    progress.  As soon as the timer tick expires, the first VCPU runs
    the interrupt handler but very soon it sets it again---and QEMU
    then goes back doing nothing in the second VCPU.
    
    The fix is to make the pause instruction do "cpu_loop_exit".
    
    Reported-by: Luigi Rizzo <rizzo at iet.unipi.it>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/target-i386/helper.h b/target-i386/helper.h
index d6974df..3775abe 100644
--- a/target-i386/helper.h
+++ b/target-i386/helper.h
@@ -58,6 +58,7 @@ DEF_HELPER_2(sysret, void, env, int)
 DEF_HELPER_2(hlt, void, env, int)
 DEF_HELPER_2(monitor, void, env, tl)
 DEF_HELPER_2(mwait, void, env, int)
+DEF_HELPER_2(pause, void, env, int)
 DEF_HELPER_1(debug, void, env)
 DEF_HELPER_1(reset_rf, void, env)
 DEF_HELPER_3(raise_interrupt, void, env, int, int)
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index 93933fd..b6307ca 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -566,6 +566,15 @@ void helper_rdmsr(CPUX86State *env)
 }
 #endif
 
+static void do_pause(X86CPU *cpu)
+{
+    CPUX86State *env = &cpu->env;
+
+    /* Just let another CPU run.  */
+    env->exception_index = EXCP_INTERRUPT;
+    cpu_loop_exit(env);
+}
+
 static void do_hlt(X86CPU *cpu)
 {
     CPUState *cs = CPU(cpu);
@@ -611,13 +620,22 @@ void helper_mwait(CPUX86State *env, int next_eip_addend)
     cs = CPU(cpu);
     /* XXX: not complete but not completely erroneous */
     if (cs->cpu_index != 0 || CPU_NEXT(cs) != NULL) {
-        /* more than one CPU: do not sleep because another CPU may
-           wake this one */
+        do_pause(cpu);
     } else {
         do_hlt(cpu);
     }
 }
 
+void helper_pause(CPUX86State *env, int next_eip_addend)
+{
+    X86CPU *cpu = x86_env_get_cpu(env);
+
+    cpu_svm_check_intercept_param(env, SVM_EXIT_PAUSE, 0);
+    env->eip += next_eip_addend;
+
+    do_pause(cpu);
+}
+
 void helper_debug(CPUX86State *env)
 {
     env->exception_index = EXCP_DEBUG;
diff --git a/target-i386/translate.c b/target-i386/translate.c
index eb0ea93..ecf16b3 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -7224,7 +7224,10 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
             goto do_xchg_reg_eax;
         }
         if (prefixes & PREFIX_REPZ) {
-            gen_svm_check_intercept(s, pc_start, SVM_EXIT_PAUSE);
+            gen_update_cc_op(s);
+            gen_jmp_im(pc_start - s->cs_base);
+            gen_helper_pause(cpu_env, tcg_const_i32(s->pc - pc_start));
+            s->is_jmp = DISAS_TB_JUMP;
         }
         break;
     case 0x9b: /* fwait */
commit fbdcec5c487685b46e78f1e40a236ebf83f862fa
Author: Amos Kong <akong at redhat.com>
Date:   Thu Nov 21 16:42:51 2013 +0800

    rng-egd: offset the point when repeatedly read from the buffer
    
    The buffer content might be read out more than once, currently
    we just repeatedly read the first data block, buffer offset is
    missing.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 6f56f9e..25bb3b4 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -91,12 +91,14 @@ static int rng_egd_chr_can_read(void *opaque)
 static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
 {
     RngEgd *s = RNG_EGD(opaque);
+    size_t buf_offset = 0;
 
     while (size > 0 && s->requests) {
         RngRequest *req = s->requests->data;
         int len = MIN(size, req->size - req->offset);
 
-        memcpy(req->data + req->offset, buf, len);
+        memcpy(req->data + req->offset, buf + buf_offset, len);
+        buf_offset += len;
         req->offset += len;
         size -= len;
 
commit 60aad298cb6de52f2716b2e82e1353ea9de95fd6
Author: Amos Kong <akong at redhat.com>
Date:   Thu Nov 21 16:42:50 2013 +0800

    rng-egd: remove redundant free
    
    We didn't set default chr_name, the free is redundant.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 9e5a536..6f56f9e 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -167,7 +167,6 @@ static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
     if (b->opened) {
         error_set(errp, QERR_PERMISSION_DENIED);
     } else {
-        g_free(s->chr_name);
         s->chr_name = g_strdup(value);
     }
 }
commit 2140cfa51d59177815f5b82e94ac48fb24909aba
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Wed Nov 13 23:09:07 2013 +0000

    target-i386: Fix build by providing stub kvm_arch_get_supported_cpuid()
    
    Fix build failures with clang when KVM is not enabled by
    providing a stub version of kvm_arch_get_supported_cpuid().
    We retain the compile time check that this function isn't
    called when CONFIG_KVM is not set by guarding the stub with
    ifndef __OPTIMIZE__ (we assume that an optimizing build will
    do sufficient constant folding and dead code elimination to
    remove the calls before linking).
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/target-i386/kvm-stub.c b/target-i386/kvm-stub.c
index 11429c4..2b9e801 100644
--- a/target-i386/kvm-stub.c
+++ b/target-i386/kvm-stub.c
@@ -16,3 +16,15 @@ bool kvm_allows_irq0_override(void)
 {
     return 1;
 }
+
+#ifndef __OPTIMIZE__
+/* This function is only called inside conditionals which we
+ * rely on the compiler to optimize out when CONFIG_KVM is not
+ * defined.
+ */
+uint32_t kvm_arch_get_supported_cpuid(KVMState *env, uint32_t function,
+                                      uint32_t index, int reg)
+{
+    abort();
+}
+#endif
commit 8d07d6c46597a885eb38d99cc6fff399ce69cd21
Author: Alex Williamson <alex.williamson at redhat.com>
Date:   Tue Nov 12 11:53:24 2013 -0700

    vfio-pci: Fix multifunction=on
    
    When an assigned device is initialized it copies the device config
    space into the emulated config space.  Unfortunately multifunction is
    setup prior to the device initfn and gets clobbered.  We need to
    restore it just like pci-assign does.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index fe95e03..f7f8a19 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -3568,6 +3568,13 @@ static int vfio_initfn(PCIDevice *pdev)
     vdev->emulated_config_bits[PCI_HEADER_TYPE] =
                                               PCI_HEADER_TYPE_MULTI_FUNCTION;
 
+    /* Restore or clear multifunction, this is always controlled by QEMU */
+    if (vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        vdev->pdev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
+    } else {
+        vdev->pdev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
+    }
+
     /*
      * Clear host resource mapping info.  If we choose not to register a
      * BAR, such as might be the case with the option ROM, we can get
commit 392a4d5b9a1860aae82429d09321dac302d70396
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Oct 22 10:58:41 2013 +0100

    atomic.h: Fix build with clang
    
    clang defines __ATOMIC_SEQ_CST but its implementation of the
    __atomic_exchange() builtin differs from that of gcc. Move the
    __clang__ branch of the ifdef ladder to the top and fix its
    implementation (there is no such builtin as __sync_exchange),
    so we can compile with clang again.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index 0aa8913..492bce1 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -168,14 +168,14 @@
 #endif
 
 #ifndef atomic_xchg
-#ifdef __ATOMIC_SEQ_CST
+#if defined(__clang__)
+#define atomic_xchg(ptr, i)    __sync_swap(ptr, i)
+#elif defined(__ATOMIC_SEQ_CST)
 #define atomic_xchg(ptr, i)    ({                           \
     typeof(*ptr) _new = (i), _old;                          \
     __atomic_exchange(ptr, &_new, &_old, __ATOMIC_SEQ_CST); \
     _old;                                                   \
 })
-#elif defined __clang__
-#define atomic_xchg(ptr, i)    __sync_exchange(ptr, i)
 #else
 /* __sync_lock_test_and_set() is documented to be an acquire barrier only.  */
 #define atomic_xchg(ptr, i)    (smp_mb(), __sync_lock_test_and_set(ptr, i))
commit 7839ff593be03a7de3c6760e0b50c565ea751d36
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Nov 4 14:30:48 2013 +0100

    pc: get rid of builtin pvpanic for "-M pc-1.5"
    
    This causes two slight backwards-incompatibilities between "-M pc-1.5"
    and 1.5's "-M pc":
    
    (1) a fw_cfg file is removed with this patch.  This is only a problem
    if migration stops the virtual machine exactly during fw_cfg enumeration.
    
    (2) after migration, a VM created without an explicit "-device pvpanic"
    will stop reporting panics to management.
    
    The first problem only occurs if migration is done at a very, very
    early point (and I'm not sure it can happen in practice for reasonable-size
    VMs, since it will likely take more time to send the RAM to destination,
    than it will take for BIOS to scan fw_cfg).
    
    The second problem only occurs if the guest panics _and_ has a guest
    driver _and_ management knows to look at the crash event, so it is
    mostly theoretical at this point in time.
    
    Thus keep the code simple, and pretend it was never broken.
    
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 094c421..2111f01 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -57,7 +57,6 @@ static const int ide_iobase[MAX_IDE_BUS] = { 0x1f0, 0x170 };
 static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
 static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 
-static bool has_pvpanic;
 static bool has_pci_info;
 static bool has_acpi_build = true;
 
@@ -229,10 +228,6 @@ static void pc_init1(QEMUMachineInitArgs *args,
     if (pci_enabled) {
         pc_pci_device_init(pci_bus);
     }
-
-    if (has_pvpanic) {
-        pvpanic_init(isa_bus);
-    }
 }
 
 static void pc_init_pci(QEMUMachineInitArgs *args)
@@ -250,13 +245,11 @@ static void pc_compat_1_6(QEMUMachineInitArgs *args)
 static void pc_compat_1_5(QEMUMachineInitArgs *args)
 {
     pc_compat_1_6(args);
-    has_pvpanic = true;
 }
 
 static void pc_compat_1_4(QEMUMachineInitArgs *args)
 {
     pc_compat_1_5(args);
-    has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
     x86_cpu_compat_set_features("Westmere", FEAT_1_ECX, 0, CPUID_EXT_PCLMULQDQ);
 }
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 1af8e2b..600fc02 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -47,7 +47,6 @@
 /* ICH9 AHCI has 6 ports */
 #define MAX_SATA_PORTS     6
 
-static bool has_pvpanic;
 static bool has_pci_info;
 static bool has_acpi_build = true;
 
@@ -216,10 +215,6 @@ static void pc_q35_init(QEMUMachineInitArgs *args)
     if (pci_enabled) {
         pc_pci_device_init(host_bus);
     }
-
-    if (has_pvpanic) {
-        pvpanic_init(isa_bus);
-    }
 }
 
 static void pc_compat_1_6(QEMUMachineInitArgs *args)
@@ -232,13 +227,11 @@ static void pc_compat_1_6(QEMUMachineInitArgs *args)
 static void pc_compat_1_5(QEMUMachineInitArgs *args)
 {
     pc_compat_1_6(args);
-    has_pvpanic = true;
 }
 
 static void pc_compat_1_4(QEMUMachineInitArgs *args)
 {
     pc_compat_1_5(args);
-    has_pvpanic = false;
     x86_cpu_compat_set_features("n270", FEAT_1_ECX, 0, CPUID_EXT_MOVBE);
     x86_cpu_compat_set_features("Westmere", FEAT_1_ECX, 0, CPUID_EXT_PCLMULQDQ);
 }
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index 226e298..5377fee 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -112,11 +112,6 @@ static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
     isa_register_ioport(d, &s->io, s->ioport);
 }
 
-void pvpanic_init(ISABus *bus)
-{
-    isa_create_simple(bus, TYPE_ISA_PVPANIC_DEVICE);
-}
-
 #define PVPANIC_IOPORT_PROP "ioport"
 
 uint16_t pvpanic_port(void)
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 57e8d16..09652fb 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -235,7 +235,6 @@ void pc_system_firmware_init(MemoryRegion *rom_memory,
                              bool isapc_ram_fw);
 
 /* pvpanic.c */
-void pvpanic_init(ISABus *bus);
 uint16_t pvpanic_port(void);
 
 /* e820 types */
commit 45d285abd7028ac72418c1a22f9298bb898fbfb8
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Mon Oct 21 21:03:06 2013 +0100

    configure: Explicitly set ARFLAGS so we can build with GNU Make 4.0
    
    Our rules.mak adds '-rR' to MAKEFLAGS to indicate that we will be
    explicitly specifying everything and not relying on any default
    variables or rules. However we were accidentally relying on the
    default ARFLAGS ("rv"). This went unnoticed because of a bug in
    GNU Make 3.82 and earlier which meant that adding -rR to MAKEFLAGS
    only affected submakes, not the currently running instance.
    Explicitly set ARFLAGS in config-host.mak, in the same way we
    handle CFLAGS and LDFLAGS; this will allow us to work with
    Make 4.0.
    
    Thanks to Paul Smith for analyzing this bug for us.
    
    Cc: qemu-stable at nongnu.org
    Reported-by: Ken Moffat <zarniwhoop at ntlworld.com>
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/configure b/configure
index 508f6a5..ad12688 100755
--- a/configure
+++ b/configure
@@ -325,6 +325,9 @@ query_pkg_config() {
 pkg_config=query_pkg_config
 sdl_config="${SDL_CONFIG-${cross_prefix}sdl-config}"
 
+# If the user hasn't specified ARFLAGS, default to 'rv', just as make does.
+ARFLAGS="${ARFLAGS-rv}"
+
 # default flags for all hosts
 QEMU_CFLAGS="-fno-strict-aliasing $QEMU_CFLAGS"
 QEMU_CFLAGS="-Wall -Wundef -Wwrite-strings -Wmissing-prototypes $QEMU_CFLAGS"
@@ -3695,6 +3698,7 @@ echo "C compiler        $cc"
 echo "Host C compiler   $host_cc"
 echo "C++ compiler      $cxx"
 echo "Objective-C compiler $objcc"
+echo "ARFLAGS           $ARFLAGS"
 echo "CFLAGS            $CFLAGS"
 echo "QEMU_CFLAGS       $QEMU_CFLAGS"
 echo "LDFLAGS           $LDFLAGS"
@@ -4276,6 +4280,7 @@ echo "HOST_CC=$host_cc" >> $config_host_mak
 echo "CXX=$cxx" >> $config_host_mak
 echo "OBJCC=$objcc" >> $config_host_mak
 echo "AR=$ar" >> $config_host_mak
+echo "ARFLAGS=$ARFLAGS" >> $config_host_mak
 echo "AS=$as" >> $config_host_mak
 echo "CPP=$cpp" >> $config_host_mak
 echo "OBJCOPY=$objcopy" >> $config_host_mak
commit da87dd7bd70f71ceaf9ff40d7cdb8394a7dc4bf5
Author: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
Date:   Sat Nov 2 16:03:50 2013 +0000

    sun4m: Add FCode ROM for TCX framebuffer
    
    Upstream OpenBIOS now implements SBus probing in order to determine the
    contents of a physical bus slot, which is required to allow OpenBIOS to
    identify the framebuffer without help from the fw_cfg interface.
    
    SBus probing works by detecting the presence of an FCode program
    (effectively tokenised Forth) at the base address of each slot, and if
    present executes it so that it creates its own device node in the
    OpenBIOS device tree.
    
    The FCode ROM is generated as part of the OpenBIOS build and should
    generally be updated at the same time.
    
    Signed-off-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    CC: Blue Swirl <blauwirbel at gmail.com>
    CC: Bob Breuer <breuerr at mc.net>
    CC: Artyom Tarasenko <atar4qemu at gmail.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/Makefile b/Makefile
index 3321b98..bdff4e4 100644
--- a/Makefile
+++ b/Makefile
@@ -293,7 +293,7 @@ ifdef INSTALL_BLOBS
 BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
 vgabios-stdvga.bin vgabios-vmware.bin vgabios-qxl.bin \
 acpi-dsdt.aml q35-acpi-dsdt.aml \
-ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc \
+ppc_rom.bin openbios-sparc32 openbios-sparc64 openbios-ppc QEMU,tcx.bin \
 pxe-e1000.rom pxe-eepro100.rom pxe-ne2k_pci.rom \
 pxe-pcnet.rom pxe-rtl8139.rom pxe-virtio.rom \
 efi-e1000.rom efi-eepro100.rom efi-ne2k_pci.rom \
diff --git a/hw/display/tcx.c b/hw/display/tcx.c
index 24876d3..873b82c 100644
--- a/hw/display/tcx.c
+++ b/hw/display/tcx.c
@@ -25,8 +25,12 @@
 #include "qemu-common.h"
 #include "ui/console.h"
 #include "ui/pixel_ops.h"
+#include "hw/loader.h"
 #include "hw/sysbus.h"
 
+#define TCX_ROM_FILE "QEMU,tcx.bin"
+#define FCODE_MAX_ROM_SIZE 0x10000
+
 #define MAXX 1024
 #define MAXY 768
 #define TCX_DAC_NREGS 16
@@ -43,6 +47,8 @@ typedef struct TCXState {
     QemuConsole *con;
     uint8_t *vram;
     uint32_t *vram24, *cplane;
+    hwaddr prom_addr;
+    MemoryRegion rom;
     MemoryRegion vram_mem;
     MemoryRegion vram_8bit;
     MemoryRegion vram_24bit;
@@ -529,14 +535,31 @@ static int tcx_init1(SysBusDevice *dev)
 {
     TCXState *s = TCX(dev);
     ram_addr_t vram_offset = 0;
-    int size;
+    int size, ret;
     uint8_t *vram_base;
+    char *fcode_filename;
 
     memory_region_init_ram(&s->vram_mem, OBJECT(s), "tcx.vram",
                            s->vram_size * (1 + 4 + 4));
     vmstate_register_ram_global(&s->vram_mem);
     vram_base = memory_region_get_ram_ptr(&s->vram_mem);
 
+    /* FCode ROM */
+    memory_region_init_ram(&s->rom, NULL, "tcx.prom", FCODE_MAX_ROM_SIZE);
+    vmstate_register_ram_global(&s->rom);
+    memory_region_set_readonly(&s->rom, true);
+    sysbus_init_mmio(dev, &s->rom);
+
+    fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, TCX_ROM_FILE);
+    if (fcode_filename) {
+        ret = load_image_targphys(fcode_filename, s->prom_addr,
+                                  FCODE_MAX_ROM_SIZE);
+        if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
+            fprintf(stderr, "tcx: could not load prom '%s'\n", TCX_ROM_FILE);
+            return -1;
+        }
+    }
+
     /* 8-bit plane */
     s->vram = vram_base;
     size = s->vram_size;
@@ -598,6 +621,7 @@ static Property tcx_properties[] = {
     DEFINE_PROP_UINT16("width",    TCXState, width,     -1),
     DEFINE_PROP_UINT16("height",   TCXState, height,    -1),
     DEFINE_PROP_UINT16("depth",    TCXState, depth,     -1),
+    DEFINE_PROP_HEX64("prom_addr", TCXState, prom_addr, -1),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index a0d366c..94f7950 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -537,24 +537,27 @@ static void tcx_init(hwaddr addr, int vram_size, int width,
     qdev_prop_set_uint16(dev, "width", width);
     qdev_prop_set_uint16(dev, "height", height);
     qdev_prop_set_uint16(dev, "depth", depth);
+    qdev_prop_set_uint64(dev, "prom_addr", addr);
     qdev_init_nofail(dev);
     s = SYS_BUS_DEVICE(dev);
+    /* FCode ROM */
+    sysbus_mmio_map(s, 0, addr);
     /* 8-bit plane */
-    sysbus_mmio_map(s, 0, addr + 0x00800000ULL);
+    sysbus_mmio_map(s, 1, addr + 0x00800000ULL);
     /* DAC */
-    sysbus_mmio_map(s, 1, addr + 0x00200000ULL);
+    sysbus_mmio_map(s, 2, addr + 0x00200000ULL);
     /* TEC (dummy) */
-    sysbus_mmio_map(s, 2, addr + 0x00700000ULL);
+    sysbus_mmio_map(s, 3, addr + 0x00700000ULL);
     /* THC 24 bit: NetBSD writes here even with 8-bit display: dummy */
-    sysbus_mmio_map(s, 3, addr + 0x00301000ULL);
+    sysbus_mmio_map(s, 4, addr + 0x00301000ULL);
     if (depth == 24) {
         /* 24-bit plane */
-        sysbus_mmio_map(s, 4, addr + 0x02000000ULL);
+        sysbus_mmio_map(s, 5, addr + 0x02000000ULL);
         /* Control plane */
-        sysbus_mmio_map(s, 5, addr + 0x0a000000ULL);
+        sysbus_mmio_map(s, 6, addr + 0x0a000000ULL);
     } else {
         /* THC 8 bit (dummy) */
-        sysbus_mmio_map(s, 4, addr + 0x00300000ULL);
+        sysbus_mmio_map(s, 5, addr + 0x00300000ULL);
     }
 }
 
diff --git a/pc-bios/QEMU,tcx.bin b/pc-bios/QEMU,tcx.bin
new file mode 100644
index 0000000..a8ddd70
Binary files /dev/null and b/pc-bios/QEMU,tcx.bin differ
diff --git a/pc-bios/README b/pc-bios/README
index 1501cf1..a110125 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -11,8 +11,8 @@
   firmware implementation. The goal is to implement a 100% IEEE
   1275-1994 (referred to as Open Firmware) compliant firmware.
   The included images for PowerPC (for 32 and 64 bit PPC CPUs),
-  Sparc32 and Sparc64 are built from OpenBIOS SVN revision
-  1229.
+  Sparc32 (including QEMU,tcx.bin) and Sparc64 are built from OpenBIOS SVN
+  revision 1229.
 
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
commit 607bb022f2a44797cbf40e85e84da4134e2f0e01
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Thu Nov 21 08:11:47 2013 -0800

    Update version for 1.7.0-rc1 release
    
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/VERSION b/VERSION
index 86e63cc..56b4609 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.6.90
+1.6.91
commit 187d62327aca39afbb038d13d7cd6bf2d11640d3
Author: Alex Williamson <alex.williamson at redhat.com>
Date:   Tue Nov 12 11:53:24 2013 -0700

    vfio-pci: Fix multifunction=on
    
    When an assigned device is initialized it copies the device config
    space into the emulated config space.  Unfortunately multifunction is
    setup prior to the device initfn and gets clobbered.  We need to
    restore it just like pci-assign does.
    
    Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
    Reviewed-by: Bandan Das <bsd at redhat.com>
    Message-id: 20131112185059.7262.33780.stgit at bling.home
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c
index fe95e03..f7f8a19 100644
--- a/hw/misc/vfio.c
+++ b/hw/misc/vfio.c
@@ -3568,6 +3568,13 @@ static int vfio_initfn(PCIDevice *pdev)
     vdev->emulated_config_bits[PCI_HEADER_TYPE] =
                                               PCI_HEADER_TYPE_MULTI_FUNCTION;
 
+    /* Restore or clear multifunction, this is always controlled by QEMU */
+    if (vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        vdev->pdev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
+    } else {
+        vdev->pdev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
+    }
+
     /*
      * Clear host resource mapping info.  If we choose not to register a
      * BAR, such as might be the case with the option ROM, we can get
commit 7865eec4f5fb10224a2cd391a8476044cbe5a1f7
Author: Richard Henderson <rth at twiddle.net>
Date:   Tue Nov 12 11:16:56 2013 +1000

    target-i386: Fix addr32 prefix in gen_lea_modrm
    
    Fix the following run-test-x86_64 testsuite failures:
    
    -lea (%%eax) = 0000000000000001
    -lea (%%ebx) = 0000000000000002
    -lea (%%ecx) = 0000000000000004
    -lea (%%edx) = 0000000000000008
    -lea (%%esi) = 0000000000000010
    -lea (%%edi) = 0000000000000020
    +lea (%%eax) = 0000abcc00000001
    +lea (%%ebx) = 0000abcf00000002
    +lea (%%ecx) = 0000abc900000004
    +lea (%%edx) = 0000abc500000008
    +lea (%%esi) = 0000abdd00000010
    +lea (%%edi) = 0000abed00000020
    
    In addition, reduce ifdeffery and minimize the number of TCG ops
    produced during address computation.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Message-id: 1384219016-5170-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/target-i386/translate.c b/target-i386/translate.c
index ecf16b3..7916e5b 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -2090,6 +2090,7 @@ static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm,
     int scale;
     int opreg;
     int mod, rm, code, override, must_add_seg;
+    TCGv sum;
 
     override = s->override;
     must_add_seg = s->addseg;
@@ -2099,10 +2100,9 @@ static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm,
     rm = modrm & 7;
 
     if (s->aflag) {
-
         havesib = 0;
         base = rm;
-        index = 0;
+        index = -1;
         scale = 0;
 
         if (base == 4) {
@@ -2110,6 +2110,9 @@ static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm,
             code = cpu_ldub_code(env, s->pc++);
             scale = (code >> 6) & 3;
             index = ((code >> 3) & 7) | REX_X(s);
+            if (index == 4) {
+                index = -1;  /* no index */
+            }
             base = (code & 7);
         }
         base |= REX_B(s);
@@ -2137,59 +2140,57 @@ static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm,
             break;
         }
 
-        if (base >= 0) {
-            /* for correct popl handling with esp */
-            if (base == 4 && s->popl_esp_hack)
-                disp += s->popl_esp_hack;
-#ifdef TARGET_X86_64
-            if (s->aflag == 2) {
-                gen_op_movq_A0_reg(base);
-                if (disp != 0) {
-                    gen_op_addq_A0_im(disp);
-                }
-            } else
-#endif
-            {
-                gen_op_movl_A0_reg(base);
-                if (disp != 0)
-                    gen_op_addl_A0_im(disp);
+        /* For correct popl handling with esp.  */
+        if (base == R_ESP && s->popl_esp_hack) {
+            disp += s->popl_esp_hack;
+        }
+
+        /* Compute the address, with a minimum number of TCG ops.  */
+        TCGV_UNUSED(sum);
+        if (index >= 0) {
+            if (scale == 0) {
+                sum = cpu_regs[index];
+            } else {
+                tcg_gen_shli_tl(cpu_A0, cpu_regs[index], scale);
+                sum = cpu_A0;
             }
-        } else {
-#ifdef TARGET_X86_64
-            if (s->aflag == 2) {
-                gen_op_movq_A0_im(disp);
-            } else
-#endif
-            {
-                gen_op_movl_A0_im(disp);
+            if (base >= 0) {
+                tcg_gen_add_tl(cpu_A0, sum, cpu_regs[base]);
+                sum = cpu_A0;
             }
+        } else if (base >= 0) {
+            sum = cpu_regs[base];
         }
-        /* index == 4 means no index */
-        if (havesib && (index != 4)) {
-#ifdef TARGET_X86_64
-            if (s->aflag == 2) {
-                gen_op_addq_A0_reg_sN(scale, index);
-            } else
-#endif
-            {
-                gen_op_addl_A0_reg_sN(scale, index);
-            }
+        if (TCGV_IS_UNUSED(sum)) {
+            tcg_gen_movi_tl(cpu_A0, disp);
+        } else {
+            tcg_gen_addi_tl(cpu_A0, sum, disp);
         }
+
         if (must_add_seg) {
             if (override < 0) {
-                if (base == R_EBP || base == R_ESP)
+                if (base == R_EBP || base == R_ESP) {
                     override = R_SS;
-                else
+                } else {
                     override = R_DS;
+                }
             }
-#ifdef TARGET_X86_64
-            if (s->aflag == 2) {
-                gen_op_addq_A0_seg(override);
-            } else
-#endif
-            {
-                gen_op_addl_A0_seg(s, override);
+
+            tcg_gen_ld_tl(cpu_tmp0, cpu_env,
+                          offsetof(CPUX86State, segs[override].base));
+            if (CODE64(s)) {
+                if (s->aflag != 2) {
+                    tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
+                }
+                tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
+                goto done;
             }
+
+            tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_tmp0);
+        }
+
+        if (s->aflag != 2) {
+            tcg_gen_ext32u_tl(cpu_A0, cpu_A0);
         }
     } else {
         switch (mod) {
@@ -2259,6 +2260,7 @@ static void gen_lea_modrm(CPUX86State *env, DisasContext *s, int modrm,
         }
     }
 
+ done:
     opreg = OR_A0;
     disp = 0;
     *reg_ptr = opreg;
commit 33effd3aab4a268fb573fd8d7e0fe0baed0cd61a
Author: Peter Maydell <peter.maydell at linaro.org>
Date:   Tue Oct 22 10:58:41 2013 +0100

    atomic.h: Fix build with clang
    
    clang defines __ATOMIC_SEQ_CST but its implementation of the
    __atomic_exchange() builtin differs from that of gcc. Move the
    __clang__ branch of the ifdef ladder to the top and fix its
    implementation (there is no such builtin as __sync_exchange),
    so we can compile with clang again.
    
    Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1382435921-18438-1-git-send-email-peter.maydell at linaro.org
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index 0aa8913..492bce1 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -168,14 +168,14 @@
 #endif
 
 #ifndef atomic_xchg
-#ifdef __ATOMIC_SEQ_CST
+#if defined(__clang__)
+#define atomic_xchg(ptr, i)    __sync_swap(ptr, i)
+#elif defined(__ATOMIC_SEQ_CST)
 #define atomic_xchg(ptr, i)    ({                           \
     typeof(*ptr) _new = (i), _old;                          \
     __atomic_exchange(ptr, &_new, &_old, __ATOMIC_SEQ_CST); \
     _old;                                                   \
 })
-#elif defined __clang__
-#define atomic_xchg(ptr, i)    __sync_exchange(ptr, i)
 #else
 /* __sync_lock_test_and_set() is documented to be an acquire barrier only.  */
 #define atomic_xchg(ptr, i)    (smp_mb(), __sync_lock_test_and_set(ptr, i))
commit 76c2975a6feb5c232698e982b7f798431457822f
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Tue Nov 19 17:49:46 2013 +0100

    target-i386: do not override nr_cores for -cpu host
    
    Commit 787aaf5 (target-i386: forward CPUID cache leaves when -cpu host is
    used, 2013-09-02) brings bits 31..26 of CPUID leaf 04h out of sync with
    the APIC IDs that QEMU reserves for each package.  This number must come
    from "-smp" options rather than from the host CPUID.
    
    It also turns out that this unsyncing makes Windows Server 2012R2 fail
    to boot.
    
    Tested-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Message-id: 1384879786-6721-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/target-i386/cpu.c b/target-i386/cpu.c
index 864c80e..47af9a8 100644
--- a/target-i386/cpu.c
+++ b/target-i386/cpu.c
@@ -2086,14 +2086,10 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         /* cache info: needed for Core compatibility */
         if (cpu->cache_info_passthrough) {
             host_cpuid(index, count, eax, ebx, ecx, edx);
-            break;
-        }
-        if (cs->nr_cores > 1) {
-            *eax = (cs->nr_cores - 1) << 26;
+            *eax &= ~0xFC000000;
         } else {
             *eax = 0;
-        }
-        switch (count) {
+            switch (count) {
             case 0: /* L1 dcache info */
                 *eax |= CPUID_4_TYPE_DCACHE | \
                         CPUID_4_LEVEL(1) | \
@@ -2133,6 +2129,12 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
                 *ecx = 0;
                 *edx = 0;
                 break;
+            }
+        }
+
+        /* QEMU gives out its own APIC IDs, never pass down bits 31..26.  */
+        if ((*eax & 31) && cs->nr_cores > 1) {
+            *eax |= (cs->nr_cores - 1) << 26;
         }
         break;
     case 5:
commit 54e755588cf1e90f0b1460c4e8e6b6a54b6d3a32
Author: Hervé Poussineau <hpoussin at reactos.org>
Date:   Mon Nov 4 23:26:17 2013 +0100

    mips jazz: do not raise data bus exception when accessing invalid addresses
    
    MIPS Jazz chipset doesn't seem to raise data bus exceptions on invalid accesses.
    However, there is no easy way to prevent them. Creating a big memory region
    for the whole address space doesn't prevent memory core to directly call
    unassigned_mem_read/write which in turn call cpu->do_unassigned_access,
    which (for MIPS CPU) raise an data bus exception.
    
    This fixes a MIPS Jazz regression introduced in c658b94f6e8c206c59d02aa6fbac285b86b53d2c.
    
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Hervé Poussineau <hpoussin at reactos.org>
    Message-id: 1383603977-7003-1-git-send-email-hpoussin at reactos.org
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/mips/mips_jazz.c b/hw/mips/mips_jazz.c
index 49bdd02..5f6dd9f 100644
--- a/hw/mips/mips_jazz.c
+++ b/hw/mips/mips_jazz.c
@@ -108,6 +108,18 @@ static void cpu_request_exit(void *opaque, int irq, int level)
     }
 }
 
+static CPUUnassignedAccess real_do_unassigned_access;
+static void mips_jazz_do_unassigned_access(CPUState *cpu, hwaddr addr,
+                                           bool is_write, bool is_exec,
+                                           int opaque, unsigned size)
+{
+    if (!is_exec) {
+        /* ignore invalid access (ie do not raise exception) */
+        return;
+    }
+    (*real_do_unassigned_access)(cpu, addr, is_write, is_exec, opaque, size);
+}
+
 static void mips_jazz_init(MemoryRegion *address_space,
                            MemoryRegion *address_space_io,
                            ram_addr_t ram_size,
@@ -117,6 +129,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
     char *filename;
     int bios_size, n;
     MIPSCPU *cpu;
+    CPUClass *cc;
     CPUMIPSState *env;
     qemu_irq *rc4030, *i8259;
     rc4030_dma *dmas;
@@ -154,6 +167,17 @@ static void mips_jazz_init(MemoryRegion *address_space,
     env = &cpu->env;
     qemu_register_reset(main_cpu_reset, cpu);
 
+    /* Chipset returns 0 in invalid reads and do not raise data exceptions.
+     * However, we can't simply add a global memory region to catch
+     * everything, as memory core directly call unassigned_mem_read/write
+     * on some invalid accesses, which call do_unassigned_access on the
+     * CPU, which raise an exception.
+     * Handle that case by hijacking the do_unassigned_access method on
+     * the CPU, and do not raise exceptions for data access. */
+    cc = CPU_GET_CLASS(cpu);
+    real_do_unassigned_access = cc->do_unassigned_access;
+    cc->do_unassigned_access = mips_jazz_do_unassigned_access;
+
     /* allocate RAM */
     memory_region_init_ram(ram, NULL, "mips_jazz.ram", ram_size);
     vmstate_register_ram_global(ram);
commit 81f3053b77f7d3a4d9100c425cd8cec99ee7a3d4
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Wed Nov 20 12:54:02 2013 +0100

    target-i386: yield to another VCPU on PAUSE
    
    After commit b1bbfe7 (aio / timers: On timer modification, qemu_notify
    or aio_notify, 2013-08-21) FreeBSD guests report a huge slowdown.
    
    The problem shows up as soon as FreeBSD turns out its periodic (~1 ms)
    tick, but the timers are only the trigger for a pre-existing problem.
    
    Before the offending patch, setting a timer did a timer_settime system call.
    
    After, setting the timer exits the event loop (which uses poll) and
    reenters it with a new deadline.  This does not cause any slowdown; the
    difference is between one system call (timer_settime and a signal
    delivery (SIGALRM) before the patch, and two system calls afterwards
    (write to a pipe or eventfd + calling poll again when re-entering the
    event loop).
    
    Unfortunately, the exit/enter causes the main loop to grab the iothread
    lock, which in turns kicks the VCPU thread out of execution.  This
    causes TCG to execute the next VCPU in its round-robin scheduling of
    VCPUS.  When the second VCPU is mostly unused, FreeBSD runs a "pause"
    instruction in its idle loop which only burns cycles without any
    progress.  As soon as the timer tick expires, the first VCPU runs
    the interrupt handler but very soon it sets it again---and QEMU
    then goes back doing nothing in the second VCPU.
    
    The fix is to make the pause instruction do "cpu_loop_exit".
    
    Cc: Richard Henderson <rth at twiddle.net>
    Reported-by: Luigi Rizzo <rizzo at iet.unipi.it>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Reviewed-by: Richard Henderson <rth at twiddle.net>
    Message-id: 1384948442-24217-1-git-send-email-pbonzini at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/target-i386/helper.h b/target-i386/helper.h
index d6974df..3775abe 100644
--- a/target-i386/helper.h
+++ b/target-i386/helper.h
@@ -58,6 +58,7 @@ DEF_HELPER_2(sysret, void, env, int)
 DEF_HELPER_2(hlt, void, env, int)
 DEF_HELPER_2(monitor, void, env, tl)
 DEF_HELPER_2(mwait, void, env, int)
+DEF_HELPER_2(pause, void, env, int)
 DEF_HELPER_1(debug, void, env)
 DEF_HELPER_1(reset_rf, void, env)
 DEF_HELPER_3(raise_interrupt, void, env, int, int)
diff --git a/target-i386/misc_helper.c b/target-i386/misc_helper.c
index 93933fd..b6307ca 100644
--- a/target-i386/misc_helper.c
+++ b/target-i386/misc_helper.c
@@ -566,6 +566,15 @@ void helper_rdmsr(CPUX86State *env)
 }
 #endif
 
+static void do_pause(X86CPU *cpu)
+{
+    CPUX86State *env = &cpu->env;
+
+    /* Just let another CPU run.  */
+    env->exception_index = EXCP_INTERRUPT;
+    cpu_loop_exit(env);
+}
+
 static void do_hlt(X86CPU *cpu)
 {
     CPUState *cs = CPU(cpu);
@@ -611,13 +620,22 @@ void helper_mwait(CPUX86State *env, int next_eip_addend)
     cs = CPU(cpu);
     /* XXX: not complete but not completely erroneous */
     if (cs->cpu_index != 0 || CPU_NEXT(cs) != NULL) {
-        /* more than one CPU: do not sleep because another CPU may
-           wake this one */
+        do_pause(cpu);
     } else {
         do_hlt(cpu);
     }
 }
 
+void helper_pause(CPUX86State *env, int next_eip_addend)
+{
+    X86CPU *cpu = x86_env_get_cpu(env);
+
+    cpu_svm_check_intercept_param(env, SVM_EXIT_PAUSE, 0);
+    env->eip += next_eip_addend;
+
+    do_pause(cpu);
+}
+
 void helper_debug(CPUX86State *env)
 {
     env->exception_index = EXCP_DEBUG;
diff --git a/target-i386/translate.c b/target-i386/translate.c
index eb0ea93..ecf16b3 100644
--- a/target-i386/translate.c
+++ b/target-i386/translate.c
@@ -7224,7 +7224,10 @@ static target_ulong disas_insn(CPUX86State *env, DisasContext *s,
             goto do_xchg_reg_eax;
         }
         if (prefixes & PREFIX_REPZ) {
-            gen_svm_check_intercept(s, pc_start, SVM_EXIT_PAUSE);
+            gen_update_cc_op(s);
+            gen_jmp_im(pc_start - s->cs_base);
+            gen_helper_pause(cpu_env, tcg_const_i32(s->pc - pc_start));
+            s->is_jmp = DISAS_TB_JUMP;
         }
         break;
     case 0x9b: /* fwait */
commit 1eb1bd9eafa890f1f4d16ef5cb8b9239a86874d9
Author: Amos Kong <akong at redhat.com>
Date:   Thu Nov 21 16:42:51 2013 +0800

    rng-egd: offset the point when repeatedly read from the buffer
    
    The buffer content might be read out more than once, currently
    we just repeatedly read the first data block, buffer offset is
    missing.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Amos Kong <akong at redhat.com>
    Message-id: 1385023371-8198-3-git-send-email-akong at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 6f56f9e..25bb3b4 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -91,12 +91,14 @@ static int rng_egd_chr_can_read(void *opaque)
 static void rng_egd_chr_read(void *opaque, const uint8_t *buf, int size)
 {
     RngEgd *s = RNG_EGD(opaque);
+    size_t buf_offset = 0;
 
     while (size > 0 && s->requests) {
         RngRequest *req = s->requests->data;
         int len = MIN(size, req->size - req->offset);
 
-        memcpy(req->data + req->offset, buf, len);
+        memcpy(req->data + req->offset, buf + buf_offset, len);
+        buf_offset += len;
         req->offset += len;
         size -= len;
 
commit 5e490b6a504912225dff0e520e1c6af68295d238
Author: Amos Kong <akong at redhat.com>
Date:   Thu Nov 21 16:42:50 2013 +0800

    rng-egd: remove redundant free
    
    We didn't set default chr_name, the free is redundant.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Message-id: 1385023371-8198-2-git-send-email-akong at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 9e5a536..6f56f9e 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -167,7 +167,6 @@ static void rng_egd_set_chardev(Object *obj, const char *value, Error **errp)
     if (b->opened) {
         error_set(errp, QERR_PERMISSION_DENIED);
     } else {
-        g_free(s->chr_name);
         s->chr_name = g_strdup(value);
     }
 }
commit d44bb8604e87ecd3823f12f0c92d5e56d613de0d
Author: Amos Kong <akong at redhat.com>
Date:   Thu Nov 21 18:53:23 2013 +0800

    virtio-rng: add check of period
    
    If period is assigned to 0, limit timer will expire immediately.
    It causes a qemu warning:
    
    "main-loop: WARNING: I/O thread spun for 1000 iterations"
    
    This limit is meaningless. This patch forbids to assign 0 to period.
    
    Reviewed-by: Amit Shah <amit.shah at redhat.com>
    Signed-off-by: Amos Kong <akong at redhat.com>
    Message-id: 1385031203-23790-1-git-send-email-akong at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index 314e393..b22ccf1 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -139,6 +139,12 @@ static int virtio_rng_device_init(VirtIODevice *vdev)
     VirtIORNG *vrng = VIRTIO_RNG(vdev);
     Error *local_err = NULL;
 
+    if (!vrng->conf.period_ms > 0) {
+        qerror_report(QERR_INVALID_PARAMETER_VALUE, "period",
+                      "a positive number");
+        return -1;
+    }
+
     if (vrng->conf.rng == NULL) {
         vrng->conf.default_backend = RNG_RANDOM(object_new(TYPE_RNG_RANDOM));
 
commit 376827d48922941d16ef9949672e86f820005d0a
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 15:34:26 2013 +0200

    s390x: fix flat file load on 32 bit systems
    
    pc-bios/s390-zipl.rom is a flat image so it's expected that
    loading it as elf will fail.
    It should fall back on loading a flat file, but doesn't
    on 32 bit systems, instead it fails printing:
        qemu: hardware error: could not load bootloader 's390-zipl.rom'
    
    The result is boot failure.
    
    The reason is that a 64 bit unsigned interger which is set
    to -1 on error is compared to -1UL which on a 32 bit system
    with gcc is a 32 bit unsigned interger.
    Since both are unsigned, no sign extension takes place and
    comparison evaluates to non-equal.
    
    There's no reason to do clever tricks: all functions
    we call actually return int so just use int.
    And then we can use == -1 everywhere, consistently.
    
    Reviewed-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Message-id: 20131121133426.GA30827 at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d69adb2..65d39da 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -62,10 +62,10 @@ typedef struct S390IPLState {
 static int s390_ipl_init(SysBusDevice *dev)
 {
     S390IPLState *ipl = S390_IPL(dev);
-    ram_addr_t kernel_size = 0;
+    int kernel_size;
 
     if (!ipl->kernel) {
-        ram_addr_t bios_size = 0;
+        int bios_size;
         char *bios_filename;
 
         /* Load zipl bootloader */
@@ -80,7 +80,7 @@ static int s390_ipl_init(SysBusDevice *dev)
 
         bios_size = load_elf(bios_filename, NULL, NULL, &ipl->start_addr, NULL,
                              NULL, 1, ELF_MACHINE, 0);
-        if (bios_size == -1UL) {
+        if (bios_size == -1) {
             bios_size = load_image_targphys(bios_filename, ZIPL_IMAGE_START,
                                             4096);
             ipl->start_addr = ZIPL_IMAGE_START;
@@ -90,17 +90,17 @@ static int s390_ipl_init(SysBusDevice *dev)
         }
         g_free(bios_filename);
 
-        if ((long)bios_size < 0) {
+        if (bios_size == -1) {
             hw_error("could not load bootloader '%s'\n", bios_name);
         }
         return 0;
     } else {
         kernel_size = load_elf(ipl->kernel, NULL, NULL, NULL, NULL,
                                NULL, 1, ELF_MACHINE, 0);
-        if (kernel_size == -1UL) {
+        if (kernel_size == -1) {
             kernel_size = load_image_targphys(ipl->kernel, 0, ram_size);
         }
-        if (kernel_size == -1UL) {
+        if (kernel_size == -1) {
             fprintf(stderr, "could not load kernel '%s'\n", ipl->kernel);
             return -1;
         }
@@ -115,7 +115,8 @@ static int s390_ipl_init(SysBusDevice *dev)
         ipl->start_addr = KERN_IMAGE_START;
     }
     if (ipl->initrd) {
-        ram_addr_t initrd_offset, initrd_size;
+        ram_addr_t initrd_offset;
+        int initrd_size;
 
         initrd_offset = INITRD_START;
         while (kernel_size + 0x100000 > initrd_offset) {
@@ -123,7 +124,7 @@ static int s390_ipl_init(SysBusDevice *dev)
         }
         initrd_size = load_image_targphys(ipl->initrd, initrd_offset,
                                           ram_size - initrd_offset);
-        if (initrd_size == -1UL) {
+        if (initrd_size == -1) {
             fprintf(stderr, "qemu: could not load initrd '%s'\n", ipl->initrd);
             exit(1);
         }
commit b15654c21acef4d2bc17e6ac528c6c93abbb7e1e
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 14:17:54 2013 +0200

    acpi-build: fix build on glib < 2.14
    
    g_array_get_element_size was only added in glib 2.14.
    Fortunately we don't use it for any arrays where
    element size is > 1, so just add an assert.
    
    Reported-by: Richard Henderson <rth at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1385036128-8753-2-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 59a17df..5f36e7e 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -425,7 +425,10 @@ static inline void *acpi_data_push(GArray *table_data, unsigned size)
 
 static unsigned acpi_data_len(GArray *table)
 {
-    return table->len * g_array_get_element_size(table);
+#if GLIB_CHECK_VERSION(2, 14, 0)
+    assert(g_array_get_element_size(table) == 1);
+#endif
+    return table->len;
 }
 
 static void acpi_align_size(GArray *blob, unsigned align)
diff --git a/hw/i386/bios-linker-loader.c b/hw/i386/bios-linker-loader.c
index 0833853..fd23611 100644
--- a/hw/i386/bios-linker-loader.c
+++ b/hw/i386/bios-linker-loader.c
@@ -90,7 +90,7 @@ enum {
 
 GArray *bios_linker_loader_init(void)
 {
-    return g_array_new(false, true /* clear */, sizeof(BiosLinkerLoaderEntry));
+    return g_array_new(false, true /* clear */, 1);
 }
 
 /* Free linker wrapper and return the linker array. */
@@ -115,7 +115,7 @@ void bios_linker_loader_alloc(GArray *linker,
                                     BIOS_LINKER_LOADER_ALLOC_ZONE_HIGH);
 
     /* Alloc entries must come first, so prepend them */
-    g_array_prepend_val(linker, entry);
+    g_array_prepend_vals(linker, &entry, sizeof entry);
 }
 
 void bios_linker_loader_add_checksum(GArray *linker, const char *file,
@@ -132,7 +132,7 @@ void bios_linker_loader_add_checksum(GArray *linker, const char *file,
     entry.cksum.start = cpu_to_le32((uint8_t *)start - (uint8_t *)table);
     entry.cksum.length = cpu_to_le32(size);
 
-    g_array_append_val(linker, entry);
+    g_array_append_vals(linker, &entry, sizeof entry);
 }
 
 void bios_linker_loader_add_pointer(GArray *linker,
@@ -154,5 +154,5 @@ void bios_linker_loader_add_pointer(GArray *linker,
     assert(pointer_size == 1 || pointer_size == 2 ||
            pointer_size == 4 || pointer_size == 8);
 
-    g_array_append_val(linker, entry);
+    g_array_append_vals(linker, &entry, sizeof entry);
 }
commit 542da88f0013ebb2b2d8ca10becbfebd9948abba
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 14:17:51 2013 +0200

    acpi-build: fix build on glib < 2.22
    
    g_string_vprintf was only introduced in 2.24 so switch to vsnprintf
    instead.  A bit uglier but name size is fixed at 4 bytes here so it's
    easy.
    
    Reported-by: Richard Henderson <rth at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Message-id: 1385036128-8753-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 486e705..59a17df 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -287,16 +287,17 @@ static inline void build_append_array(GArray *array, GArray *val)
 
 static void build_append_nameseg(GArray *array, const char *format, ...)
 {
-    GString *s = g_string_new("");
+    /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
+    char s[] = "XXXX";
+    int len;
     va_list args;
 
     va_start(args, format);
-    g_string_vprintf(s, format, args);
+    len = vsnprintf(s, sizeof s, format, args);
     va_end(args);
 
-    assert(s->len == 4);
-    g_array_append_vals(array, s->str, s->len);
-    g_string_free(s, true);
+    assert(len == 4);
+    g_array_append_vals(array, s, len);
 }
 
 /* 5.4 Definition Block Encoding */
commit 0a3c738507cef91bd751d8507676109bc7985e1a
Merge: ffb62da ef4cbe1
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Thu Nov 21 07:09:52 2013 -0800

    Merge remote-tracking branch 'qemu-kvm/uq/master' into staging
    
    # By Jan Kiszka (1) and others
    # Via Gleb Natapov
    * qemu-kvm/uq/master:
      kvm: Fix uninitialized cpuid_data
      pci-assign: Remove dead code for direct I/O region access from userspace
      KVM: x86: fix typo in KVM_GET_XCRS
    
    Message-id: cover.1385040432.git.gleb at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit ffb62da7a23b1d13a3582bee6b2df599baa6ecfb
Merge: 425ff51 14a650e
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Thu Nov 21 07:08:47 2013 -0800

    Merge remote-tracking branch 'jliu/or32' into staging
    
    # By Sebastian Macke
    # Via Jia Liu
    * jliu/or32:
      target-openrisc: Correct carry flag check of l.addc and l.addic test cases
      target-openrisc: Correct memory bounds checking for the tlb buffers
      openrisc-timer: Reduce overhead, Separate clock update functions
      target-openrisc: Correct wrong epcr register in interrupt handler
      target-openrisc: Remove executable flag for every page
      target-openrisc: Remove unnecessary code generated by jump instructions
      target-openrisc: Speed up move instruction
    
    Message-id: 1384958318-9145-1-git-send-email-proljc at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 425ff5102f8668d5c921e2a1d77ee9173742bfdf
Merge: 394cfa3 8e86729
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Thu Nov 21 07:08:31 2013 -0800

    Merge remote-tracking branch 'quintela/migration.next' into staging
    
    # By Wangting (Kathy)
    # Via Juan Quintela
    * quintela/migration.next:
      The calculation of bytes_xfer in qemu_put_buffer() is wrong
    
    Message-id: 1384946787-8190-1-git-send-email-quintela at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 90d131fb6504ed12a37dc8433375cc683c30e9da
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Nov 18 21:41:44 2013 +0200

    Revert "e1000/rtl8139: update HMP NIC when every bit is written"
    
    This reverts commit cd5be5829c1ce87aa6b3a7806524fac07ac9a757.
    Digging into hardware specs shows this does not
    actually make QEMU behave more like hardware:
    
    There are valid arguments backed by the spec to indicate why the version
    of e1000 prior to cd5be582 was more correct: the high byte actually
    includes a valid bit, this is why all guests write it last.
    
    For rtl8139 there's actually a separate undocumented valid bit, but we
    don't implement it yet.
    
    To summarize all the drivers we know about behave in one way
    that allows us to make an assumption about write order and avoid
    spurious, incorrect mac address updates to the monitor.
    
    Let's stick to the tried heuristic for 1.7 and
    possibly revisit for 1.8.
    
    Reported-by: Vlad Yasevich <vyasevic at redhat.com>
    Reviewed-by: Vlad Yasevich <vyasevic at redhat.com>
    Cc: Amos Kong <akong at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index ae63591..8387443 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1106,7 +1106,7 @@ mac_writereg(E1000State *s, int index, uint32_t val)
 
     s->mac_reg[index] = val;
 
-    if (index == RA || index == RA + 1) {
+    if (index == RA + 1) {
         macaddr[0] = cpu_to_le32(s->mac_reg[RA]);
         macaddr[1] = cpu_to_le32(s->mac_reg[RA + 1]);
         qemu_format_nic_info_str(qemu_get_queue(s->nic), (uint8_t *)macaddr);
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 7f2b4db..5329f44 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -2741,7 +2741,10 @@ static void rtl8139_io_writeb(void *opaque, uint8_t addr, uint32_t val)
 
     switch (addr)
     {
-        case MAC0 ... MAC0+5:
+        case MAC0 ... MAC0+4:
+            s->phys[addr - MAC0] = val;
+            break;
+        case MAC0+5:
             s->phys[addr - MAC0] = val;
             qemu_format_nic_info_str(qemu_get_queue(s->nic), s->phys);
             break;
commit fd8f5e37557596e14a859d8edf3dc24523bd4400
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 11:22:51 2013 +0200

    acpi-build: fix build on glib < 2.14
    
    g_array_get_element_size was only added in glib 2.14,
    there's no way to find element size in with an older glib.
    
    Fortunately we only use a single table (linker) where element size > 1.
    Switch element size to 1 everywhere, then we can just look at len field
    to get table size in bytes.
    
    Add an assert to make sure we catch any violations of this rule.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reported-by: Richard Henderson <rth at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 59a17df..5f36e7e 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -425,7 +425,10 @@ static inline void *acpi_data_push(GArray *table_data, unsigned size)
 
 static unsigned acpi_data_len(GArray *table)
 {
-    return table->len * g_array_get_element_size(table);
+#if GLIB_CHECK_VERSION(2, 14, 0)
+    assert(g_array_get_element_size(table) == 1);
+#endif
+    return table->len;
 }
 
 static void acpi_align_size(GArray *blob, unsigned align)
diff --git a/hw/i386/bios-linker-loader.c b/hw/i386/bios-linker-loader.c
index 0833853..fd23611 100644
--- a/hw/i386/bios-linker-loader.c
+++ b/hw/i386/bios-linker-loader.c
@@ -90,7 +90,7 @@ enum {
 
 GArray *bios_linker_loader_init(void)
 {
-    return g_array_new(false, true /* clear */, sizeof(BiosLinkerLoaderEntry));
+    return g_array_new(false, true /* clear */, 1);
 }
 
 /* Free linker wrapper and return the linker array. */
@@ -115,7 +115,7 @@ void bios_linker_loader_alloc(GArray *linker,
                                     BIOS_LINKER_LOADER_ALLOC_ZONE_HIGH);
 
     /* Alloc entries must come first, so prepend them */
-    g_array_prepend_val(linker, entry);
+    g_array_prepend_vals(linker, &entry, sizeof entry);
 }
 
 void bios_linker_loader_add_checksum(GArray *linker, const char *file,
@@ -132,7 +132,7 @@ void bios_linker_loader_add_checksum(GArray *linker, const char *file,
     entry.cksum.start = cpu_to_le32((uint8_t *)start - (uint8_t *)table);
     entry.cksum.length = cpu_to_le32(size);
 
-    g_array_append_val(linker, entry);
+    g_array_append_vals(linker, &entry, sizeof entry);
 }
 
 void bios_linker_loader_add_pointer(GArray *linker,
@@ -154,5 +154,5 @@ void bios_linker_loader_add_pointer(GArray *linker,
     assert(pointer_size == 1 || pointer_size == 2 ||
            pointer_size == 4 || pointer_size == 8);
 
-    g_array_append_val(linker, entry);
+    g_array_append_vals(linker, &entry, sizeof entry);
 }
commit 8b9c3b897c682cd9739c6aef73b3220c7204c243
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 11:19:58 2013 +0200

    acpi-build: fix build on glib < 2.22
    
    g_string_vprintf was only introduced in 2.24 so switch to vsnprintf
    instead.  A bit uglier but name size is fixed at 4 bytes here so it's
    easy.
    
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Reported-by: Richard Henderson <rth at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 486e705..59a17df 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -287,16 +287,17 @@ static inline void build_append_array(GArray *array, GArray *val)
 
 static void build_append_nameseg(GArray *array, const char *format, ...)
 {
-    GString *s = g_string_new("");
+    /* It would be nicer to use g_string_vprintf but it's only there in 2.22 */
+    char s[] = "XXXX";
+    int len;
     va_list args;
 
     va_start(args, format);
-    g_string_vprintf(s, format, args);
+    len = vsnprintf(s, sizeof s, format, args);
     va_end(args);
 
-    assert(s->len == 4);
-    g_array_append_vals(array, s->str, s->len);
-    g_string_free(s, true);
+    assert(len == 4);
+    g_array_append_vals(array, s, len);
 }
 
 /* 5.4 Definition Block Encoding */
commit 5c397242d5d53c1adecce31817bb439383cf8228
Author: Bandan Das <bsd at redhat.com>
Date:   Wed Nov 6 17:52:17 2013 -0500

    pci: unregister vmstate_pcibus on unplug
    
    PCIBus registers a vmstate during init. Unregister it upon
    removal/unplug.
    
    Signed-off-by: Bandan Das <bsd at redhat.com>
    Cc: qemu-stable at nongnu.org
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index ed32059..49eca95 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -47,6 +47,7 @@ static void pcibus_dev_print(Monitor *mon, DeviceState *dev, int indent);
 static char *pcibus_get_dev_path(DeviceState *dev);
 static char *pcibus_get_fw_dev_path(DeviceState *dev);
 static int pcibus_reset(BusState *qbus);
+static void pci_bus_finalize(Object *obj);
 
 static Property pci_props[] = {
     DEFINE_PROP_PCI_DEVFN("addr", PCIDevice, devfn, -1),
@@ -73,6 +74,7 @@ static const TypeInfo pci_bus_info = {
     .name = TYPE_PCI_BUS,
     .parent = TYPE_BUS,
     .instance_size = sizeof(PCIBus),
+    .instance_finalize = pci_bus_finalize,
     .class_init = pci_bus_class_init,
 };
 
@@ -375,6 +377,12 @@ int pci_bus_num(PCIBus *s)
     return s->parent_dev->config[PCI_SECONDARY_BUS];
 }
 
+static void pci_bus_finalize(Object *obj)
+{
+    PCIBus *bus = PCI_BUS(obj);
+    vmstate_unregister(NULL, &vmstate_pcibus, bus);
+}
+
 static int get_pci_config_device(QEMUFile *f, void *pv, size_t size)
 {
     PCIDevice *s = container_of(pv, PCIDevice, config);
commit decbc880289526d94495bcbe6e1ba2a11b92e7a8
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 21 13:59:15 2013 +0200

    s390x: fix flat file load on 32 bit systems
    
    pc-bios/s390-zipl.rom is a flat image so it's expected that
    loading it as elf will fail.
    It should fall back on loading a flat file, but doesn't
    on 32 bit systems, instead it fails printing:
        qemu: hardware error: could not load bootloader 's390-zipl.rom'
    
    The result is boot failure.
    
    The reason is that a 64 bit unsigned interger which is set
    to -1 on error is compared to -1UL which on a 32 bit system
    with gcc is a 32 bit unsigned interger.
    Since both are unsigned, no sign extension takes place and
    comparison evaluates to non-equal.
    
    There's no reason to do clever tricks: all functions
    we call actually return int so just use int.
    And then we can use == -1 everywhere, consistently.
    
    Reviewed-by: Alexander Graf <agraf at suse.de>
    Reviewed-by: Cornelia Huck <cornelia.huck at de.ibm.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index d69adb2..65d39da 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -62,10 +62,10 @@ typedef struct S390IPLState {
 static int s390_ipl_init(SysBusDevice *dev)
 {
     S390IPLState *ipl = S390_IPL(dev);
-    ram_addr_t kernel_size = 0;
+    int kernel_size;
 
     if (!ipl->kernel) {
-        ram_addr_t bios_size = 0;
+        int bios_size;
         char *bios_filename;
 
         /* Load zipl bootloader */
@@ -80,7 +80,7 @@ static int s390_ipl_init(SysBusDevice *dev)
 
         bios_size = load_elf(bios_filename, NULL, NULL, &ipl->start_addr, NULL,
                              NULL, 1, ELF_MACHINE, 0);
-        if (bios_size == -1UL) {
+        if (bios_size == -1) {
             bios_size = load_image_targphys(bios_filename, ZIPL_IMAGE_START,
                                             4096);
             ipl->start_addr = ZIPL_IMAGE_START;
@@ -90,17 +90,17 @@ static int s390_ipl_init(SysBusDevice *dev)
         }
         g_free(bios_filename);
 
-        if ((long)bios_size < 0) {
+        if (bios_size == -1) {
             hw_error("could not load bootloader '%s'\n", bios_name);
         }
         return 0;
     } else {
         kernel_size = load_elf(ipl->kernel, NULL, NULL, NULL, NULL,
                                NULL, 1, ELF_MACHINE, 0);
-        if (kernel_size == -1UL) {
+        if (kernel_size == -1) {
             kernel_size = load_image_targphys(ipl->kernel, 0, ram_size);
         }
-        if (kernel_size == -1UL) {
+        if (kernel_size == -1) {
             fprintf(stderr, "could not load kernel '%s'\n", ipl->kernel);
             return -1;
         }
@@ -115,7 +115,8 @@ static int s390_ipl_init(SysBusDevice *dev)
         ipl->start_addr = KERN_IMAGE_START;
     }
     if (ipl->initrd) {
-        ram_addr_t initrd_offset, initrd_size;
+        ram_addr_t initrd_offset;
+        int initrd_size;
 
         initrd_offset = INITRD_START;
         while (kernel_size + 0x100000 > initrd_offset) {
@@ -123,7 +124,7 @@ static int s390_ipl_init(SysBusDevice *dev)
         }
         initrd_size = load_image_targphys(ipl->initrd, initrd_offset,
                                           ram_size - initrd_offset);
-        if (initrd_size == -1UL) {
+        if (initrd_size == -1) {
             fprintf(stderr, "qemu: could not load initrd '%s'\n", ipl->initrd);
             exit(1);
         }
commit 14a650ec25ca93a626397783d6c6e840ec2502c6
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:45 2013 +0200

    target-openrisc: Correct carry flag check of l.addc and l.addic test cases
    
    The test cases did not correctly test for the carry flag.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/tests/tcg/openrisc/test_addc.c b/tests/tcg/openrisc/test_addc.c
index 05d18f8..a8f756a 100644
--- a/tests/tcg/openrisc/test_addc.c
+++ b/tests/tcg/openrisc/test_addc.c
@@ -7,9 +7,10 @@ int main(void)
 
     b = 0x01;
     c = 0xffffffff;
-    result = 1;
+    result = 0;
     __asm
-    ("l.addc   %0, %1, %2\n\t"
+    ("l.add r1, r1, r0\n\t" /* clear carry */
+     "l.addc   %0, %1, %2\n\t"
      : "=r"(a)
      : "r"(b), "r"(c)
     );
@@ -22,7 +23,8 @@ int main(void)
     c = 0xffffffff;
     result = 0x80000001;
     __asm
-    ("l.addc   %0, %1, %2\n\t"
+    ("l.add r1, r1, r0\n\t" /* clear carry */
+     "l.addc   %0, %1, %2\n\t"
      "l.movhi  %2, 0x7fff\n\t"
      "l.ori    %2, %2, 0xffff\n\t"
      "l.addc   %0, %1, %2\n\t"
diff --git a/tests/tcg/openrisc/test_addic.c b/tests/tcg/openrisc/test_addic.c
index 4ba7432..857aaa1 100644
--- a/tests/tcg/openrisc/test_addic.c
+++ b/tests/tcg/openrisc/test_addic.c
@@ -6,9 +6,10 @@ int main(void)
     int result;
 
     a = 1;
-    result = 0x1;
+    result = 0x0;
     __asm
-    ("l.addic %0, %0, 0xffff\n\t"
+    ("l.add r1, r1, r0\n\t" /* clear carry */
+     "l.addic %0, %0, 0xffff\n\t"
      : "+r"(a)
     );
     if (a != result) {
@@ -16,10 +17,11 @@ int main(void)
         return -1;
    }
 
-    a = 0x1;
+    a = -1;
     result = 0x201;
     __asm
-    ("l.addic %0, %0, 0xffff\n\t"
+    ("l.add r1, r1, r0\n\t"  /* clear carry */
+     "l.addic %0, %0, 0x1\n\t"
      "l.ori   %0, r0, 0x100\n\t"
      "l.addic %0, %0, 0x100\n\t"
      : "+r"(a)
commit 93147a180c10b97bf9575a87e01c9a1c93e6c9ce
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:42 2013 +0200

    target-openrisc: Correct memory bounds checking for the tlb buffers
    
    The mtspr and mfspr routines didn't check for the correct memory boundaries.
    This fixes a segmentation fault while booting Linux.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/sys_helper.c b/target-openrisc/sys_helper.c
index f116588..be06c45 100644
--- a/target-openrisc/sys_helper.c
+++ b/target-openrisc/sys_helper.c
@@ -81,7 +81,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
     case TO_SPR(0, 64): /* ESR */
         env->esr = rb;
         break;
-    case TO_SPR(1, 512) ... TO_SPR(1, 639): /* DTLBW0MR 0-127 */
+    case TO_SPR(1, 512) ... TO_SPR(1, 512+DTLB_SIZE-1): /* DTLBW0MR 0-127 */
         idx = spr - TO_SPR(1, 512);
         if (!(rb & 1)) {
             tlb_flush_page(env, env->tlb->dtlb[0][idx].mr & TARGET_PAGE_MASK);
@@ -89,7 +89,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
         env->tlb->dtlb[0][idx].mr = rb;
         break;
 
-    case TO_SPR(1, 640) ... TO_SPR(1, 767): /* DTLBW0TR 0-127 */
+    case TO_SPR(1, 640) ... TO_SPR(1, 640+DTLB_SIZE-1): /* DTLBW0TR 0-127 */
         idx = spr - TO_SPR(1, 640);
         env->tlb->dtlb[0][idx].tr = rb;
         break;
@@ -100,7 +100,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
     case TO_SPR(1, 1280) ... TO_SPR(1, 1407): /* DTLBW3MR 0-127 */
     case TO_SPR(1, 1408) ... TO_SPR(1, 1535): /* DTLBW3TR 0-127 */
         break;
-    case TO_SPR(2, 512) ... TO_SPR(2, 639):   /* ITLBW0MR 0-127 */
+    case TO_SPR(2, 512) ... TO_SPR(2, 512+ITLB_SIZE-1):   /* ITLBW0MR 0-127 */
         idx = spr - TO_SPR(2, 512);
         if (!(rb & 1)) {
             tlb_flush_page(env, env->tlb->itlb[0][idx].mr & TARGET_PAGE_MASK);
@@ -108,7 +108,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
         env->tlb->itlb[0][idx].mr = rb;
         break;
 
-    case TO_SPR(2, 640) ... TO_SPR(2, 767): /* ITLBW0TR 0-127 */
+    case TO_SPR(2, 640) ... TO_SPR(2, 640+ITLB_SIZE-1): /* ITLBW0TR 0-127 */
         idx = spr - TO_SPR(2, 640);
         env->tlb->itlb[0][idx].tr = rb;
         break;
@@ -212,11 +212,11 @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env,
     case TO_SPR(0, 64): /* ESR */
         return env->esr;
 
-    case TO_SPR(1, 512) ... TO_SPR(1, 639): /* DTLBW0MR 0-127 */
+    case TO_SPR(1, 512) ... TO_SPR(1, 512+DTLB_SIZE-1): /* DTLBW0MR 0-127 */
         idx = spr - TO_SPR(1, 512);
         return env->tlb->dtlb[0][idx].mr;
 
-    case TO_SPR(1, 640) ... TO_SPR(1, 767): /* DTLBW0TR 0-127 */
+    case TO_SPR(1, 640) ... TO_SPR(1, 640+DTLB_SIZE-1): /* DTLBW0TR 0-127 */
         idx = spr - TO_SPR(1, 640);
         return env->tlb->dtlb[0][idx].tr;
 
@@ -228,11 +228,11 @@ target_ulong HELPER(mfspr)(CPUOpenRISCState *env,
     case TO_SPR(1, 1408) ... TO_SPR(1, 1535): /* DTLBW3TR 0-127 */
         break;
 
-    case TO_SPR(2, 512) ... TO_SPR(2, 639): /* ITLBW0MR 0-127 */
+    case TO_SPR(2, 512) ... TO_SPR(2, 512+ITLB_SIZE-1): /* ITLBW0MR 0-127 */
         idx = spr - TO_SPR(2, 512);
         return env->tlb->itlb[0][idx].mr;
 
-    case TO_SPR(2, 640) ... TO_SPR(2, 767): /* ITLBW0TR 0-127 */
+    case TO_SPR(2, 640) ... TO_SPR(2, 640+ITLB_SIZE-1): /* ITLBW0TR 0-127 */
         idx = spr - TO_SPR(2, 640);
         return env->tlb->itlb[0][idx].tr;
 
commit d51552176a2ab5e80a211514aa1339fe2575ec2a
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:41 2013 +0200

    openrisc-timer: Reduce overhead, Separate clock update functions
    
    The clock value is only evaluated when really necessary reducing
    the overhead of the timer handling.
    
    This also solves a problem in the way the Linux kernel
    handles the timer and the expected accuracy.
    The old version could lead to inaccurate timings.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/hw/openrisc/cputimer.c b/hw/openrisc/cputimer.c
index 988ca20..9c54945 100644
--- a/hw/openrisc/cputimer.c
+++ b/hw/openrisc/cputimer.c
@@ -30,19 +30,28 @@ static int is_counting;
 
 void cpu_openrisc_count_update(OpenRISCCPU *cpu)
 {
-    uint64_t now, next;
-    uint32_t wait;
+    uint64_t now;
 
-    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     if (!is_counting) {
-        timer_del(cpu->env.timer);
-        last_clk = now;
         return;
     }
-
+    now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     cpu->env.ttcr += (uint32_t)muldiv64(now - last_clk, TIMER_FREQ,
                                         get_ticks_per_sec());
     last_clk = now;
+}
+
+void cpu_openrisc_timer_update(OpenRISCCPU *cpu)
+{
+    uint32_t wait;
+    uint64_t now, next;
+
+    if (!is_counting) {
+        return;
+    }
+
+    cpu_openrisc_count_update(cpu);
+    now = last_clk;
 
     if ((cpu->env.ttmr & TTMR_TP) <= (cpu->env.ttcr & TTMR_TP)) {
         wait = TTMR_TP - (cpu->env.ttcr & TTMR_TP) + 1;
@@ -50,7 +59,6 @@ void cpu_openrisc_count_update(OpenRISCCPU *cpu)
     } else {
         wait = (cpu->env.ttmr & TTMR_TP) - (cpu->env.ttcr & TTMR_TP);
     }
-
     next = now + muldiv64(wait, get_ticks_per_sec(), TIMER_FREQ);
     timer_mod(cpu->env.timer, next);
 }
@@ -63,8 +71,9 @@ void cpu_openrisc_count_start(OpenRISCCPU *cpu)
 
 void cpu_openrisc_count_stop(OpenRISCCPU *cpu)
 {
-    is_counting = 0;
+    timer_del(cpu->env.timer);
     cpu_openrisc_count_update(cpu);
+    is_counting = 0;
 }
 
 static void openrisc_timer_cb(void *opaque)
@@ -84,15 +93,15 @@ static void openrisc_timer_cb(void *opaque)
         break;
     case TIMER_INTR:
         cpu->env.ttcr = 0;
-        cpu_openrisc_count_start(cpu);
         break;
     case TIMER_SHOT:
         cpu_openrisc_count_stop(cpu);
         break;
     case TIMER_CONT:
-        cpu_openrisc_count_start(cpu);
         break;
     }
+
+    cpu_openrisc_timer_update(cpu);
 }
 
 void cpu_openrisc_clock_init(OpenRISCCPU *cpu)
diff --git a/target-openrisc/cpu.h b/target-openrisc/cpu.h
index 8fd0bc0..0f9efdf 100644
--- a/target-openrisc/cpu.h
+++ b/target-openrisc/cpu.h
@@ -373,6 +373,7 @@ void cpu_openrisc_pic_init(OpenRISCCPU *cpu);
 /* hw/openrisc_timer.c */
 void cpu_openrisc_clock_init(OpenRISCCPU *cpu);
 void cpu_openrisc_count_update(OpenRISCCPU *cpu);
+void cpu_openrisc_timer_update(OpenRISCCPU *cpu);
 void cpu_openrisc_count_start(OpenRISCCPU *cpu);
 void cpu_openrisc_count_stop(OpenRISCCPU *cpu);
 
diff --git a/target-openrisc/sys_helper.c b/target-openrisc/sys_helper.c
index cccbc0e..f116588 100644
--- a/target-openrisc/sys_helper.c
+++ b/target-openrisc/sys_helper.c
@@ -127,33 +127,31 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
         break;
     case TO_SPR(10, 0): /* TTMR */
         {
+            if ((env->ttmr & TTMR_M) ^ (rb & TTMR_M)) {
+                switch (rb & TTMR_M) {
+                case TIMER_NONE:
+                    cpu_openrisc_count_stop(cpu);
+                    break;
+                case TIMER_INTR:
+                case TIMER_SHOT:
+                case TIMER_CONT:
+                    cpu_openrisc_count_start(cpu);
+                    break;
+                default:
+                    break;
+                }
+            }
+
             int ip = env->ttmr & TTMR_IP;
 
             if (rb & TTMR_IP) {    /* Keep IP bit.  */
-                env->ttmr = (rb & ~TTMR_IP) + ip;
+                env->ttmr = (rb & ~TTMR_IP) | ip;
             } else {    /* Clear IP bit.  */
                 env->ttmr = rb & ~TTMR_IP;
                 cs->interrupt_request &= ~CPU_INTERRUPT_TIMER;
             }
 
-            cpu_openrisc_count_update(cpu);
-
-            switch (env->ttmr & TTMR_M) {
-            case TIMER_NONE:
-                cpu_openrisc_count_stop(cpu);
-                break;
-            case TIMER_INTR:
-                cpu_openrisc_count_start(cpu);
-                break;
-            case TIMER_SHOT:
-                cpu_openrisc_count_start(cpu);
-                break;
-            case TIMER_CONT:
-                cpu_openrisc_count_start(cpu);
-                break;
-            default:
-                break;
-            }
+            cpu_openrisc_timer_update(cpu);
         }
         break;
 
@@ -162,7 +160,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env,
         if (env->ttmr & TIMER_NONE) {
             return;
         }
-        cpu_openrisc_count_start(cpu);
+        cpu_openrisc_timer_update(cpu);
         break;
     default:
 
commit ae52bd96ceaea36c486d8ffeb798e160f31d3be8
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:40 2013 +0200

    target-openrisc: Correct wrong epcr register in interrupt handler
    
    This patch corrects several misbehaviors during an interrupt process.
    Most of the time the pc is already correct and therefore no special treatment
    of the exceptions is necessary.
    
    Tested by checking crashing programs which otherwise work in or1ksim.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/interrupt.c b/target-openrisc/interrupt.c
index 16ef4b3..2153e7e 100644
--- a/target-openrisc/interrupt.c
+++ b/target-openrisc/interrupt.c
@@ -30,26 +30,15 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
     OpenRISCCPU *cpu = OPENRISC_CPU(cs);
     CPUOpenRISCState *env = &cpu->env;
 #ifndef CONFIG_USER_ONLY
-    if (env->flags & D_FLAG) { /* Delay Slot insn */
+
+    env->epcr = env->pc;
+    if (env->flags & D_FLAG) {
         env->flags &= ~D_FLAG;
         env->sr |= SR_DSX;
-        if (env->exception_index == EXCP_TICK    ||
-            env->exception_index == EXCP_INT     ||
-            env->exception_index == EXCP_SYSCALL ||
-            env->exception_index == EXCP_FPE) {
-            env->epcr = env->jmp_pc;
-        } else {
-            env->epcr = env->pc - 4;
-        }
-    } else {
-        if (env->exception_index == EXCP_TICK    ||
-            env->exception_index == EXCP_INT     ||
-            env->exception_index == EXCP_SYSCALL ||
-            env->exception_index == EXCP_FPE) {
-            env->epcr = env->npc;
-        } else {
-            env->epcr = env->pc;
-        }
+        env->epcr -= 4;
+    }
+    if (env->exception_index == EXCP_SYSCALL) {
+        env->epcr += 4;
     }
 
     /* For machine-state changed between user-mode and supervisor mode,
commit 04359e6bb7f2841031aae645a770583f9c5df3cd
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:39 2013 +0200

    target-openrisc: Remove executable flag for every page
    
    Pages should be flagged executable only if the tlb executable flag is
    set or the mmu is off.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/mmu.c b/target-openrisc/mmu.c
index 22d7cbe..dd487bd 100644
--- a/target-openrisc/mmu.c
+++ b/target-openrisc/mmu.c
@@ -32,7 +32,7 @@ int cpu_openrisc_get_phys_nommu(OpenRISCCPU *cpu,
                                 int *prot, target_ulong address, int rw)
 {
     *physical = address;
-    *prot = PAGE_READ | PAGE_WRITE;
+    *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
     return TLBRET_MATCH;
 }
 
@@ -187,7 +187,7 @@ int cpu_openrisc_handle_mmu_fault(CPUOpenRISCState *env,
 
     if (ret == TLBRET_MATCH) {
         tlb_set_page(env, address & TARGET_PAGE_MASK,
-                     physical & TARGET_PAGE_MASK, prot | PAGE_EXEC,
+                     physical & TARGET_PAGE_MASK, prot,
                      mmu_idx, TARGET_PAGE_SIZE);
         ret = 0;
     } else if (ret < 0) {
commit da1d77597b29f45bfd290d251ee459a2794112c6
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:38 2013 +0200

    target-openrisc: Remove unnecessary code generated by jump instructions
    
    The sr_f variable is only used for the l.bf and l.bnf instructions.
    For clarity the code is also rewritten using a switch statement instead
    of if chaining.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index 8276ce7..91c60eb 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -209,42 +209,49 @@ static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
 static void gen_jump(DisasContext *dc, uint32_t imm, uint32_t reg, uint32_t op0)
 {
     target_ulong tmp_pc;
-    int lab = gen_new_label();
-    TCGv sr_f = tcg_temp_new();
     /* N26, 26bits imm */
     tmp_pc = sign_extend((imm<<2), 26) + dc->pc;
-    tcg_gen_andi_tl(sr_f, cpu_sr, SR_F);
 
-    if (op0 == 0x00) {    /* l.j */
+    switch (op0) {
+    case 0x00:     /* l.j */
         tcg_gen_movi_tl(jmp_pc, tmp_pc);
-    } else if (op0 == 0x01) {    /* l.jal */
+        break;
+    case 0x01:     /* l.jal */
         tcg_gen_movi_tl(cpu_R[9], (dc->pc + 8));
         tcg_gen_movi_tl(jmp_pc, tmp_pc);
-    } else if (op0 == 0x03) {    /* l.bnf */
-        tcg_gen_movi_tl(jmp_pc, dc->pc+8);
-        tcg_gen_brcondi_i32(TCG_COND_EQ, sr_f, SR_F, lab);
-        tcg_gen_movi_tl(jmp_pc, tmp_pc);
-        gen_set_label(lab);
-    } else if (op0 == 0x04) {    /* l.bf */
-        tcg_gen_movi_tl(jmp_pc, dc->pc+8);
-        tcg_gen_brcondi_i32(TCG_COND_NE, sr_f, SR_F, lab);
-        tcg_gen_movi_tl(jmp_pc, tmp_pc);
-        gen_set_label(lab);
-    } else if (op0 == 0x11) {    /* l.jr */
+        break;
+    case 0x03:     /* l.bnf */
+    case 0x04:     /* l.bf  */
+        {
+            int lab = gen_new_label();
+            TCGv sr_f = tcg_temp_new();
+            tcg_gen_movi_tl(jmp_pc, dc->pc+8);
+            tcg_gen_andi_tl(sr_f, cpu_sr, SR_F);
+            tcg_gen_brcondi_i32(op0 == 0x03 ? TCG_COND_EQ : TCG_COND_NE,
+                                sr_f, SR_F, lab);
+            tcg_gen_movi_tl(jmp_pc, tmp_pc);
+            gen_set_label(lab);
+            tcg_temp_free(sr_f);
+        }
+        break;
+    case 0x11:     /* l.jr */
         tcg_gen_mov_tl(jmp_pc, cpu_R[reg]);
-    } else if (op0 == 0x12) {    /* l.jalr */
+        break;
+    case 0x12:     /* l.jalr */
         tcg_gen_movi_tl(cpu_R[9], (dc->pc + 8));
         tcg_gen_mov_tl(jmp_pc, cpu_R[reg]);
-    } else {
+        break;
+    default:
         gen_illegal_exception(dc);
+        break;
     }
 
-    tcg_temp_free(sr_f);
     dc->delayed_branch = 2;
     dc->tb_flags |= D_FLAG;
     gen_sync_flags(dc);
 }
 
+
 static void dec_calc(DisasContext *dc, uint32_t insn)
 {
     uint32_t op0, op1, op2;
commit 352367e8bb53bd4e16abaecbcb9fc0bcadf5881b
Author: Sebastian Macke <sebastian at macke.de>
Date:   Tue Oct 22 02:12:37 2013 +0200

    target-openrisc: Speed up move instruction
    
    The OpenRISC architecture does not have its own move register
    instruction. Instead it uses either "l.addi rd, r0, x" or
    "l.ori rd, rs, 0" or "l.or rd, rx, r0"
    
    The l.ori instruction is automatically optimized but not the l.addi instruction.
    This patch optimizes for this special case.
    
    Signed-off-by: Sebastian Macke <sebastian at macke.de>
    Reviewed-by: Jia Liu <proljc at gmail.com>
    Signed-off-by: Jia Liu <proljc at gmail.com>

diff --git a/target-openrisc/translate.c b/target-openrisc/translate.c
index 8908a2e..8276ce7 100644
--- a/target-openrisc/translate.c
+++ b/target-openrisc/translate.c
@@ -904,29 +904,33 @@ static void dec_misc(DisasContext *dc, uint32_t insn)
     case 0x27:    /* l.addi */
         LOG_DIS("l.addi r%d, r%d, %d\n", rd, ra, I16);
         {
-            int lab = gen_new_label();
-            TCGv_i64 ta = tcg_temp_new_i64();
-            TCGv_i64 td = tcg_temp_local_new_i64();
-            TCGv_i32 res = tcg_temp_local_new_i32();
-            TCGv_i32 sr_ove = tcg_temp_local_new_i32();
-            tcg_gen_extu_i32_i64(ta, cpu_R[ra]);
-            tcg_gen_addi_i64(td, ta, sign_extend(I16, 16));
-            tcg_gen_trunc_i64_i32(res, td);
-            tcg_gen_shri_i64(td, td, 32);
-            tcg_gen_andi_i64(td, td, 0x3);
-            /* Jump to lab when no overflow.  */
-            tcg_gen_brcondi_i64(TCG_COND_EQ, td, 0x0, lab);
-            tcg_gen_brcondi_i64(TCG_COND_EQ, td, 0x3, lab);
-            tcg_gen_ori_i32(cpu_sr, cpu_sr, (SR_OV | SR_CY));
-            tcg_gen_andi_i32(sr_ove, cpu_sr, SR_OVE);
-            tcg_gen_brcondi_i32(TCG_COND_NE, sr_ove, SR_OVE, lab);
-            gen_exception(dc, EXCP_RANGE);
-            gen_set_label(lab);
-            tcg_gen_mov_i32(cpu_R[rd], res);
-            tcg_temp_free_i64(ta);
-            tcg_temp_free_i64(td);
-            tcg_temp_free_i32(res);
-            tcg_temp_free_i32(sr_ove);
+            if (I16 == 0) {
+                tcg_gen_mov_tl(cpu_R[rd], cpu_R[ra]);
+            } else {
+                int lab = gen_new_label();
+                TCGv_i64 ta = tcg_temp_new_i64();
+                TCGv_i64 td = tcg_temp_local_new_i64();
+                TCGv_i32 res = tcg_temp_local_new_i32();
+                TCGv_i32 sr_ove = tcg_temp_local_new_i32();
+                tcg_gen_extu_i32_i64(ta, cpu_R[ra]);
+                tcg_gen_addi_i64(td, ta, sign_extend(I16, 16));
+                tcg_gen_trunc_i64_i32(res, td);
+                tcg_gen_shri_i64(td, td, 32);
+                tcg_gen_andi_i64(td, td, 0x3);
+                /* Jump to lab when no overflow.  */
+                tcg_gen_brcondi_i64(TCG_COND_EQ, td, 0x0, lab);
+                tcg_gen_brcondi_i64(TCG_COND_EQ, td, 0x3, lab);
+                tcg_gen_ori_i32(cpu_sr, cpu_sr, (SR_OV | SR_CY));
+                tcg_gen_andi_i32(sr_ove, cpu_sr, SR_OVE);
+                tcg_gen_brcondi_i32(TCG_COND_NE, sr_ove, SR_OVE, lab);
+                gen_exception(dc, EXCP_RANGE);
+                gen_set_label(lab);
+                tcg_gen_mov_i32(cpu_R[rd], res);
+                tcg_temp_free_i64(ta);
+                tcg_temp_free_i64(td);
+                tcg_temp_free_i32(res);
+                tcg_temp_free_i32(sr_ove);
+            }
         }
         break;
 
commit 8e86729a0e83b557c22808a2337252c969ca3986
Author: Wangting (Kathy) <kathy.wangting at huawei.com>
Date:   Tue Nov 19 05:53:45 2013 +0000

    The calculation of bytes_xfer in qemu_put_buffer() is wrong
    
    In qemu_put_buffer(), bytes_xfer += size is wrong, it will be more
    than expected, and should be bytes_xfer += l.
    
    Signed-off-by: zhangmin <zhangmin6 at huawei.com>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/savevm.c b/savevm.c
index 2f631d4..3f912dd 100644
--- a/savevm.c
+++ b/savevm.c
@@ -794,7 +794,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size)
         if (l > size)
             l = size;
         memcpy(f->buf + f->buf_index, buf, l);
-        f->bytes_xfer += size;
+        f->bytes_xfer += l;
         if (f->ops->writev_buffer) {
             add_to_iovec(f, f->buf + f->buf_index, l);
         }
commit 394cfa39ba24dd838ace1308ae24961243947fb8
Merge: 4ed3479 fc1c4a5
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 13:03:06 2013 -0800

    Merge remote-tracking branch 'quintela/migration.next' into staging
    
    # By Peter Lieven
    # Via Juan Quintela
    * quintela/migration.next:
      migration: drop MADVISE_DONT_NEED for incoming zero pages
    
    Message-id: 1384878412-23521-1-git-send-email-quintela at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 4ed34791696523522fa7e6a00301e0bf3a09ea29
Merge: 1c46e59 2ad645d
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 13:00:52 2013 -0800

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Andreas Färber
    # Via Stefan Hajnoczi
    * stefanha/block:
      qtest: Use -display none by default

commit 1c46e594dc3eb0df4bdc1ea31b61c19ee0eed753
Merge: dc6dc0a 2d3aa28
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 13:00:09 2013 -0800

    Merge remote-tracking branch 'afaerber/tags/qom-devices-for-anthony' into staging
    
    QOM infrastructure fixes for 1.7
    
    * QOM memory leak fix
    
    # gpg: Signature made Tue 19 Nov 2013 01:58:58 AM PST using RSA key ID 3E7E013F
    # gpg: Can't check signature: public key not found
    
    # By Vlad Yasevich
    # Via Andreas Färber
    * afaerber/tags/qom-devices-for-anthony:
      qom: Fix memory leak in object_property_set_link()

commit dc6dc0a9879738236b4da03d34d3c72eedfd25bb
Merge: 4be6693 463230d
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 13:00:02 2013 -0800

    Merge remote-tracking branch 'rth/tcg-ia64-17' into staging
    
    # By Richard Henderson
    # Via Richard Henderson
    * rth/tcg-ia64-17:
      tcg-ia64: Introduce tcg_opc_bswap64_i
      tcg-ia64: Introduce tcg_opc_ext_i
      tcg-ia64: Introduce tcg_opc_movi_a
      tcg-ia64: Introduce tcg_opc_mov_a
      tcg-ia64: Use A3 form of logical operations
      tcg-ia64: Use SUB_A3 and ADDS_A4 for subtraction
      tcg-ia64: Use ADDS for small addition
      tcg-ia64: Avoid unnecessary stop bit in tcg_out_alu
      tcg-ia64: Move AREG0 to R32
      tcg-ia64: Simplify brcond
      tcg-ia64: Handle constant calls
      tcg-ia64: Use shortcuts for nop insns
      tcg-ia64: Use TCGMemOp within qemu_ldst routines
    
    Message-id: 1384811395-7097-1-git-send-email-rth at twiddle.net
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 4be6693a8842023542d1ae1c6e4e2a3fd9988ebe
Merge: 38dc749 420508f
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 12:59:48 2013 -0800

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pc last minute fixes for 1.8
    
    This has a patch that drops an unused FW CFG entry.
    I think it's best to include it before 1.7 to avoid
    the need to maintain it in compat machine types.
    
    There's also a doc bugfix by Amos: I'm guessing
    doc fixes are still fair game even at this late stage.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Mon 18 Nov 2013 03:48:14 AM PST using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By Amos Kong (1) and Igor Mammedov (1)
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      doc: fix hardcoded helper path
      pc: disable pci-info
    
    Message-id: 1384775449-6693-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 38dc74907e2b2ce2249b8b84eae1a1664b122835
Merge: 7af3151 0478f37
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 12:59:26 2013 -0800

    Merge remote-tracking branch 'mjt/trivial-patches' into staging
    
    # By Jan Krupa (4) and others
    # Via Michael Tokarev
    * mjt/trivial-patches:
      hw/i386/Makefile.obj: use $(PYTHON) to run .py scripts consistently
      configure: Use -B switch only for Python versions which support it
      qga: Fix shutdown command of guest agent to work with SysV
      console: Remove unused debug code
      qga: Fix compilation for old versions of MinGW
      .travis.yml: basic compile and check recipes
      pci-assign: Fix error_report of pci-stub message
      qapi: Fix comment for create-type to match code.
      vl: fix build when configured with no graphic support
      usb: drop unused USBNetState.inpkt field
      qemu-char: add missing characters used in keymaps
      qemu-char: add support for U-prefixed symbols
      qemu-char: add Czech keymap file
      qemu-char: add Czech characters to VNC keysyms
    
    Message-id: 1384684850-6777-1-git-send-email-mjt at msgid.tls.msk.ru
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 7af31519e220efc0572cacec5ac65dc54e73985d
Merge: 88a47b9 06d22aa
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 12:59:09 2013 -0800

    Merge remote-tracking branch 'kwolf/tags/for-anthony' into staging
    
    Block fixes for 1.7.0
    
    # gpg: Signature made Fri 15 Nov 2013 09:51:25 AM PST using RSA key ID C88F2FD6
    # gpg: Can't check signature: public key not found
    
    # By Max Reitz (3) and others
    # Via Kevin Wolf
    * kwolf/tags/for-anthony:
      block: Fail if requested driver is not available
      MAINTAINERS: add block driver sub-maintainers
      qemu-img: Fix overwriting 'ret' before using
      qemu-iotests: Test qcow2 count_contiguous_clusters()
      qcow2: fix possible corruption when reading multiple clusters
      qmp: access the local QemuOptsLists for drive option
      MAINTAINERS: add block tree repo URLs
      qemu-iotests: Extend 041 for unbacked mirroring
      block/drive-mirror: Check for NULL backing_hd
      qapi-schema: Update description for NewImageMode
      block: Print its file name if backing file opening failed
    
    Message-id: 1384537999-5972-1-git-send-email-kwolf at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 88a47b9de2c01121e153b1feb24cdb2e033b2f04
Merge: 8c630d5 96e3504
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 12:58:32 2013 -0800

    Merge remote-tracking branch 'stefanha/net' into staging
    
    # By Amos Kong (1) and Sebastian Huber (1)
    # Via Stefan Hajnoczi
    * stefanha/net:
      virtio-net: fix the memory leak in rxfilter_notify()
      smc91c111: Fix receive starvation
    
    Message-id: 1384532032-19057-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 8c630d5150ddedea231a39727e43787e5a3b6690
Merge: 5c5432e 9d0e1da
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Tue Nov 19 12:57:16 2013 -0800

    Merge remote-tracking branch 'agraf/tags/signed-ppc-for-upstream-1.7' into staging
    
    Patch queue for ppc - 2013-11-08
    
    These are two patches that will hopefully make it into 1.7. The SLOF update
    fixes -append kernel command line argument passing into the guest kernel. The
    other patch makes VIO devices appear when using -device '?'.
    
    # gpg: Signature made Thu 07 Nov 2013 07:34:54 PM PST using RSA key ID 03FEDC60
    # gpg: Can't check signature: public key not found
    
    # By Alexey Kardashevskiy
    # Via Alexander Graf
    * agraf/tags/signed-ppc-for-upstream-1.7:
      pseries: Update SLOF firmware image
      spapr: add vio-bus devices to categories
    
    Message-id: 1383881766-13958-1-git-send-email-agraf at suse.de
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit fc1c4a5d32e15a4c40c47945da85ef9c1e0c1b54
Author: Peter Lieven <pl at kamp.de>
Date:   Thu Oct 24 09:21:29 2013 +0200

    migration: drop MADVISE_DONT_NEED for incoming zero pages
    
    The madvise for zeroed out pages was introduced when every transferred
    zero page was memset to zero and thus allocated. Since commit
    211ea740 we check for zeroness of a target page before we memset
    it to zero. Additionally we memmap target memory so it is essentially
    zero initialized (except for e.g. option roms and bios which are loaded
    into target memory although they shouldn't).
    
    It was reported recently that this madvise causes a performance degradation
    in some situations. As the madvise should only be called rarely and if it's called
    it is likely on a busy page (it was non-zero and changed to zero during migration)
    drop it completely.
    
    Reported-By: Zhang Haoyu <haoyu.zhang at huawei.com>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Juan Quintela <quintela at redhat.com>

diff --git a/arch_init.c b/arch_init.c
index 7545d96..e0acbc5 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -850,14 +850,6 @@ void ram_handle_compressed(void *host, uint8_t ch, uint64_t size)
 {
     if (ch != 0 || !is_zero_range(host, size)) {
         memset(host, ch, size);
-#ifndef _WIN32
-        if (ch == 0 && (!kvm_enabled() || kvm_has_sync_mmu())) {
-            size = size & ~(getpagesize() - 1);
-            if (size > 0) {
-                qemu_madvise(host, size, QEMU_MADV_DONTNEED);
-            }
-        }
-#endif
     }
 }
 
commit 2d3aa28cc2cf382aa04cd577e0be542175eea9bd
Author: Vlad Yasevich <vyasevic at redhat.com>
Date:   Fri Nov 15 12:09:47 2013 -0500

    qom: Fix memory leak in object_property_set_link()
    
    Save the result of the call to object_get_canonical_path()
    so we can free it.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Vlad Yasevich <vyasevic at redhat.com>
    Reviewed-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Andreas Färber <afaerber at suse.de>

diff --git a/qom/object.c b/qom/object.c
index b617f26..fc19cf6 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -838,8 +838,9 @@ char *object_property_get_str(Object *obj, const char *name,
 void object_property_set_link(Object *obj, Object *value,
                               const char *name, Error **errp)
 {
-    object_property_set_str(obj, object_get_canonical_path(value),
-                            name, errp);
+    gchar *path = object_get_canonical_path(value);
+    object_property_set_str(obj, path, name, errp);
+    g_free(path);
 }
 
 Object *object_property_get_link(Object *obj, const char *name,
commit 2ad645d2854746b55ddfd1d8e951f689cca5d78f
Author: Andreas Färber <afaerber at suse.de>
Date:   Mon Nov 18 17:36:34 2013 +0100

    qtest: Use -display none by default
    
    This avoids each test needing to add it to suppress windows popping up.
    
    [Commit 7ceeedd016facf8d58e14a0d1417fa7225d71072 ("blockdev-test: add
    test case for drive_add duplicate IDs") and commit
    43cd209803d6cffb1e1a028c9ff2fd0ff4fce954 ("qdev-monitor-test: add
    device_add leak test cases") added qtest tests without specifying
    -display none.
    
    As a result, "make check" now tries to use graphics (GTK or SDL).  Since
    graphics are not used by the test and inappropriate for headless "make
    check" runs, add the missing -display none.
    
    This fixes "make check" in the QEMU buildbot.
    -- Stefan]
    
    Signed-off-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index da158c3..360a691 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -34,7 +34,7 @@ static void test_a_boot_order(const char *machine,
     char *args;
     uint64_t actual;
 
-    args = g_strdup_printf("-nodefaults -display none%s%s %s",
+    args = g_strdup_printf("-nodefaults%s%s %s",
                            machine ? " -M " : "",
                            machine ?: "",
                            test_args);
diff --git a/tests/endianness-test.c b/tests/endianness-test.c
index 8719c09..646df7d 100644
--- a/tests/endianness-test.c
+++ b/tests/endianness-test.c
@@ -121,7 +121,7 @@ static void test_endianness(gconstpointer data)
     const TestCase *test = data;
     char *args;
 
-    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+    args = g_strdup_printf("-M %s%s%s -device pc-testdev",
                            test->machine,
                            test->superio ? " -device " : "",
                            test->superio ?: "");
@@ -196,7 +196,7 @@ static void test_endianness_split(gconstpointer data)
     const TestCase *test = data;
     char *args;
 
-    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+    args = g_strdup_printf("-M %s%s%s -device pc-testdev",
                            test->machine,
                            test->superio ? " -device " : "",
                            test->superio ?: "");
@@ -243,7 +243,7 @@ static void test_endianness_combine(gconstpointer data)
     const TestCase *test = data;
     char *args;
 
-    args = g_strdup_printf("-display none -M %s%s%s -device pc-testdev",
+    args = g_strdup_printf("-M %s%s%s -device pc-testdev",
                            test->machine,
                            test->superio ? " -device " : "",
                            test->superio ?: "");
diff --git a/tests/fw_cfg-test.c b/tests/fw_cfg-test.c
index b86e49a..e4f355c 100644
--- a/tests/fw_cfg-test.c
+++ b/tests/fw_cfg-test.c
@@ -126,8 +126,7 @@ int main(int argc, char **argv)
     g_test_add_func("/fw_cfg/numa", test_fw_cfg_numa);
     g_test_add_func("/fw_cfg/boot_menu", test_fw_cfg_boot_menu);
 
-    cmdline = g_strdup_printf("-display none "
-                              "-uuid 4600cb32-38ec-4b2f-8acb-81c6ea54f2d8 ");
+    cmdline = g_strdup_printf("-uuid 4600cb32-38ec-4b2f-8acb-81c6ea54f2d8 ");
     s = qtest_start(cmdline);
     g_free(cmdline);
 
diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c
index b72042e..c84d1e7 100644
--- a/tests/hd-geo-test.c
+++ b/tests/hd-geo-test.c
@@ -171,7 +171,7 @@ static int setup_common(char *argv[], int argv_sz)
 {
     memset(cur_ide, 0, sizeof(cur_ide));
     return append_arg(0, argv, argv_sz,
-                      g_strdup("-nodefaults -display none"));
+                      g_strdup("-nodefaults"));
 }
 
 static void setup_mbr(int img_idx, MBRcontents mbr)
diff --git a/tests/i440fx-test.c b/tests/i440fx-test.c
index 08ce820..65c786c 100644
--- a/tests/i440fx-test.c
+++ b/tests/i440fx-test.c
@@ -265,7 +265,7 @@ int main(int argc, char **argv)
 
     data.num_cpus = 1;
 
-    cmdline = g_strdup_printf("-display none -smp %d", data.num_cpus);
+    cmdline = g_strdup_printf("-smp %d", data.num_cpus);
     s = qtest_start(cmdline);
     g_free(cmdline);
 
diff --git a/tests/libqtest.c b/tests/libqtest.c
index 83424c3..359d571 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -135,6 +135,7 @@ QTestState *qtest_init(const char *extra_args)
                                   "-qmp unix:%s,nowait "
                                   "-pidfile %s "
                                   "-machine accel=qtest "
+                                  "-display none "
                                   "%s", qemu_binary, s->socket_path,
                                   s->qmp_socket_path, pid_file,
                                   extra_args ?: "");
diff --git a/tests/m48t59-test.c b/tests/m48t59-test.c
index 4081a5f..6abc4c8 100644
--- a/tests/m48t59-test.c
+++ b/tests/m48t59-test.c
@@ -249,7 +249,7 @@ int main(int argc, char **argv)
 
     g_test_init(&argc, &argv, NULL);
 
-    s = qtest_start("-display none -rtc clock=vm");
+    s = qtest_start("-rtc clock=vm");
 
     qtest_add_func("/rtc/bcd/check-time", bcd_check_time);
     qtest_add_func("/rtc/fuzz-registers", fuzz_registers);
diff --git a/tests/qom-test.c b/tests/qom-test.c
index 6ed23c5..499be40 100644
--- a/tests/qom-test.c
+++ b/tests/qom-test.c
@@ -18,7 +18,7 @@ static void test_nop(gconstpointer data)
     const char *machine = data;
     char *args;
 
-    args = g_strdup_printf("-display none -machine %s", machine);
+    args = g_strdup_printf("-machine %s", machine);
     s = qtest_start(args);
     if (s) {
         qtest_quit(s);
diff --git a/tests/rtc-test.c b/tests/rtc-test.c
index 3395d7f..f1b123f 100644
--- a/tests/rtc-test.c
+++ b/tests/rtc-test.c
@@ -552,7 +552,7 @@ int main(int argc, char **argv)
 
     g_test_init(&argc, &argv, NULL);
 
-    s = qtest_start("-display none -rtc clock=vm");
+    s = qtest_start("-rtc clock=vm");
     qtest_irq_intercept_in(s, "ioapic");
 
     qtest_add_func("/rtc/check-time/bcd", bcd_check_time);
diff --git a/tests/tmp105-test.c b/tests/tmp105-test.c
index fecd6dc..5ac48e2 100644
--- a/tests/tmp105-test.c
+++ b/tests/tmp105-test.c
@@ -59,7 +59,7 @@ int main(int argc, char **argv)
 
     g_test_init(&argc, &argv, NULL);
 
-    s = qtest_start("-display none -machine n800");
+    s = qtest_start("-machine n800");
     i2c = omap_i2c_create(OMAP2_I2C_1_BASE);
     addr = N8X0_ADDR;
 
commit 96e35046e4a97df5b4e1e24e217eb1e1701c7c71
Author: Amos Kong <akong at redhat.com>
Date:   Mon Nov 18 23:32:17 2013 +0800

    virtio-net: fix the memory leak in rxfilter_notify()
    
    object_get_canonical_path() returns a gchar*, it should be freed by the
    caller.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Vlad Yasevich <vyasevic at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 613f144..b75c753 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -200,16 +200,16 @@ static void rxfilter_notify(NetClientState *nc)
     VirtIONet *n = qemu_get_nic_opaque(nc);
 
     if (nc->rxfilter_notify_enabled) {
+        gchar *path = object_get_canonical_path(OBJECT(n->qdev));
         if (n->netclient_name) {
             event_data = qobject_from_jsonf("{ 'name': %s, 'path': %s }",
-                                    n->netclient_name,
-                                    object_get_canonical_path(OBJECT(n->qdev)));
+                                    n->netclient_name, path);
         } else {
-            event_data = qobject_from_jsonf("{ 'path': %s }",
-                                    object_get_canonical_path(OBJECT(n->qdev)));
+            event_data = qobject_from_jsonf("{ 'path': %s }", path);
         }
         monitor_protocol_event(QEVENT_NIC_RX_FILTER_CHANGED, event_data);
         qobject_decref(event_data);
+        g_free(path);
 
         /* disable event notification to avoid events flooding */
         nc->rxfilter_notify_enabled = 0;
commit 420508fbba2a6e8eaff008715b5f7eff83f8e865
Author: Amos Kong <akong at redhat.com>
Date:   Wed Oct 23 04:49:28 2013 +0800

    doc: fix hardcoded helper path
    
    The install directory of qemu-bridge-helper is configurable,
    but we use a fixed path in the documentation.
    
    DEFAULT_BRIDGE_HELPER macro isn't available in texi mode,
    we should always use "/path/to/" prefix for dynamic paths
    (e.g.: /path/to/image, /path/to/linux, etc).
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/qemu-options.hx b/qemu-options.hx
index 5dc8b75..8b94264 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1605,7 +1605,7 @@ to disable script execution.
 
 If running QEMU as an unprivileged user, use the network helper
 @var{helper} to configure the TAP interface. The default network
-helper executable is @file{/usr/local/libexec/qemu-bridge-helper}.
+helper executable is @file{/path/to/qemu-bridge-helper}.
 
 @option{fd}=@var{h} can be used to specify the handle of an already
 opened host TAP interface.
@@ -1629,7 +1629,7 @@ qemu-system-i386 linux.img \
 #launch a QEMU instance with the default network helper to
 #connect a TAP device to bridge br0
 qemu-system-i386 linux.img \
-                 -net nic -net tap,"helper=/usr/local/libexec/qemu-bridge-helper"
+                 -net nic -net tap,"helper=/path/to/qemu-bridge-helper"
 @end example
 
 @item -netdev bridge,id=@var{id}[,br=@var{bridge}][,helper=@var{helper}]
@@ -1638,7 +1638,7 @@ Connect a host TAP network interface to a host bridge device.
 
 Use the network helper @var{helper} to configure the TAP interface and
 attach it to the bridge. The default network helper executable is
- at file{/usr/local/libexec/qemu-bridge-helper} and the default bridge
+ at file{/path/to/qemu-bridge-helper} and the default bridge
 device is @file{br0}.
 
 Examples:
commit 463230d85e1e0898b1a94092af65026e615e6ec6
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 19:20:40 2013 -0400

    tcg-ia64: Introduce tcg_opc_bswap64_i
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 8168519..2d8e00c 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1400,12 +1400,17 @@ static inline void tcg_out_ext(TCGContext *s, uint64_t opc_i29,
                    tcg_opc_i29(TCG_REG_P0, opc_i29, ret, arg));
 }
 
+static inline uint64_t tcg_opc_bswap64_i(int qp, TCGReg d, TCGReg s)
+{
+    return tcg_opc_i3(qp, OPC_MUX1_I3, d, s, 0xb);
+}
+
 static inline void tcg_out_bswap16(TCGContext *s, TCGArg ret, TCGArg arg)
 {
     tcg_out_bundle(s, mII,
                    INSN_NOP_M,
                    tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret, arg, 15, 15),
-                   tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, ret, 0xb));
+                   tcg_opc_bswap64_i(TCG_REG_P0, ret, ret));
 }
 
 static inline void tcg_out_bswap32(TCGContext *s, TCGArg ret, TCGArg arg)
@@ -1413,7 +1418,7 @@ static inline void tcg_out_bswap32(TCGContext *s, TCGArg ret, TCGArg arg)
     tcg_out_bundle(s, mII,
                    INSN_NOP_M,
                    tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret, arg, 31, 31),
-                   tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, ret, 0xb));
+                   tcg_opc_bswap64_i(TCG_REG_P0, ret, ret));
 }
 
 static inline void tcg_out_bswap64(TCGContext *s, TCGArg ret, TCGArg arg)
@@ -1421,7 +1426,7 @@ static inline void tcg_out_bswap64(TCGContext *s, TCGArg ret, TCGArg arg)
     tcg_out_bundle(s, miI,
                    INSN_NOP_M,
                    INSN_NOP_I,
-                   tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, arg, 0xb));
+                   tcg_opc_bswap64_i(TCG_REG_P0, ret, arg));
 }
 
 static inline void tcg_out_deposit(TCGContext *s, TCGArg ret, TCGArg a1,
@@ -1659,8 +1664,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
     } else {
         tcg_out_bundle(s, miB,
                        tcg_opc_movi_a(TCG_REG_P7, TCG_REG_R58, mem_index),
-                       tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
-                                   TCG_REG_R8, TCG_REG_R8, 0xb),
+                       tcg_opc_bswap64_i(TCG_REG_P6, TCG_REG_R8, TCG_REG_R8),
                        tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
                                    TCG_REG_B0, TCG_REG_B6));
     }
@@ -1734,8 +1738,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        INSN_NOP_I,
-                       tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
-                                   TCG_REG_R2, TCG_REG_R2, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P6, TCG_REG_R2, TCG_REG_R2));
         data_reg = TCG_REG_R2;
         break;
 
@@ -1749,8 +1752,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        INSN_NOP_I,
-                       tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
-                                   TCG_REG_R2, TCG_REG_R2, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P6, TCG_REG_R2, TCG_REG_R2));
         data_reg = TCG_REG_R2;
         break;
 
@@ -1759,8 +1761,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
                        tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
-                       tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
-                                   TCG_REG_R2, data_reg, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P6, TCG_REG_R2, data_reg));
         data_reg = TCG_REG_R2;
         break;
 
@@ -1827,8 +1828,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
                            INSN_NOP_I,
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       data_reg, data_reg, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg));
     } else {
         if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
@@ -1849,13 +1849,11 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
             tcg_out_bundle(s, miI,
                            INSN_NOP_M,
                            INSN_NOP_I,
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       data_reg, data_reg, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg));
         } else {
             tcg_out_bundle(s, mII,
                            INSN_NOP_M,
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       data_reg, data_reg, 0xb),
+                           tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg),
                            tcg_opc_ext_i(TCG_REG_P0, opc, data_reg, data_reg));
         }
     }
@@ -1880,21 +1878,18 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                        INSN_NOP_M,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 15, 15),
-                       tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                   data_reg, data_reg, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg));
     } else if (bswap && s_bits == MO_32) {
         tcg_out_bundle(s, mII,
                        INSN_NOP_M,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 31, 31),
-                       tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                   data_reg, data_reg, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg));
     } else if (bswap && s_bits == MO_64) {
         tcg_out_bundle(s, miI,
                        INSN_NOP_M,
                        INSN_NOP_I,
-                       tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                   data_reg, data_reg, 0xb));
+                       tcg_opc_bswap64_i(TCG_REG_P0, data_reg, data_reg));
     }
     if (opc & MO_SIGN) {
         tcg_out_bundle(s, miI,
@@ -1944,23 +1939,22 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                            INSN_NOP_M,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 15, 15),
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, TCG_REG_R3, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0,
+                                             TCG_REG_R3, TCG_REG_R3));
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_32) {
             tcg_out_bundle(s, mII,
                            INSN_NOP_M,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 31, 31),
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, TCG_REG_R3, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0,
+                                             TCG_REG_R3, TCG_REG_R3));
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
                            INSN_NOP_M,
                            INSN_NOP_I,
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, data_reg, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0, TCG_REG_R3, data_reg));
             data_reg = TCG_REG_R3;
         }
     }
@@ -1990,23 +1984,22 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                            add_guest_base,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 15, 15),
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, TCG_REG_R3, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0,
+                                             TCG_REG_R3, TCG_REG_R3));
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_32) {
             tcg_out_bundle(s, mII,
                            add_guest_base,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 31, 31),
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, TCG_REG_R3, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0,
+                                             TCG_REG_R3, TCG_REG_R3));
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
                            add_guest_base,
                            INSN_NOP_I,
-                           tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
-                                       TCG_REG_R3, data_reg, 0xb));
+                           tcg_opc_bswap64_i(TCG_REG_P0, TCG_REG_R3, data_reg));
             data_reg = TCG_REG_R3;
         }
         tcg_out_bundle(s, miI,
commit db008a8de2c5ea1325d6db455fa5a0a4bca66735
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 19:13:41 2013 -0400

    tcg-ia64: Introduce tcg_opc_ext_i
    
    Being able to "extend" from 64-bits (with a mov) simplifies
    a few places where the conditional breaks the train of thought.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index afcb1ad..8168519 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1377,6 +1377,20 @@ static inline void tcg_out_rotr_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
     }
 }
 
+static const uint64_t opc_ext_i29[8] = {
+    OPC_ZXT1_I29, OPC_ZXT2_I29, OPC_ZXT4_I29, 0,
+    OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0
+};
+
+static inline uint64_t tcg_opc_ext_i(int qp, TCGMemOp opc, TCGReg d, TCGReg s)
+{
+    if ((opc & MO_SIZE) == MO_64) {
+        return tcg_opc_mov_a(qp, d, s);
+    } else {
+        return tcg_opc_i29(qp, opc_ext_i29[opc & MO_SSIZE], d, s);
+    }
+}
+
 static inline void tcg_out_ext(TCGContext *s, uint64_t opc_i29,
                                TCGArg ret, TCGArg arg)
 {
@@ -1556,11 +1570,9 @@ static inline void tcg_out_qemu_tlb(TCGContext *s, TCGArg addr_reg,
     tcg_out_bundle(s, mII,
                    tcg_opc_a5 (TCG_REG_P0, OPC_ADDL_A5, TCG_REG_R2,
                                offset_rw, TCG_REG_R2),
-#if TARGET_LONG_BITS == 32
-                   tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29, TCG_REG_R57, addr_reg),
-#else
-                   tcg_opc_mov_a(TCG_REG_P0, TCG_REG_R57, addr_reg),
-#endif
+                   tcg_opc_ext_i(TCG_REG_P0,
+                                 TARGET_LONG_BITS == 32 ? MO_UL : MO_Q,
+                                 TCG_REG_R57, addr_reg),
                    tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1, TCG_REG_R2,
                                TCG_REG_R2, TCG_AREG0));
     tcg_out_bundle(s, mII,
@@ -1590,10 +1602,6 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
     static const uint64_t opc_ld_m1[4] = {
         OPC_LD1_M1, OPC_LD2_M1, OPC_LD4_M1, OPC_LD8_M1
     };
-    static const uint64_t opc_ext_i29[8] = {
-        OPC_ZXT1_I29, OPC_ZXT2_I29, OPC_ZXT4_I29, 0,
-        OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0
-    };
     int addr_reg, data_reg, mem_index;
     TCGMemOp s_bits, bswap;
 
@@ -1657,18 +1665,10 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                                    TCG_REG_B0, TCG_REG_B6));
     }
 
-    if (s_bits == MO_64) {
-        tcg_out_bundle(s, miI,
-                       INSN_NOP_M,
-                       INSN_NOP_I,
-                       tcg_opc_mov_a(TCG_REG_P0, data_reg, TCG_REG_R8));
-    } else {
-        tcg_out_bundle(s, miI,
-                       INSN_NOP_M,
-                       INSN_NOP_I,
-                       tcg_opc_i29(TCG_REG_P0, opc_ext_i29[opc & MO_SSIZE],
-                                   data_reg, TCG_REG_R8));
-    }
+    tcg_out_bundle(s, miI,
+                   INSN_NOP_M,
+                   INSN_NOP_I,
+                   tcg_opc_ext_i(TCG_REG_P0, opc, data_reg, TCG_REG_R8));
 }
 
 /* helper signature: helper_st_mmu(CPUState *env, target_ulong addr,
@@ -1784,9 +1784,6 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
     static uint64_t const opc_ld_m1[4] = {
         OPC_LD1_M1, OPC_LD2_M1, OPC_LD4_M1, OPC_LD8_M1
     };
-    static uint64_t const opc_sxt_i29[4] = {
-        OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0
-    };
     int addr_reg, data_reg;
     TCGMemOp s_bits, bswap;
 
@@ -1823,8 +1820,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
                            INSN_NOP_I,
-                           tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
-                                       data_reg, data_reg));
+                           tcg_opc_ext_i(TCG_REG_P0, opc, data_reg, data_reg));
         }
     } else if (s_bits == MO_64) {
             tcg_out_bundle(s, mII,
@@ -1860,8 +1856,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                            INSN_NOP_M,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        data_reg, data_reg, 0xb),
-                           tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
-                                       data_reg, data_reg));
+                           tcg_opc_ext_i(TCG_REG_P0, opc, data_reg, data_reg));
         }
     }
 #else
@@ -1905,8 +1900,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        INSN_NOP_M,
                        INSN_NOP_I,
-                       tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
-                                   data_reg, data_reg));
+                       tcg_opc_ext_i(TCG_REG_P0, opc, data_reg, data_reg));
     }
 #endif
 }
commit fa0cdb6c2a574774376b33c5fb0907e93403c188
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 18:56:39 2013 -0400

    tcg-ia64: Introduce tcg_opc_movi_a
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 2f630f4..afcb1ad 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -881,6 +881,12 @@ static inline void tcg_out_mov(TCGContext *s, TCGType type,
                    tcg_opc_mov_a(TCG_REG_P0, ret, arg));
 }
 
+static inline uint64_t tcg_opc_movi_a(int qp, TCGReg dst, int64_t src)
+{
+    assert(src == sextract64(src, 0, 22));
+    return tcg_opc_a5(qp, OPC_ADDL_A5, dst, src, TCG_REG_R0);
+}
+
 static inline void tcg_out_movi(TCGContext *s, TCGType type,
                                 TCGReg reg, tcg_target_long arg)
 {
@@ -1058,16 +1064,14 @@ static inline void tcg_out_alu(TCGContext *s, uint64_t opc_a1, uint64_t opc_a3,
     uint64_t opc1 = 0, opc2 = 0, opc3 = 0;
 
     if (const_arg2 && arg2 != 0) {
-        opc2 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
-                          TCG_REG_R3, arg2, TCG_REG_R0);
+        opc2 = tcg_opc_movi_a(TCG_REG_P0, TCG_REG_R3, arg2);
         arg2 = TCG_REG_R3;
     }
     if (const_arg1 && arg1 != 0) {
         if (opc_a3 && arg1 == (int8_t)arg1) {
             opc3 = tcg_opc_a3(TCG_REG_P0, opc_a3, ret, arg1, arg2);
         } else {
-            opc1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
-                              TCG_REG_R2, arg1, TCG_REG_R0);
+            opc1 = tcg_opc_movi_a(TCG_REG_P0, TCG_REG_R2, arg1);
             arg1 = TCG_REG_R2;
         }
     }
@@ -1423,8 +1427,7 @@ static inline void tcg_out_deposit(TCGContext *s, TCGArg ret, TCGArg a1,
         } else {
             /* Otherwise, load any constant into a temporary.  Do this into
                the first I slot to help out with cross-unit delays.  */
-            i1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
-                            TCG_REG_R2, a2, TCG_REG_R0);
+            i1 = tcg_opc_movi_a(TCG_REG_P0, TCG_REG_R2, a2);
             a2 = TCG_REG_R2;
         }
     }
@@ -1503,8 +1506,8 @@ static inline void tcg_out_setcond(TCGContext *s, TCGCond cond, TCGArg ret,
 {
     tcg_out_bundle(s, MmI,
                    tcg_opc_cmp_a(TCG_REG_P0, cond, arg1, arg2, cmp4),
-                   tcg_opc_a5(TCG_REG_P6, OPC_ADDL_A5, ret, 1, TCG_REG_R0),
-                   tcg_opc_a5(TCG_REG_P7, OPC_ADDL_A5, ret, 0, TCG_REG_R0));
+                   tcg_opc_movi_a(TCG_REG_P6, ret, 1),
+                   tcg_opc_movi_a(TCG_REG_P7, ret, 0));
 }
 
 static inline void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGArg ret,
@@ -1515,14 +1518,14 @@ static inline void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGArg ret,
     uint64_t opc1, opc2;
 
     if (const_v1) {
-        opc1 = tcg_opc_a5(TCG_REG_P6, OPC_ADDL_A5, ret, v1, TCG_REG_R0);
+        opc1 = tcg_opc_movi_a(TCG_REG_P6, ret, v1);
     } else if (ret == v1) {
         opc1 = INSN_NOP_M;
     } else {
         opc1 = tcg_opc_mov_a(TCG_REG_P6, ret, v1);
     }
     if (const_v2) {
-        opc2 = tcg_opc_a5(TCG_REG_P7, OPC_ADDL_A5, ret, v2, TCG_REG_R0);
+        opc2 = tcg_opc_movi_a(TCG_REG_P7, ret, v2);
     } else if (ret == v2) {
         opc2 = INSN_NOP_I;
     } else {
@@ -1641,15 +1644,13 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
     }
     if (!bswap) {
         tcg_out_bundle(s, miB,
-                       tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
-                                   mem_index, TCG_REG_R0),
+                       tcg_opc_movi_a(TCG_REG_P7, TCG_REG_R58, mem_index),
                        INSN_NOP_I,
                        tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
                                    TCG_REG_B0, TCG_REG_B6));
     } else {
         tcg_out_bundle(s, miB,
-                       tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
-                                   mem_index, TCG_REG_R0),
+                       tcg_opc_movi_a(TCG_REG_P7, TCG_REG_R58, mem_index),
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R8, TCG_REG_R8, 0xb),
                        tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
@@ -1770,8 +1771,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
     tcg_out_bundle(s, miB,
                    tcg_opc_m4 (TCG_REG_P6, opc_st_m4[s_bits],
                                data_reg, TCG_REG_R3),
-                   tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R59,
-                               mem_index, TCG_REG_R0),
+                   tcg_opc_movi_a(TCG_REG_P7, TCG_REG_R59, mem_index),
                    tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
                                TCG_REG_B0, TCG_REG_B6));
 }
commit 3b9ccdcc74e06a3e7e10d012679583c2ee30d7fa
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 18:48:42 2013 -0400

    tcg-ia64: Introduce tcg_opc_mov_a
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 322955b..2f630f4 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -867,13 +867,18 @@ static inline void tcg_out_bundle(TCGContext *s, int template,
     s->code_ptr += 16;
 }
 
+static inline uint64_t tcg_opc_mov_a(int qp, TCGReg dst, TCGReg src)
+{
+    return tcg_opc_a4(qp, OPC_ADDS_A4, dst, 0, src);
+}
+
 static inline void tcg_out_mov(TCGContext *s, TCGType type,
                                TCGReg ret, TCGReg arg)
 {
     tcg_out_bundle(s, mmI,
                    INSN_NOP_M,
                    INSN_NOP_M,
-                   tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, 0, arg));
+                   tcg_opc_mov_a(TCG_REG_P0, ret, arg));
 }
 
 static inline void tcg_out_movi(TCGContext *s, TCGType type,
@@ -1514,14 +1519,14 @@ static inline void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGArg ret,
     } else if (ret == v1) {
         opc1 = INSN_NOP_M;
     } else {
-        opc1 = tcg_opc_a4(TCG_REG_P6, OPC_ADDS_A4, ret, 0, v1);
+        opc1 = tcg_opc_mov_a(TCG_REG_P6, ret, v1);
     }
     if (const_v2) {
         opc2 = tcg_opc_a5(TCG_REG_P7, OPC_ADDL_A5, ret, v2, TCG_REG_R0);
     } else if (ret == v2) {
         opc2 = INSN_NOP_I;
     } else {
-        opc2 = tcg_opc_a4(TCG_REG_P7, OPC_ADDS_A4, ret, 0, v2);
+        opc2 = tcg_opc_mov_a(TCG_REG_P7, ret, v2);
     }
 
     tcg_out_bundle(s, MmI,
@@ -1551,8 +1556,7 @@ static inline void tcg_out_qemu_tlb(TCGContext *s, TCGArg addr_reg,
 #if TARGET_LONG_BITS == 32
                    tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29, TCG_REG_R57, addr_reg),
 #else
-                   tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, TCG_REG_R57,
-                              0, addr_reg),
+                   tcg_opc_mov_a(TCG_REG_P0, TCG_REG_R57, addr_reg),
 #endif
                    tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1, TCG_REG_R2,
                                TCG_REG_R2, TCG_AREG0));
@@ -1603,8 +1607,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
 
     /* P6 is the fast path, and P7 the slow path */
     tcg_out_bundle(s, mLX,
-                   tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4,
-                               TCG_REG_R56, 0, TCG_AREG0),
+                   tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R56, TCG_AREG0),
                    tcg_opc_l2 ((tcg_target_long) qemu_ld_helpers[s_bits]),
                    tcg_opc_x2 (TCG_REG_P7, OPC_MOVL_X2, TCG_REG_R2,
                                (tcg_target_long) qemu_ld_helpers[s_bits]));
@@ -1657,8 +1660,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        INSN_NOP_M,
                        INSN_NOP_I,
-                       tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
-                                   data_reg, 0, TCG_REG_R8));
+                       tcg_opc_mov_a(TCG_REG_P0, data_reg, TCG_REG_R8));
     } else {
         tcg_out_bundle(s, miI,
                        INSN_NOP_M,
@@ -1697,8 +1699,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
 
     /* P6 is the fast path, and P7 the slow path */
     tcg_out_bundle(s, mLX,
-                   tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4,
-                               TCG_REG_R56, 0, TCG_AREG0),
+                   tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R56, TCG_AREG0),
                    tcg_opc_l2 ((tcg_target_long) qemu_st_helpers[s_bits]),
                    tcg_opc_x2 (TCG_REG_P7, OPC_MOVL_X2, TCG_REG_R2,
                                (tcg_target_long) qemu_st_helpers[s_bits]));
@@ -1718,8 +1719,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, mii,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
-                       tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
-                                   0, data_reg),
+                       tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        INSN_NOP_I);
         break;
 
@@ -1731,8 +1731,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                        tcg_opc_i12(TCG_REG_P6, OPC_DEP_Z_I12,
                                    TCG_REG_R2, data_reg, 15, 15));
         tcg_out_bundle(s, miI,
-                       tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
-                                   0, data_reg),
+                       tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        INSN_NOP_I,
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
@@ -1747,8 +1746,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                        tcg_opc_i12(TCG_REG_P6, OPC_DEP_Z_I12,
                                    TCG_REG_R2, data_reg, 31, 31));
         tcg_out_bundle(s, miI,
-                       tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
-                                   0, data_reg),
+                       tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        INSN_NOP_I,
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
@@ -1759,8 +1757,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
-                       tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
-                                   0, data_reg),
+                       tcg_opc_mov_a(TCG_REG_P7, TCG_REG_R58, data_reg),
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, data_reg, 0xb));
         data_reg = TCG_REG_R2;
commit 25c9c73bdc9029407da3b286ab0d1d694c851b3e
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 17:13:43 2013 -0400

    tcg-ia64: Use A3 form of logical operations
    
    We can and/or/xor/andcm small constants, saving one cycle.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 54232eb..322955b 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -263,6 +263,7 @@ enum {
     OPC_MOV_I_I26             = 0x00150000000ull,
     OPC_MOVL_X2               = 0x0c000000000ull,
     OPC_OR_A1                 = 0x10070000000ull,
+    OPC_OR_A3                 = 0x10170000000ull,
     OPC_SETF_EXP_M18          = 0x0c748000000ull,
     OPC_SETF_SIG_M18          = 0x0c708000000ull,
     OPC_SHL_I7                = 0x0f240000000ull,
@@ -281,6 +282,7 @@ enum {
     OPC_UNPACK4_L_I2          = 0x0f860000000ull,
     OPC_XMA_L_F2              = 0x1d000000000ull,
     OPC_XOR_A1                = 0x10078000000ull,
+    OPC_XOR_A3                = 0x10178000000ull,
     OPC_ZXT1_I29              = 0x00080000000ull,
     OPC_ZXT2_I29              = 0x00088000000ull,
     OPC_ZXT4_I29              = 0x00090000000ull,
@@ -1044,27 +1046,34 @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
     }
 }
 
-static void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGReg ret, TCGArg arg1,
-                        int const_arg1, TCGArg arg2, int const_arg2)
+static inline void tcg_out_alu(TCGContext *s, uint64_t opc_a1, uint64_t opc_a3,
+                               TCGReg ret, TCGArg arg1, int const_arg1,
+                               TCGArg arg2, int const_arg2)
 {
-    uint64_t opc1 = 0, opc2 = 0;
-
-    if (const_arg1 && arg1 != 0) {
-        opc1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
-                          TCG_REG_R2, arg1, TCG_REG_R0);
-        arg1 = TCG_REG_R2;
-    }
+    uint64_t opc1 = 0, opc2 = 0, opc3 = 0;
 
     if (const_arg2 && arg2 != 0) {
         opc2 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
                           TCG_REG_R3, arg2, TCG_REG_R0);
         arg2 = TCG_REG_R3;
     }
+    if (const_arg1 && arg1 != 0) {
+        if (opc_a3 && arg1 == (int8_t)arg1) {
+            opc3 = tcg_opc_a3(TCG_REG_P0, opc_a3, ret, arg1, arg2);
+        } else {
+            opc1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
+                              TCG_REG_R2, arg1, TCG_REG_R0);
+            arg1 = TCG_REG_R2;
+        }
+    }
+    if (opc3 == 0) {
+        opc3 = tcg_opc_a1(TCG_REG_P0, opc_a1, ret, arg1, arg2);
+    }
 
     tcg_out_bundle(s, (opc1 || opc2 ? mII : miI),
                    opc1 ? opc1 : INSN_NOP_M,
                    opc2 ? opc2 : INSN_NOP_I,
-                   tcg_opc_a1(TCG_REG_P0, opc_a1, ret, arg1, arg2));
+                   opc3);
 }
 
 static inline void tcg_out_add(TCGContext *s, TCGReg ret, TCGReg arg1,
@@ -1076,29 +1085,21 @@ static inline void tcg_out_add(TCGContext *s, TCGReg ret, TCGReg arg1,
                        INSN_NOP_M,
                        tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, arg2, arg1));
     } else {
-        tcg_out_alu(s, OPC_ADD_A1, ret, arg1, 0, arg2, const_arg2);
+        tcg_out_alu(s, OPC_ADD_A1, 0, ret, arg1, 0, arg2, const_arg2);
     }
 }
 
 static inline void tcg_out_sub(TCGContext *s, TCGReg ret, TCGArg arg1,
                                int const_arg1, TCGArg arg2, int const_arg2)
 {
-    if (const_arg1 && arg1 == (int8_t)arg1) {
-        if (const_arg2) {
-            tcg_out_movi(s, TCG_TYPE_I64, ret, arg1 - arg2);
-            return;
-        }
-        tcg_out_bundle(s, mmI,
-                       INSN_NOP_M,
-                       INSN_NOP_M,
-                       tcg_opc_a3(TCG_REG_P0, OPC_SUB_A3, ret, arg1, arg2));
-    } else if (const_arg2 && -arg2 == sextract64(-arg2, 0, 14)) {
+    if (!const_arg1 && const_arg2 && -arg2 == sextract64(-arg2, 0, 14)) {
         tcg_out_bundle(s, mmI,
                        INSN_NOP_M,
                        INSN_NOP_M,
                        tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, -arg2, arg1));
     } else {
-        tcg_out_alu(s, OPC_SUB_A1, ret, arg1, const_arg1, arg2, const_arg2);
+        tcg_out_alu(s, OPC_SUB_A1, OPC_SUB_A3, ret,
+                    arg1, const_arg1, arg2, const_arg2);
     }
 }
 
@@ -2112,13 +2113,14 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_and_i32:
     case INDEX_op_and_i64:
-        tcg_out_alu(s, OPC_AND_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        /* TCG expects arg2 constant; A3 expects arg1 constant.  Swap.  */
+        tcg_out_alu(s, OPC_AND_A1, OPC_AND_A3, args[0],
+                    args[2], const_args[2], args[1], const_args[1]);
         break;
     case INDEX_op_andc_i32:
     case INDEX_op_andc_i64:
-        tcg_out_alu(s, OPC_ANDCM_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        tcg_out_alu(s, OPC_ANDCM_A1, OPC_ANDCM_A3, args[0],
+                    args[1], const_args[1], args[2], const_args[2]);
         break;
     case INDEX_op_eqv_i32:
     case INDEX_op_eqv_i64:
@@ -2137,8 +2139,9 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_or_i32:
     case INDEX_op_or_i64:
-        tcg_out_alu(s, OPC_OR_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        /* TCG expects arg2 constant; A3 expects arg1 constant.  Swap.  */
+        tcg_out_alu(s, OPC_OR_A1, OPC_OR_A3, args[0],
+                    args[2], const_args[2], args[1], const_args[1]);
         break;
     case INDEX_op_orc_i32:
     case INDEX_op_orc_i64:
@@ -2147,8 +2150,9 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_xor_i32:
     case INDEX_op_xor_i64:
-        tcg_out_alu(s, OPC_XOR_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        /* TCG expects arg2 constant; A3 expects arg1 constant.  Swap.  */
+        tcg_out_alu(s, OPC_XOR_A1, OPC_XOR_A3, args[0],
+                    args[2], const_args[2], args[1], const_args[1]);
         break;
 
     case INDEX_op_mul_i32:
commit f940fb086c607fcb9c98d5ce67619fc5255f6abb
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 16:44:18 2013 -0400

    tcg-ia64: Use SUB_A3 and ADDS_A4 for subtraction
    
    We can subtract from more small constants that just 0 with one insn,
    and we can add the negative for most small constants.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 8fb3ba0..54232eb 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1080,6 +1080,28 @@ static inline void tcg_out_add(TCGContext *s, TCGReg ret, TCGReg arg1,
     }
 }
 
+static inline void tcg_out_sub(TCGContext *s, TCGReg ret, TCGArg arg1,
+                               int const_arg1, TCGArg arg2, int const_arg2)
+{
+    if (const_arg1 && arg1 == (int8_t)arg1) {
+        if (const_arg2) {
+            tcg_out_movi(s, TCG_TYPE_I64, ret, arg1 - arg2);
+            return;
+        }
+        tcg_out_bundle(s, mmI,
+                       INSN_NOP_M,
+                       INSN_NOP_M,
+                       tcg_opc_a3(TCG_REG_P0, OPC_SUB_A3, ret, arg1, arg2));
+    } else if (const_arg2 && -arg2 == sextract64(-arg2, 0, 14)) {
+        tcg_out_bundle(s, mmI,
+                       INSN_NOP_M,
+                       INSN_NOP_M,
+                       tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, -arg2, arg1));
+    } else {
+        tcg_out_alu(s, OPC_SUB_A1, ret, arg1, const_arg1, arg2, const_arg2);
+    }
+}
+
 static inline void tcg_out_eqv(TCGContext *s, TCGArg ret,
                                TCGArg arg1, int const_arg1,
                                TCGArg arg2, int const_arg2)
@@ -2085,8 +2107,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
-        tcg_out_alu(s, OPC_SUB_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        tcg_out_sub(s, args[0], args[1], const_args[1], args[2], const_args[2]);
         break;
 
     case INDEX_op_and_i32:
commit 8642088a3d73a599b31c6fdd1d2aa2c945d95ced
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 16:15:13 2013 -0400

    tcg-ia64: Use ADDS for small addition
    
    Avoids a wasted cycle loading up small constants.
    
    Simplify the code assuming the tcg optimizer is going to work
    and don't expect the first operand of the add to be constant.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index aeb6bc7..8fb3ba0 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1067,6 +1067,19 @@ static void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGReg ret, TCGArg arg1,
                    tcg_opc_a1(TCG_REG_P0, opc_a1, ret, arg1, arg2));
 }
 
+static inline void tcg_out_add(TCGContext *s, TCGReg ret, TCGReg arg1,
+                               TCGArg arg2, int const_arg2)
+{
+    if (const_arg2 && arg2 == sextract64(arg2, 0, 14)) {
+        tcg_out_bundle(s, mmI,
+                       INSN_NOP_M,
+                       INSN_NOP_M,
+                       tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, arg2, arg1));
+    } else {
+        tcg_out_alu(s, OPC_ADD_A1, ret, arg1, 0, arg2, const_arg2);
+    }
+}
+
 static inline void tcg_out_eqv(TCGContext *s, TCGArg ret,
                                TCGArg arg1, int const_arg1,
                                TCGArg arg2, int const_arg2)
@@ -2068,8 +2081,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
     case INDEX_op_add_i32:
     case INDEX_op_add_i64:
-        tcg_out_alu(s, OPC_ADD_A1, args[0], args[1], const_args[1],
-                    args[2], const_args[2]);
+        tcg_out_add(s, args[0], args[1], args[2], const_args[2]);
         break;
     case INDEX_op_sub_i32:
     case INDEX_op_sub_i64:
@@ -2275,7 +2287,7 @@ static const TCGTargetOpDef ia64_op_defs[] = {
     { INDEX_op_st16_i32, { "rZ", "r" } },
     { INDEX_op_st_i32, { "rZ", "r" } },
 
-    { INDEX_op_add_i32, { "r", "rI", "rI" } },
+    { INDEX_op_add_i32, { "r", "rZ", "rI" } },
     { INDEX_op_sub_i32, { "r", "rI", "rI" } },
 
     { INDEX_op_and_i32, { "r", "rI", "rI" } },
@@ -2322,7 +2334,7 @@ static const TCGTargetOpDef ia64_op_defs[] = {
     { INDEX_op_st32_i64, { "rZ", "r" } },
     { INDEX_op_st_i64, { "rZ", "r" } },
 
-    { INDEX_op_add_i64, { "r", "rI", "rI" } },
+    { INDEX_op_add_i64, { "r", "rZ", "rI" } },
     { INDEX_op_sub_i64, { "r", "rI", "rI" } },
 
     { INDEX_op_and_i64, { "r", "rI", "rI" } },
commit 3c289cba9b82ff55f52287a642332d4c2ca62b95
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 15:56:44 2013 -0400

    tcg-ia64: Avoid unnecessary stop bit in tcg_out_alu
    
    When performing an operation with two input registers, we'd leave
    the stop bit (and thus an extra cycle) that's only needed when one
    or the other input is a constant.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 11a414c..aeb6bc7 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1044,31 +1044,26 @@ static inline void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
     }
 }
 
-static inline void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGArg ret,
-                               TCGArg arg1, int const_arg1,
-                               TCGArg arg2, int const_arg2)
+static void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGReg ret, TCGArg arg1,
+                        int const_arg1, TCGArg arg2, int const_arg2)
 {
-    uint64_t opc1, opc2;
+    uint64_t opc1 = 0, opc2 = 0;
 
     if (const_arg1 && arg1 != 0) {
         opc1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
                           TCG_REG_R2, arg1, TCG_REG_R0);
         arg1 = TCG_REG_R2;
-    } else {
-        opc1 = INSN_NOP_M;
     }
 
     if (const_arg2 && arg2 != 0) {
         opc2 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5,
                           TCG_REG_R3, arg2, TCG_REG_R0);
         arg2 = TCG_REG_R3;
-    } else {
-        opc2 = INSN_NOP_I;
     }
 
-    tcg_out_bundle(s, mII,
-                   opc1,
-                   opc2,
+    tcg_out_bundle(s, (opc1 || opc2 ? mII : miI),
+                   opc1 ? opc1 : INSN_NOP_M,
+                   opc2 ? opc2 : INSN_NOP_I,
                    tcg_opc_a1(TCG_REG_P0, opc_a1, ret, arg1, arg2));
 }
 
commit d15de15ca01fa990544b015fb972f2d04ab4d2d0
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 14:45:54 2013 -0400

    tcg-ia64: Move AREG0 to R32
    
    Since the move away from the global areg0, we're no longer globally
    reserving areg0.  Which means our use of R7 clobbers a call-saved
    register.  Shift areg0 into the windowed registers.  Indeed, choose
    the incoming parameter register that it comes to us by.
    
    This requires moving the register holding the return address elsewhere.
    Choose R33 for tidiness.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 9fb3832..11a414c 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -109,7 +109,6 @@ enum {
 };
 
 static const int tcg_target_reg_alloc_order[] = {
-    TCG_REG_R33,
     TCG_REG_R35,
     TCG_REG_R36,
     TCG_REG_R37,
@@ -2404,8 +2403,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     tcg_out_bundle(s, miI,
                    tcg_opc_m34(TCG_REG_P0, OPC_ALLOC_M34,
                                TCG_REG_R34, 32, 24, 0),
-                   tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
-                               TCG_AREG0, 0, TCG_REG_R32),
+                   INSN_NOP_I,
                    tcg_opc_i21(TCG_REG_P0, OPC_MOV_I21,
                                TCG_REG_B6, TCG_REG_R33, 0));
 
@@ -2424,7 +2422,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
                    tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
                                TCG_REG_R12, -frame_size, TCG_REG_R12),
                    tcg_opc_i22(TCG_REG_P0, OPC_MOV_I22,
-                               TCG_REG_R32, TCG_REG_B0),
+                               TCG_REG_R33, TCG_REG_B0),
                    tcg_opc_b4 (TCG_REG_P0, OPC_BR_SPTK_MANY_B4, TCG_REG_B6));
 
     /* epilogue */
@@ -2432,7 +2430,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     tcg_out_bundle(s, miI,
                    INSN_NOP_M,
                    tcg_opc_i21(TCG_REG_P0, OPC_MOV_I21,
-                               TCG_REG_B0, TCG_REG_R32, 0),
+                               TCG_REG_B0, TCG_REG_R33, 0),
                    tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
                                TCG_REG_R12, frame_size, TCG_REG_R12));
     tcg_out_bundle(s, miB,
@@ -2489,16 +2487,17 @@ static void tcg_target_init(TCGContext *s)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R3);   /* internal use */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R12);  /* stack pointer */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R13);  /* thread pointer */
-    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R32);  /* return address */
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R33);  /* return address */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R34);  /* PFS */
 
-    /* The following 3 are not in use, are call-saved, but *not* saved
+    /* The following 4 are not in use, are call-saved, but *not* saved
        by the prologue.  Therefore we cannot use them without modifying
        the prologue.  There doesn't seem to be any good reason to use
        these as opposed to the windowed registers.  */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R4);
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R5);
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R6);
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_R7);
 
     tcg_add_target_add_op_defs(ia64_op_defs);
 }
diff --git a/tcg/ia64/tcg-target.h b/tcg/ia64/tcg-target.h
index c90038a..52a939c 100644
--- a/tcg/ia64/tcg-target.h
+++ b/tcg/ia64/tcg-target.h
@@ -92,6 +92,8 @@ typedef enum {
     TCG_REG_R61,
     TCG_REG_R62,
     TCG_REG_R63,
+
+    TCG_AREG0 = TCG_REG_R32,
 } TCGReg;
 
 #define TCG_CT_CONST_ZERO 0x100
@@ -162,8 +164,6 @@ typedef enum {
 #define TCG_TARGET_HAS_not_i32          0 /* xor r1, -1, r3 */
 #define TCG_TARGET_HAS_not_i64          0 /* xor r1, -1, r3 */
 
-#define TCG_AREG0 TCG_REG_R7
-
 static inline void flush_icache_range(uintptr_t start, uintptr_t stop)
 {
     start = start & ~(32UL - 1UL);
commit 6d264b38fcc267b68df2890b22d27bc404878c8c
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 12:47:41 2013 -0400

    tcg-ia64: Simplify brcond
    
    There was a misconception that a stop bit is required between a compare
    and the branch that uses the predicate set by the compare.  This lead to
    the usage of an extra bundle in which to perform the compare.  The extra
    bundle left room for constants to be loaded for use with the compare insn.
    
    If we pack the compare and the branch together in the same bundle, then
    there's no longer any room for non-zero constants.  At which point we
    can eliminate half the function by not handling them.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 4566a33..9fb3832 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1444,38 +1444,16 @@ static inline uint64_t tcg_opc_cmp_a(int qp, TCGCond cond, TCGArg arg1,
     }
 }
 
-static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
-                                  int const_arg1, TCGArg arg2, int const_arg2,
-                                  int label_index, int cmp4)
+static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGReg arg1,
+                                  TCGReg arg2, int label_index, int cmp4)
 {
     TCGLabel *l = &s->labels[label_index];
-    uint64_t opc1, opc2;
 
-    if (const_arg1 && arg1 != 0) {
-        opc1 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5, TCG_REG_R2,
-                          arg1, TCG_REG_R0);
-        arg1 = TCG_REG_R2;
-    } else {
-        opc1 = INSN_NOP_M;
-    }
-
-    if (const_arg2 && arg2 != 0) {
-        opc2 = tcg_opc_a5(TCG_REG_P0, OPC_ADDL_A5, TCG_REG_R3,
-                          arg2, TCG_REG_R0);
-        arg2 = TCG_REG_R3;
-    } else {
-        opc2 = INSN_NOP_I;
-    }
-
-    tcg_out_bundle(s, mII,
-                   opc1,
-                   opc2,
-                   tcg_opc_cmp_a(TCG_REG_P0, cond, arg1, arg2, cmp4));
-    tcg_out_bundle(s, mmB,
-                   INSN_NOP_M,
+    tcg_out_bundle(s, miB,
                    INSN_NOP_M,
-                   tcg_opc_b1 (TCG_REG_P6, OPC_BR_DPTK_FEW_B1,
-                               get_reloc_pcrel21b(s->code_ptr + 2)));
+                   tcg_opc_cmp_a(TCG_REG_P0, cond, arg1, arg2, cmp4),
+                   tcg_opc_b1(TCG_REG_P6, OPC_BR_DPTK_FEW_B1,
+                              get_reloc_pcrel21b(s->code_ptr + 2)));
 
     if (l->has_value) {
         reloc_pcrel21b((s->code_ptr - 16) + 2, l->u.value);
@@ -2224,12 +2202,10 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_brcond_i32:
-        tcg_out_brcond(s, args[2], args[0], const_args[0],
-                       args[1], const_args[1], args[3], 1);
+        tcg_out_brcond(s, args[2], args[0], args[1], args[3], 1);
         break;
     case INDEX_op_brcond_i64:
-        tcg_out_brcond(s, args[2], args[0], const_args[0],
-                       args[1], const_args[1], args[3], 0);
+        tcg_out_brcond(s, args[2], args[0], args[1], args[3], 0);
         break;
     case INDEX_op_setcond_i32:
         tcg_out_setcond(s, args[3], args[0], args[1], args[2], 1);
@@ -2333,7 +2309,7 @@ static const TCGTargetOpDef ia64_op_defs[] = {
     { INDEX_op_bswap16_i32, { "r", "rZ" } },
     { INDEX_op_bswap32_i32, { "r", "rZ" } },
 
-    { INDEX_op_brcond_i32, { "rI", "rI" } },
+    { INDEX_op_brcond_i32, { "rZ", "rZ" } },
     { INDEX_op_setcond_i32, { "r", "rZ", "rZ" } },
     { INDEX_op_movcond_i32, { "r", "rZ", "rZ", "rI", "rI" } },
 
@@ -2383,7 +2359,7 @@ static const TCGTargetOpDef ia64_op_defs[] = {
     { INDEX_op_bswap32_i64, { "r", "rZ" } },
     { INDEX_op_bswap64_i64, { "r", "rZ" } },
 
-    { INDEX_op_brcond_i64, { "rI", "rI" } },
+    { INDEX_op_brcond_i64, { "rZ", "rZ" } },
     { INDEX_op_setcond_i64, { "r", "rZ", "rZ" } },
     { INDEX_op_movcond_i64, { "r", "rZ", "rZ", "rI", "rI" } },
 
commit 6f65c780b952485d7d1edbb72bf199e9803995e2
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Sep 5 12:11:27 2013 -0400

    tcg-ia64: Handle constant calls
    
    Using only indirect calls results in 3 bundles (one to load the
    descriptor address), and 4 stop bits.  By looking through the
    descriptor to the constants, we can perform the call with 2
    bundles and only 1 stop bit.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 0581455..4566a33 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -226,6 +226,7 @@ enum {
     OPC_BR_CALL_SPTK_MANY_B5  = 0x02100001000ull,
     OPC_BR_RET_SPTK_MANY_B4   = 0x00108001100ull,
     OPC_BRL_SPTK_MANY_X3      = 0x18000001000ull,
+    OPC_BRL_CALL_SPTK_MANY_X4 = 0x1a000001000ull,
     OPC_CMP_LT_A6             = 0x18000000000ull,
     OPC_CMP_LTU_A6            = 0x1a000000000ull,
     OPC_CMP_EQ_A6             = 0x1c000000000ull,
@@ -584,6 +585,8 @@ static inline uint64_t tcg_opc_l3(uint64_t imm)
     return (imm & 0x07fffffffff00000ull) >> 18;
 }
 
+#define tcg_opc_l4  tcg_opc_l3
+
 static inline uint64_t tcg_opc_m1(int qp, uint64_t opc, int r1, int r3)
 {
     return opc
@@ -668,6 +671,15 @@ static inline uint64_t tcg_opc_x3(int qp, uint64_t opc, uint64_t imm)
            | (qp & 0x3f);
 }
 
+static inline uint64_t tcg_opc_x4(int qp, uint64_t opc, int b1, uint64_t imm)
+{
+    return opc
+           | ((imm & 0x0800000000000000ull) >> 23) /* i */
+           | ((imm & 0x00000000000fffffull) << 13) /* imm20b */
+           | ((b1 & 0x7) << 6)
+           | (qp & 0x3f);
+}
+
 
 /*
  * Relocations
@@ -893,7 +905,23 @@ static void tcg_out_br(TCGContext *s, int label_index)
     }
 }
 
-static inline void tcg_out_call(TCGContext *s, TCGArg addr)
+static inline void tcg_out_calli(TCGContext *s, uintptr_t addr)
+{
+    /* Look through the function descriptor.  */
+    uintptr_t disp, *desc = (uintptr_t *)addr;
+    tcg_out_bundle(s, mlx,
+                   INSN_NOP_M,
+                   tcg_opc_l2 (desc[1]),
+                   tcg_opc_x2 (TCG_REG_P0, OPC_MOVL_X2, TCG_REG_R1, desc[1]));
+    disp = (desc[0] - (uintptr_t)s->code_ptr) >> 4;
+    tcg_out_bundle(s, mLX,
+                   INSN_NOP_M,
+                   tcg_opc_l4 (disp),
+                   tcg_opc_x4 (TCG_REG_P0, OPC_BRL_CALL_SPTK_MANY_X4,
+                               TCG_REG_B0, disp));
+}
+
+static inline void tcg_out_callr(TCGContext *s, TCGReg addr)
 {
     tcg_out_bundle(s, MmI,
                    tcg_opc_m1 (TCG_REG_P0, OPC_LD8_M1, TCG_REG_R2, addr),
@@ -2004,7 +2032,11 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         tcg_out_br(s, args[0]);
         break;
     case INDEX_op_call:
-        tcg_out_call(s, args[0]);
+        if (likely(const_args[0])) {
+            tcg_out_calli(s, args[0]);
+        } else {
+            tcg_out_callr(s, args[0]);
+        }
         break;
     case INDEX_op_goto_tb:
         tcg_out_goto_tb(s, args[0]);
@@ -2257,7 +2289,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
 
 static const TCGTargetOpDef ia64_op_defs[] = {
     { INDEX_op_br, { } },
-    { INDEX_op_call, { "r" } },
+    { INDEX_op_call, { "ri" } },
     { INDEX_op_exit_tb, { } },
     { INDEX_op_goto_tb, { } },
 
commit 5f7b16877a431c477d8dac92d0bb553d05c6402e
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Sep 4 19:00:52 2013 -0400

    tcg-ia64: Use shortcuts for nop insns
    
    There's no need to go through the full opcode-to-insn function call
    to generate nops.  This makes the source a bit more readable.
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 8db0ac1..0581455 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -284,6 +284,9 @@ enum {
     OPC_ZXT1_I29              = 0x00080000000ull,
     OPC_ZXT2_I29              = 0x00088000000ull,
     OPC_ZXT4_I29              = 0x00090000000ull,
+
+    INSN_NOP_M                = OPC_NOP_M48,  /* nop.m 0 */
+    INSN_NOP_I                = OPC_NOP_I18,  /* nop.i 0 */
 };
 
 static inline uint64_t tcg_opc_a1(int qp, uint64_t opc, int r1,
@@ -855,8 +858,8 @@ static inline void tcg_out_mov(TCGContext *s, TCGType type,
                                TCGReg ret, TCGReg arg)
 {
     tcg_out_bundle(s, mmI,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4, ret, 0, arg));
 }
 
@@ -864,7 +867,7 @@ static inline void tcg_out_movi(TCGContext *s, TCGType type,
                                 TCGReg reg, tcg_target_long arg)
 {
     tcg_out_bundle(s, mLX,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_l2 (arg),
                    tcg_opc_x2 (TCG_REG_P0, OPC_MOVL_X2, reg, arg));
 }
@@ -877,8 +880,8 @@ static void tcg_out_br(TCGContext *s, int label_index)
        the existing value and using it again. This ensure that caches and
        memory are kept coherent during retranslation. */
     tcg_out_bundle(s, mmB,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_b1 (TCG_REG_P0, OPC_BR_SPTK_MANY_B1,
                                get_reloc_pcrel21b(s->code_ptr + 2)));
 
@@ -899,7 +902,7 @@ static inline void tcg_out_call(TCGContext *s, TCGArg addr)
                                TCG_REG_B6, TCG_REG_R2, 0));
     tcg_out_bundle(s, mmB,
                    tcg_opc_m1 (TCG_REG_P0, OPC_LD8_M1, TCG_REG_R1, TCG_REG_R3),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_b5 (TCG_REG_P0, OPC_BR_CALL_SPTK_MANY_B5,
                                TCG_REG_B0, TCG_REG_B6));
 }
@@ -915,7 +918,7 @@ static void tcg_out_exit_tb(TCGContext *s, tcg_target_long arg)
     imm = (uint64_t)disp >> 4;
 
     tcg_out_bundle(s, mLX,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_l3 (imm),
                    tcg_opc_x3 (TCG_REG_P0, OPC_BRL_SPTK_MANY_X3, imm));
 }
@@ -932,12 +935,12 @@ static inline void tcg_out_goto_tb(TCGContext *s, TCGArg arg)
         tcg_out_bundle(s, MmI,
                        tcg_opc_m1 (TCG_REG_P0, OPC_LD8_M1,
                                    TCG_REG_R2, TCG_REG_R2),
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i21(TCG_REG_P0, OPC_MOV_I21, TCG_REG_B6,
                                    TCG_REG_R2, 0));
         tcg_out_bundle(s, mmB,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_M,
                        tcg_opc_b4 (TCG_REG_P0, OPC_BR_SPTK_MANY_B4,
                                    TCG_REG_B6));
     }
@@ -947,12 +950,12 @@ static inline void tcg_out_goto_tb(TCGContext *s, TCGArg arg)
 static inline void tcg_out_jmp(TCGContext *s, TCGArg addr)
 {
     tcg_out_bundle(s, mmI,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_i21(TCG_REG_P0, OPC_MOV_I21, TCG_REG_B6, addr, 0));
     tcg_out_bundle(s, mmB,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_b4(TCG_REG_P0, OPC_BR_SPTK_MANY_B4, TCG_REG_B6));
 }
 
@@ -964,14 +967,14 @@ static inline void tcg_out_ld_rel(TCGContext *s, uint64_t opc_m4, TCGArg arg,
                        tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4,
                                   TCG_REG_R2, arg2, arg1),
                        tcg_opc_m1 (TCG_REG_P0, opc_m4, arg, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     } else {
         tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R2, arg2);
         tcg_out_bundle(s, MmI,
                        tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1,
                                    TCG_REG_R2, TCG_REG_R2, arg1),
                        tcg_opc_m1 (TCG_REG_P0, opc_m4, arg, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
 }
 
@@ -983,14 +986,14 @@ static inline void tcg_out_st_rel(TCGContext *s, uint64_t opc_m4, TCGArg arg,
                        tcg_opc_a4(TCG_REG_P0, OPC_ADDS_A4,
                                   TCG_REG_R2, arg2, arg1),
                        tcg_opc_m4 (TCG_REG_P0, opc_m4, arg, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     } else {
         tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_R2, arg2);
         tcg_out_bundle(s, MmI,
                        tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1,
                                    TCG_REG_R2, TCG_REG_R2, arg1),
                        tcg_opc_m4 (TCG_REG_P0, opc_m4, arg, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
 }
 
@@ -1025,7 +1028,7 @@ static inline void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGArg ret,
                           TCG_REG_R2, arg1, TCG_REG_R0);
         arg1 = TCG_REG_R2;
     } else {
-        opc1 = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
+        opc1 = INSN_NOP_M;
     }
 
     if (const_arg2 && arg2 != 0) {
@@ -1033,7 +1036,7 @@ static inline void tcg_out_alu(TCGContext *s, uint64_t opc_a1, TCGArg ret,
                           TCG_REG_R3, arg2, TCG_REG_R0);
         arg2 = TCG_REG_R3;
     } else {
-        opc2 = tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0);
+        opc2 = INSN_NOP_I;
     }
 
     tcg_out_bundle(s, mII,
@@ -1047,7 +1050,7 @@ static inline void tcg_out_eqv(TCGContext *s, TCGArg ret,
                                TCGArg arg2, int const_arg2)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_a1 (TCG_REG_P0, OPC_XOR_A1, ret, arg1, arg2),
                    tcg_opc_a3 (TCG_REG_P0, OPC_ANDCM_A3, ret, -1, ret));
 }
@@ -1057,7 +1060,7 @@ static inline void tcg_out_nand(TCGContext *s, TCGArg ret,
                                 TCGArg arg2, int const_arg2)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_a1 (TCG_REG_P0, OPC_AND_A1, ret, arg1, arg2),
                    tcg_opc_a3 (TCG_REG_P0, OPC_ANDCM_A3, ret, -1, ret));
 }
@@ -1067,7 +1070,7 @@ static inline void tcg_out_nor(TCGContext *s, TCGArg ret,
                                TCGArg arg2, int const_arg2)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_a1 (TCG_REG_P0, OPC_OR_A1, ret, arg1, arg2),
                    tcg_opc_a3 (TCG_REG_P0, OPC_ANDCM_A3, ret, -1, ret));
 }
@@ -1077,7 +1080,7 @@ static inline void tcg_out_orc(TCGContext *s, TCGArg ret,
                                TCGArg arg2, int const_arg2)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_a3 (TCG_REG_P0, OPC_ANDCM_A3, TCG_REG_R2, -1, arg2),
                    tcg_opc_a1 (TCG_REG_P0, OPC_OR_A1, ret, arg1, TCG_REG_R2));
 }
@@ -1088,16 +1091,16 @@ static inline void tcg_out_mul(TCGContext *s, TCGArg ret,
     tcg_out_bundle(s, mmI,
                    tcg_opc_m18(TCG_REG_P0, OPC_SETF_SIG_M18, TCG_REG_F6, arg1),
                    tcg_opc_m18(TCG_REG_P0, OPC_SETF_SIG_M18, TCG_REG_F7, arg2),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                   INSN_NOP_I);
     tcg_out_bundle(s, mmF,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_f2 (TCG_REG_P0, OPC_XMA_L_F2, TCG_REG_F6, TCG_REG_F6,
                                TCG_REG_F7, TCG_REG_F0));
     tcg_out_bundle(s, miI,
                    tcg_opc_m19(TCG_REG_P0, OPC_GETF_SIG_M19, ret, TCG_REG_F6),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                   INSN_NOP_I,
+                   INSN_NOP_I);
 }
 
 static inline void tcg_out_sar_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
@@ -1105,8 +1108,8 @@ static inline void tcg_out_sar_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_I11,
                                    ret, arg1, arg2, 31 - arg2));
     } else {
@@ -1124,14 +1127,14 @@ static inline void tcg_out_sar_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_I11,
                                    ret, arg1, arg2, 63 - arg2));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i5 (TCG_REG_P0, OPC_SHR_I5, ret, arg1, arg2));
     }
 }
@@ -1141,13 +1144,13 @@ static inline void tcg_out_shl_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret,
                                    arg1, 63 - arg2, 31 - arg2));
     } else {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_a3 (TCG_REG_P0, OPC_AND_A3, TCG_REG_R2,
                                    0x1f, arg2),
                        tcg_opc_i7 (TCG_REG_P0, OPC_SHL_I7, ret,
@@ -1160,14 +1163,14 @@ static inline void tcg_out_shl_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret,
                                    arg1, 63 - arg2, 63 - arg2));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i7 (TCG_REG_P0, OPC_SHL_I7, ret,
                                    arg1, arg2));
     }
@@ -1178,8 +1181,8 @@ static inline void tcg_out_shr_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_U_I11, ret,
                                    arg1, arg2, 31 - arg2));
     } else {
@@ -1197,14 +1200,14 @@ static inline void tcg_out_shr_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_U_I11, ret,
                                    arg1, arg2, 63 - arg2));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i5 (TCG_REG_P0, OPC_SHR_U_I5, ret,
                                    arg1, arg2));
     }
@@ -1215,20 +1218,20 @@ static inline void tcg_out_rotl_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i2 (TCG_REG_P0, OPC_UNPACK4_L_I2,
                                    TCG_REG_R2, arg1, arg1),
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_U_I11, ret,
                                    TCG_REG_R2, 32 - arg2, 31));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i2 (TCG_REG_P0, OPC_UNPACK4_L_I2,
                                    TCG_REG_R2, arg1, arg1),
                        tcg_opc_a3 (TCG_REG_P0, OPC_AND_A3, TCG_REG_R3,
                                    0x1f, arg2));
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_a3 (TCG_REG_P0, OPC_SUB_A3, TCG_REG_R3,
                                    0x20, TCG_REG_R3),
                        tcg_opc_i5 (TCG_REG_P0, OPC_SHR_U_I5, ret,
@@ -1241,8 +1244,8 @@ static inline void tcg_out_rotl_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i10(TCG_REG_P0, OPC_SHRP_I10, ret, arg1,
                                    arg1, 0x40 - arg2));
     } else {
@@ -1254,8 +1257,8 @@ static inline void tcg_out_rotl_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
                        tcg_opc_i5 (TCG_REG_P0, OPC_SHR_U_I5, TCG_REG_R2,
                                    arg1, TCG_REG_R2));
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_a1 (TCG_REG_P0, OPC_OR_A1, ret,
                                    TCG_REG_R2, TCG_REG_R3));
     }
@@ -1266,7 +1269,7 @@ static inline void tcg_out_rotr_i32(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i2 (TCG_REG_P0, OPC_UNPACK4_L_I2,
                                    TCG_REG_R2, arg1, arg1),
                        tcg_opc_i11(TCG_REG_P0, OPC_EXTR_U_I11, ret,
@@ -1287,8 +1290,8 @@ static inline void tcg_out_rotr_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
 {
     if (const_arg2) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i10(TCG_REG_P0, OPC_SHRP_I10, ret, arg1,
                                    arg1, arg2));
     } else {
@@ -1300,8 +1303,8 @@ static inline void tcg_out_rotr_i64(TCGContext *s, TCGArg ret, TCGArg arg1,
                        tcg_opc_i7 (TCG_REG_P0, OPC_SHL_I7, TCG_REG_R2,
                                    arg1, TCG_REG_R2));
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_a1 (TCG_REG_P0, OPC_OR_A1, ret,
                                    TCG_REG_R2, TCG_REG_R3));
     }
@@ -1311,15 +1314,15 @@ static inline void tcg_out_ext(TCGContext *s, uint64_t opc_i29,
                                TCGArg ret, TCGArg arg)
 {
     tcg_out_bundle(s, miI,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_I,
                    tcg_opc_i29(TCG_REG_P0, opc_i29, ret, arg));
 }
 
 static inline void tcg_out_bswap16(TCGContext *s, TCGArg ret, TCGArg arg)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret, arg, 15, 15),
                    tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, ret, 0xb));
 }
@@ -1327,7 +1330,7 @@ static inline void tcg_out_bswap16(TCGContext *s, TCGArg ret, TCGArg arg)
 static inline void tcg_out_bswap32(TCGContext *s, TCGArg ret, TCGArg arg)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, ret, arg, 31, 31),
                    tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, ret, 0xb));
 }
@@ -1335,8 +1338,8 @@ static inline void tcg_out_bswap32(TCGContext *s, TCGArg ret, TCGArg arg)
 static inline void tcg_out_bswap64(TCGContext *s, TCGArg ret, TCGArg arg)
 {
     tcg_out_bundle(s, miI,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_I,
                    tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3, ret, arg, 0xb));
 }
 
@@ -1366,8 +1369,8 @@ static inline void tcg_out_deposit(TCGContext *s, TCGArg ret, TCGArg a1,
         i2 = tcg_opc_i15(TCG_REG_P0, OPC_DEP_I15, ret, a2, a1, cpos, lm1);
     }
     tcg_out_bundle(s, (i1 ? mII : miI),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   i1 ? i1 : tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                   INSN_NOP_M,
+                   i1 ? i1 : INSN_NOP_I,
                    i2);
 }
 
@@ -1425,7 +1428,7 @@ static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
                           arg1, TCG_REG_R0);
         arg1 = TCG_REG_R2;
     } else {
-        opc1 = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
+        opc1 = INSN_NOP_M;
     }
 
     if (const_arg2 && arg2 != 0) {
@@ -1433,7 +1436,7 @@ static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
                           arg2, TCG_REG_R0);
         arg2 = TCG_REG_R3;
     } else {
-        opc2 = tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0);
+        opc2 = INSN_NOP_I;
     }
 
     tcg_out_bundle(s, mII,
@@ -1441,8 +1444,8 @@ static inline void tcg_out_brcond(TCGContext *s, TCGCond cond, TCGArg arg1,
                    opc2,
                    tcg_opc_cmp_a(TCG_REG_P0, cond, arg1, arg2, cmp4));
     tcg_out_bundle(s, mmB,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
+                   INSN_NOP_M,
                    tcg_opc_b1 (TCG_REG_P6, OPC_BR_DPTK_FEW_B1,
                                get_reloc_pcrel21b(s->code_ptr + 2)));
 
@@ -1473,14 +1476,14 @@ static inline void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGArg ret,
     if (const_v1) {
         opc1 = tcg_opc_a5(TCG_REG_P6, OPC_ADDL_A5, ret, v1, TCG_REG_R0);
     } else if (ret == v1) {
-        opc1 = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
+        opc1 = INSN_NOP_M;
     } else {
         opc1 = tcg_opc_a4(TCG_REG_P6, OPC_ADDS_A4, ret, 0, v1);
     }
     if (const_v2) {
         opc2 = tcg_opc_a5(TCG_REG_P7, OPC_ADDL_A5, ret, v2, TCG_REG_R0);
     } else if (ret == v2) {
-        opc2 = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
+        opc2 = INSN_NOP_I;
     } else {
         opc2 = tcg_opc_a4(TCG_REG_P7, OPC_ADDS_A4, ret, 0, v2);
     }
@@ -1500,7 +1503,7 @@ static inline void tcg_out_qemu_tlb(TCGContext *s, TCGArg addr_reg,
                                     uint64_t offset_addend)
 {
     tcg_out_bundle(s, mII,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_i11(TCG_REG_P0, OPC_EXTR_U_I11, TCG_REG_R2,
                                addr_reg, TARGET_PAGE_BITS, CPU_TLB_BITS - 1),
                    tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12, TCG_REG_R2,
@@ -1595,13 +1598,13 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                        tcg_opc_m1 (TCG_REG_P6, opc_ld_m1[s_bits],
                                    TCG_REG_R8, TCG_REG_R3),
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1, TCG_REG_R1, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
     if (!bswap) {
         tcg_out_bundle(s, miB,
                        tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
                                    mem_index, TCG_REG_R0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_I,
                        tcg_opc_b5 (TCG_REG_P7, OPC_BR_CALL_SPTK_MANY_B5,
                                    TCG_REG_B0, TCG_REG_B6));
     } else {
@@ -1616,14 +1619,14 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
 
     if (s_bits == MO_64) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
                                    data_reg, 0, TCG_REG_R8));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i29(TCG_REG_P0, opc_ext_i29[opc & MO_SSIZE],
                                    data_reg, TCG_REG_R8));
     }
@@ -1681,20 +1684,20 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                                    TCG_REG_R1, TCG_REG_R2),
                        tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
                                    0, data_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
         break;
 
     case MO_16 | MO_BSWAP:
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_I,
                        tcg_opc_i12(TCG_REG_P6, OPC_DEP_Z_I12,
                                    TCG_REG_R2, data_reg, 15, 15));
         tcg_out_bundle(s, miI,
                        tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
                                    0, data_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_I,
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
         data_reg = TCG_REG_R2;
@@ -1704,13 +1707,13 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_I,
                        tcg_opc_i12(TCG_REG_P6, OPC_DEP_Z_I12,
                                    TCG_REG_R2, data_reg, 31, 31));
         tcg_out_bundle(s, miI,
                        tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
                                    0, data_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_I,
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
         data_reg = TCG_REG_R2;
@@ -1762,17 +1765,17 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
 #if TARGET_LONG_BITS == 32
     if (GUEST_BASE != 0) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29,
                                    TCG_REG_R3, addr_reg),
                        tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1, TCG_REG_R2,
                                    TCG_GUEST_BASE_REG, TCG_REG_R3));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29,
                                    TCG_REG_R2, addr_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
 
     if (!bswap) {
@@ -1780,13 +1783,13 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
             tcg_out_bundle(s, miI,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                           INSN_NOP_I,
+                           INSN_NOP_I);
         } else {
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_I,
                            tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
                                        data_reg, data_reg));
         }
@@ -1794,7 +1797,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_I,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        data_reg, data_reg, 0xb));
     } else {
@@ -1802,26 +1805,26 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_I,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                       data_reg, data_reg, 15, 15));
         } else {
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_I,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                       data_reg, data_reg, 31, 31));
         }
         if (!(opc & MO_SIGN)) {
             tcg_out_bundle(s, miI,
-                           tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_M,
+                           INSN_NOP_I,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        data_reg, data_reg, 0xb));
         } else {
             tcg_out_bundle(s, mII,
-                           tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                           INSN_NOP_M,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        data_reg, data_reg, 0xb),
                            tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
@@ -1835,40 +1838,40 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
                                    TCG_GUEST_BASE_REG, addr_reg),
                        tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                    data_reg, TCG_REG_R2),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     } else {
         tcg_out_bundle(s, mmI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                    data_reg, addr_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
 
     if (bswap && s_bits == MO_16) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 15, 15),
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
     } else if (bswap && s_bits == MO_32) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 31, 31),
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
     } else if (bswap && s_bits == MO_64) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
     }
     if (opc & MO_SIGN) {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                       INSN_NOP_M,
+                       INSN_NOP_I,
                        tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
                                    data_reg, data_reg));
     }
@@ -1895,23 +1898,23 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
 #if TARGET_LONG_BITS == 32
     if (GUEST_BASE != 0) {
         tcg_out_bundle(s, mII,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29,
                                    TCG_REG_R3, addr_reg),
                        tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1, TCG_REG_R2,
                                    TCG_GUEST_BASE_REG, TCG_REG_R3));
     } else {
         tcg_out_bundle(s, miI,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_i29(TCG_REG_P0, OPC_ZXT4_I29,
                                    TCG_REG_R2, addr_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     }
 
     if (bswap) {
         if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
-                           tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                           INSN_NOP_M,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 15, 15),
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
@@ -1919,7 +1922,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_32) {
             tcg_out_bundle(s, mII,
-                           tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                           INSN_NOP_M,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                        TCG_REG_R3, data_reg, 31, 31),
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
@@ -1927,8 +1930,8 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
             data_reg = TCG_REG_R3;
         } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
-                           tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_M,
+                           INSN_NOP_I,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, data_reg, 0xb));
             data_reg = TCG_REG_R3;
@@ -1937,15 +1940,15 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
     tcg_out_bundle(s, mmI,
                    tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                data_reg, TCG_REG_R2),
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
-                   tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                   INSN_NOP_M,
+                   INSN_NOP_I);
 #else
     if (GUEST_BASE != 0) {
         add_guest_base = tcg_opc_a1 (TCG_REG_P0, OPC_ADD_A1, TCG_REG_R2,
                                      TCG_GUEST_BASE_REG, addr_reg);
         addr_reg = TCG_REG_R2;
     } else {
-        add_guest_base = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
+        add_guest_base = INSN_NOP_M;
     }
 
     if (!bswap) {
@@ -1953,7 +1956,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
                        add_guest_base,
                        tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                    data_reg, addr_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I);
     } else {
         if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
@@ -1974,7 +1977,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
                            add_guest_base,
-                           tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
+                           INSN_NOP_I,
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, data_reg, 0xb));
             data_reg = TCG_REG_R3;
@@ -1982,8 +1985,8 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
         tcg_out_bundle(s, miI,
                        tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                    data_reg, addr_reg),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
-                       tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
+                       INSN_NOP_I,
+                       INSN_NOP_I);
     }
 #endif
 }
@@ -2402,7 +2405,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
        an ADDL in the M slot of the next bundle.  */
     if (GUEST_BASE != 0) {
         tcg_out_bundle(s, mlx,
-                       tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                       INSN_NOP_M,
                        tcg_opc_l2 (GUEST_BASE),
                        tcg_opc_x2 (TCG_REG_P0, OPC_MOVL_X2,
                                    TCG_GUEST_BASE_REG, GUEST_BASE));
@@ -2419,13 +2422,13 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     /* epilogue */
     tb_ret_addr = s->code_ptr;
     tcg_out_bundle(s, miI,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_i21(TCG_REG_P0, OPC_MOV_I21,
                                TCG_REG_B0, TCG_REG_R32, 0),
                    tcg_opc_a4 (TCG_REG_P0, OPC_ADDS_A4,
                                TCG_REG_R12, frame_size, TCG_REG_R12));
     tcg_out_bundle(s, miB,
-                   tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
+                   INSN_NOP_M,
                    tcg_opc_i26(TCG_REG_P0, OPC_MOV_I_I26,
                                TCG_REG_PFS, TCG_REG_R34),
                    tcg_opc_b4 (TCG_REG_P0, OPC_BR_RET_SPTK_MANY_B4,
commit e3afa1c4ad3162792421fb64bce937242bc7e0d8
Author: Richard Henderson <rth at twiddle.net>
Date:   Wed Sep 4 17:24:38 2013 -0400

    tcg-ia64: Use TCGMemOp within qemu_ldst routines
    
    Acked-by: Aurelien Jarno <aurelien at aurel32.net>
    Signed-off-by: Richard Henderson <rth at twiddle.net>

diff --git a/tcg/ia64/tcg-target.c b/tcg/ia64/tcg-target.c
index 0656d39..8db0ac1 100644
--- a/tcg/ia64/tcg-target.c
+++ b/tcg/ia64/tcg-target.c
@@ -1496,7 +1496,7 @@ static inline void tcg_out_movcond(TCGContext *s, TCGCond cond, TCGArg ret,
    R2 is loaded with the address of the addend TLB entry.
    R57 is loaded with the address, zero extented on 32-bit targets. */
 static inline void tcg_out_qemu_tlb(TCGContext *s, TCGArg addr_reg,
-                                    int s_bits, uint64_t offset_rw,
+                                    TCGMemOp s_bits, uint64_t offset_rw,
                                     uint64_t offset_addend)
 {
     tcg_out_bundle(s, mII,
@@ -1538,23 +1538,24 @@ static const void * const qemu_ld_helpers[4] = {
     helper_ldq_mmu,
 };
 
-static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+                                   TCGMemOp opc)
 {
-    int addr_reg, data_reg, mem_index, s_bits, bswap;
-    uint64_t opc_ld_m1[4] = { OPC_LD1_M1, OPC_LD2_M1, OPC_LD4_M1, OPC_LD8_M1 };
-    uint64_t opc_ext_i29[8] = { OPC_ZXT1_I29, OPC_ZXT2_I29, OPC_ZXT4_I29, 0,
-                                OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0 };
+    static const uint64_t opc_ld_m1[4] = {
+        OPC_LD1_M1, OPC_LD2_M1, OPC_LD4_M1, OPC_LD8_M1
+    };
+    static const uint64_t opc_ext_i29[8] = {
+        OPC_ZXT1_I29, OPC_ZXT2_I29, OPC_ZXT4_I29, 0,
+        OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0
+    };
+    int addr_reg, data_reg, mem_index;
+    TCGMemOp s_bits, bswap;
 
     data_reg = *args++;
     addr_reg = *args++;
     mem_index = *args;
-    s_bits = opc & 3;
-
-#ifdef TARGET_WORDS_BIGENDIAN
-    bswap = 1;
-#else
-    bswap = 0;
-#endif
+    s_bits = opc & MO_SIZE;
+    bswap = opc & MO_BSWAP;
 
     /* Read the TLB entry */
     tcg_out_qemu_tlb(s, addr_reg, s_bits,
@@ -1575,14 +1576,14 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                                TCG_REG_R3, TCG_REG_R57),
                    tcg_opc_i21(TCG_REG_P7, OPC_MOV_I21, TCG_REG_B6,
                                TCG_REG_R3, 0));
-    if (bswap && s_bits == 1) {
+    if (bswap && s_bits == MO_16) {
         tcg_out_bundle(s, MmI,
                        tcg_opc_m1 (TCG_REG_P6, opc_ld_m1[s_bits],
                                    TCG_REG_R8, TCG_REG_R3),
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1, TCG_REG_R1, TCG_REG_R2),
                        tcg_opc_i12(TCG_REG_P6, OPC_DEP_Z_I12,
                                    TCG_REG_R8, TCG_REG_R8, 15, 15));
-    } else if (bswap && s_bits == 2) {
+    } else if (bswap && s_bits == MO_32) {
         tcg_out_bundle(s, MmI,
                        tcg_opc_m1 (TCG_REG_P6, opc_ld_m1[s_bits],
                                    TCG_REG_R8, TCG_REG_R3),
@@ -1596,7 +1597,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1, TCG_REG_R1, TCG_REG_R2),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
     }
-    if (!bswap || s_bits == 0) {
+    if (!bswap) {
         tcg_out_bundle(s, miB,
                        tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R58,
                                    mem_index, TCG_REG_R0),
@@ -1613,7 +1614,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                                    TCG_REG_B0, TCG_REG_B6));
     }
 
-    if (opc == 3) {
+    if (s_bits == MO_64) {
         tcg_out_bundle(s, miI,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
@@ -1623,7 +1624,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
         tcg_out_bundle(s, miI,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
-                       tcg_opc_i29(TCG_REG_P0, opc_ext_i29[opc],
+                       tcg_opc_i29(TCG_REG_P0, opc_ext_i29[opc & MO_SSIZE],
                                    data_reg, TCG_REG_R8));
     }
 }
@@ -1637,22 +1638,21 @@ static const void * const qemu_st_helpers[4] = {
     helper_stq_mmu,
 };
 
-static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+                                   TCGMemOp opc)
 {
-    int addr_reg, data_reg, mem_index, bswap;
-    uint64_t opc_st_m4[4] = { OPC_ST1_M4, OPC_ST2_M4, OPC_ST4_M4, OPC_ST8_M4 };
+    static const uint64_t opc_st_m4[4] = {
+        OPC_ST1_M4, OPC_ST2_M4, OPC_ST4_M4, OPC_ST8_M4
+    };
+    int addr_reg, data_reg, mem_index;
+    TCGMemOp s_bits;
 
     data_reg = *args++;
     addr_reg = *args++;
     mem_index = *args;
+    s_bits = opc & MO_SIZE;
 
-#ifdef TARGET_WORDS_BIGENDIAN
-    bswap = 1;
-#else
-    bswap = 0;
-#endif
-
-    tcg_out_qemu_tlb(s, addr_reg, opc,
+    tcg_out_qemu_tlb(s, addr_reg, s_bits,
                      offsetof(CPUArchState, tlb_table[mem_index][0].addr_write),
                      offsetof(CPUArchState, tlb_table[mem_index][0].addend));
 
@@ -1660,9 +1660,9 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
     tcg_out_bundle(s, mLX,
                    tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4,
                                TCG_REG_R56, 0, TCG_AREG0),
-                   tcg_opc_l2 ((tcg_target_long) qemu_st_helpers[opc]),
+                   tcg_opc_l2 ((tcg_target_long) qemu_st_helpers[s_bits]),
                    tcg_opc_x2 (TCG_REG_P7, OPC_MOVL_X2, TCG_REG_R2,
-                               (tcg_target_long) qemu_st_helpers[opc]));
+                               (tcg_target_long) qemu_st_helpers[s_bits]));
     tcg_out_bundle(s, MmI,
                    tcg_opc_m3 (TCG_REG_P0, OPC_LD8_M3, TCG_REG_R3,
                                TCG_REG_R2, 8),
@@ -1671,14 +1671,20 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                    tcg_opc_i21(TCG_REG_P7, OPC_MOV_I21, TCG_REG_B6,
                                TCG_REG_R3, 0));
 
-    if (!bswap || opc == 0) {
+    switch (opc) {
+    case MO_8:
+    case MO_16:
+    case MO_32:
+    case MO_64:
         tcg_out_bundle(s, mii,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
                        tcg_opc_a4 (TCG_REG_P7, OPC_ADDS_A4, TCG_REG_R58,
                                    0, data_reg),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
-    } else if (opc == 1) {
+        break;
+
+    case MO_16 | MO_BSWAP:
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
@@ -1692,7 +1698,9 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
         data_reg = TCG_REG_R2;
-    } else if (opc == 2) {
+        break;
+
+    case MO_32 | MO_BSWAP:
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
@@ -1706,7 +1714,9 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, TCG_REG_R2, 0xb));
         data_reg = TCG_REG_R2;
-    } else if (opc == 3) {
+        break;
+
+    case MO_64 | MO_BSWAP:
         tcg_out_bundle(s, miI,
                        tcg_opc_m1 (TCG_REG_P7, OPC_LD8_M1,
                                    TCG_REG_R1, TCG_REG_R2),
@@ -1715,10 +1725,14 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_i3 (TCG_REG_P6, OPC_MUX1_I3,
                                    TCG_REG_R2, data_reg, 0xb));
         data_reg = TCG_REG_R2;
+        break;
+
+    default:
+        tcg_abort();
     }
 
     tcg_out_bundle(s, miB,
-                   tcg_opc_m4 (TCG_REG_P6, opc_st_m4[opc],
+                   tcg_opc_m4 (TCG_REG_P6, opc_st_m4[s_bits],
                                data_reg, TCG_REG_R3),
                    tcg_opc_a5 (TCG_REG_P7, OPC_ADDL_A5, TCG_REG_R59,
                                mem_index, TCG_REG_R0),
@@ -1728,7 +1742,8 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
 
 #else /* !CONFIG_SOFTMMU */
 
-static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
+static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args,
+                                   TCGMemOp opc)
 {
     static uint64_t const opc_ld_m1[4] = {
         OPC_LD1_M1, OPC_LD2_M1, OPC_LD4_M1, OPC_LD8_M1
@@ -1736,17 +1751,13 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
     static uint64_t const opc_sxt_i29[4] = {
         OPC_SXT1_I29, OPC_SXT2_I29, OPC_SXT4_I29, 0
     };
-    int addr_reg, data_reg, s_bits, bswap;
+    int addr_reg, data_reg;
+    TCGMemOp s_bits, bswap;
 
     data_reg = *args++;
     addr_reg = *args++;
-    s_bits = opc & 3;
-
-#ifdef TARGET_WORDS_BIGENDIAN
-    bswap = 1;
-#else
-    bswap = 0;
-#endif
+    s_bits = opc & MO_SIZE;
+    bswap = opc & MO_BSWAP;
 
 #if TARGET_LONG_BITS == 32
     if (GUEST_BASE != 0) {
@@ -1764,8 +1775,8 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
     }
 
-    if (!bswap || s_bits == 0) {
-        if (s_bits == opc) {
+    if (!bswap) {
+        if (!(opc & MO_SIGN)) {
             tcg_out_bundle(s, miI,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
@@ -1779,7 +1790,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i29(TCG_REG_P0, opc_sxt_i29[s_bits],
                                        data_reg, data_reg));
         }
-    } else if (s_bits == 3) {
+    } else if (s_bits == MO_64) {
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
@@ -1787,7 +1798,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        data_reg, data_reg, 0xb));
     } else {
-        if (s_bits == 1) {
+        if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
                            tcg_opc_m1 (TCG_REG_P0, opc_ld_m1[s_bits],
                                        data_reg, TCG_REG_R2),
@@ -1802,7 +1813,7 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                       data_reg, data_reg, 31, 31));
         }
-        if (opc == s_bits) {
+        if (!(opc & MO_SIGN)) {
             tcg_out_bundle(s, miI,
                            tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                            tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
@@ -1833,28 +1844,28 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
     }
 
-    if (bswap && s_bits == 1) {
+    if (bswap && s_bits == MO_16) {
         tcg_out_bundle(s, mII,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 15, 15),
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
-    } else if (bswap && s_bits == 2) {
+    } else if (bswap && s_bits == MO_32) {
         tcg_out_bundle(s, mII,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
                                    data_reg, data_reg, 31, 31),
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
-    } else if (bswap && s_bits == 3) {
+    } else if (bswap && s_bits == MO_64) {
         tcg_out_bundle(s, miI,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
                        tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                    data_reg, data_reg, 0xb));
     }
-    if (s_bits != opc) {
+    if (opc & MO_SIGN) {
         tcg_out_bundle(s, miI,
                        tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
@@ -1864,24 +1875,22 @@ static inline void tcg_out_qemu_ld(TCGContext *s, const TCGArg *args, int opc)
 #endif
 }
 
-static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
+static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args,
+                                   TCGMemOp opc)
 {
     static uint64_t const opc_st_m4[4] = {
         OPC_ST1_M4, OPC_ST2_M4, OPC_ST4_M4, OPC_ST8_M4
     };
-    int addr_reg, data_reg, bswap;
+    int addr_reg, data_reg;
 #if TARGET_LONG_BITS == 64
     uint64_t add_guest_base;
 #endif
+    TCGMemOp s_bits, bswap;
 
     data_reg = *args++;
     addr_reg = *args++;
-
-#ifdef TARGET_WORDS_BIGENDIAN
-    bswap = 1;
-#else
-    bswap = 0;
-#endif
+    s_bits = opc & MO_SIZE;
+    bswap = opc & MO_BSWAP;
 
 #if TARGET_LONG_BITS == 32
     if (GUEST_BASE != 0) {
@@ -1900,7 +1909,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
     }
 
     if (bswap) {
-        if (opc == 1) {
+        if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
                            tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
@@ -1908,7 +1917,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, TCG_REG_R3, 0xb));
             data_reg = TCG_REG_R3;
-        } else if (opc == 2) {
+        } else if (s_bits == MO_32) {
             tcg_out_bundle(s, mII,
                            tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
@@ -1916,7 +1925,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, TCG_REG_R3, 0xb));
             data_reg = TCG_REG_R3;
-        } else if (opc == 3) {
+        } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
                            tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                            tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
@@ -1926,7 +1935,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
         }
     }
     tcg_out_bundle(s, mmI,
-                   tcg_opc_m4 (TCG_REG_P0, opc_st_m4[opc],
+                   tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                data_reg, TCG_REG_R2),
                    tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0),
                    tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
@@ -1939,14 +1948,14 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
         add_guest_base = tcg_opc_m48(TCG_REG_P0, OPC_NOP_M48, 0);
     }
 
-    if (!bswap || opc == 0) {
+    if (!bswap) {
         tcg_out_bundle(s, (GUEST_BASE ? MmI : mmI),
                        add_guest_base,
-                       tcg_opc_m4 (TCG_REG_P0, opc_st_m4[opc],
+                       tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                    data_reg, addr_reg),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
     } else {
-        if (opc == 1) {
+        if (s_bits == MO_16) {
             tcg_out_bundle(s, mII,
                            add_guest_base,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
@@ -1954,7 +1963,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, TCG_REG_R3, 0xb));
             data_reg = TCG_REG_R3;
-        } else if (opc == 2) {
+        } else if (s_bits == MO_32) {
             tcg_out_bundle(s, mII,
                            add_guest_base,
                            tcg_opc_i12(TCG_REG_P0, OPC_DEP_Z_I12,
@@ -1962,7 +1971,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
                            tcg_opc_i3 (TCG_REG_P0, OPC_MUX1_I3,
                                        TCG_REG_R3, TCG_REG_R3, 0xb));
             data_reg = TCG_REG_R3;
-        } else if (opc == 3) {
+        } else if (s_bits == MO_64) {
             tcg_out_bundle(s, miI,
                            add_guest_base,
                            tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
@@ -1971,7 +1980,7 @@ static inline void tcg_out_qemu_st(TCGContext *s, const TCGArg *args, int opc)
             data_reg = TCG_REG_R3;
         }
         tcg_out_bundle(s, miI,
-                       tcg_opc_m4 (TCG_REG_P0, opc_st_m4[opc],
+                       tcg_opc_m4 (TCG_REG_P0, opc_st_m4[s_bits],
                                    data_reg, addr_reg),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0),
                        tcg_opc_i18(TCG_REG_P0, OPC_NOP_I18, 0));
@@ -2203,39 +2212,39 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc,
         break;
 
     case INDEX_op_qemu_ld8u:
-        tcg_out_qemu_ld(s, args, 0);
+        tcg_out_qemu_ld(s, args, MO_UB);
         break;
     case INDEX_op_qemu_ld8s:
-        tcg_out_qemu_ld(s, args, 0 | 4);
+        tcg_out_qemu_ld(s, args, MO_SB);
         break;
     case INDEX_op_qemu_ld16u:
-        tcg_out_qemu_ld(s, args, 1);
+        tcg_out_qemu_ld(s, args, MO_TEUW);
         break;
     case INDEX_op_qemu_ld16s:
-        tcg_out_qemu_ld(s, args, 1 | 4);
+        tcg_out_qemu_ld(s, args, MO_TESW);
         break;
     case INDEX_op_qemu_ld32:
     case INDEX_op_qemu_ld32u:
-        tcg_out_qemu_ld(s, args, 2);
+        tcg_out_qemu_ld(s, args, MO_TEUL);
         break;
     case INDEX_op_qemu_ld32s:
-        tcg_out_qemu_ld(s, args, 2 | 4);
+        tcg_out_qemu_ld(s, args, MO_TESL);
         break;
     case INDEX_op_qemu_ld64:
-        tcg_out_qemu_ld(s, args, 3);
+        tcg_out_qemu_ld(s, args, MO_TEQ);
         break;
 
     case INDEX_op_qemu_st8:
-        tcg_out_qemu_st(s, args, 0);
+        tcg_out_qemu_st(s, args, MO_UB);
         break;
     case INDEX_op_qemu_st16:
-        tcg_out_qemu_st(s, args, 1);
+        tcg_out_qemu_st(s, args, MO_TEUW);
         break;
     case INDEX_op_qemu_st32:
-        tcg_out_qemu_st(s, args, 2);
+        tcg_out_qemu_st(s, args, MO_TEUL);
         break;
     case INDEX_op_qemu_st64:
-        tcg_out_qemu_st(s, args, 3);
+        tcg_out_qemu_st(s, args, MO_TEQ);
         break;
 
     default:
commit 0478f37ce258438d74164dd182b0ae125f174ec6
Author: Michael Tokarev <mjt at tls.msk.ru>
Date:   Sat Nov 16 14:09:14 2013 +0400

    hw/i386/Makefile.obj: use $(PYTHON) to run .py scripts consistently
    
    $(PYTHON) is a Make variable which is set by configure.
    In all other places over the tree, .py files are run from
    Makefiles using this variable, except of a single leftover
    in hw/i386/Makefile.obj (and a nearby place in there uses
    $(PYTHON) correctly).  Fix this leftover too.
    
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>
    Cc: Luigi Rizzo <rizzo at iet.unipi.it>
    Reviewed-by:: Stefan Weil <sw at weilnetz.de>

diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
index 185aacb..09ac433 100644
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -20,7 +20,7 @@ hw/i386/%.hex: $(SRC_PATH)/hw/i386/%.dsl $(SRC_PATH)/scripts/acpi_extract_prepro
 	$(call quiet-command, cpp -P $< -o $*.dsl.i.orig, "  CPP $(TARGET_DIR)$*.dsl.i.orig")
 	$(call quiet-command, $(PYTHON) $(SRC_PATH)/scripts/acpi_extract_preprocess.py $*.dsl.i.orig > $*.dsl.i, "  ACPI_PREPROCESS $(TARGET_DIR)$*.dsl.i")
 	$(call quiet-command, $(IASL) $(call iasl-option,$(IASL),-Pn,) -vs -l -tc -p $* $*.dsl.i $(if $(V), , > /dev/null) 2>&1 ,"  IASL $(TARGET_DIR)$*.dsl.i")
-	$(call quiet-command, $(SRC_PATH)/scripts/acpi_extract.py $*.lst > $*.off, "  ACPI_EXTRACT $(TARGET_DIR)$*.off")
+	$(call quiet-command, $(PYTHON) $(SRC_PATH)/scripts/acpi_extract.py $*.lst > $*.off, "  ACPI_EXTRACT $(TARGET_DIR)$*.off")
 	$(call quiet-command, cat $*.off > $@, "  CAT $(TARGET_DIR)$@")
 else
 #IASL Not present. Restore pre-generated hex files.
commit 52510f8b2c0486e6c2743b1d069b3584ef4524da
Author: Stefan Weil <sw at weilnetz.de>
Date:   Thu Nov 14 19:07:03 2013 +0100

    configure: Use -B switch only for Python versions which support it
    
    Commit 1d984a67a95d88f3e708b077dab8adeb47c38c93 added the -B switch
    unconditionally. This breaks Python versions before 2.6 which don't
    support that switch.
    
    Now configure adds -B only if it is accepted by the Python interpreter.
    
    This modification introduces a small incompatibility because -B might now
    also be added when configure was called with --python=PYTHON_INTERPRETER.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Peter Maydell <peter.maydell at linaro.org>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/configure b/configure
index 9addff1..eb2c31d 100755
--- a/configure
+++ b/configure
@@ -579,7 +579,7 @@ fi
 
 : ${make=${MAKE-make}}
 : ${install=${INSTALL-install}}
-: ${python=${PYTHON-python -B}}
+: ${python=${PYTHON-python}}
 : ${smbd=${SMBD-/usr/sbin/smbd}}
 
 # Default objcc to clang if available, otherwise use CC
@@ -1400,6 +1400,13 @@ if ! $python -c 'import sys; sys.exit(sys.version_info < (2,4) or sys.version_in
       "Use --python=/path/to/python to specify a supported Python."
 fi
 
+# The -B switch was added in Python 2.6.
+# If it is supplied, compiled files are not written.
+# Use it for Python versions which support it.
+if $python -B -c 'import sys; sys.exit(0)' 2>/dev/null; then
+  python="$python -B"
+fi
+
 if test -z "${target_list+xxx}" ; then
     target_list="$default_target_list"
 else
commit 485e741cd15655b4032b07b8a912aa5c7a4f2028
Author: whitearchey <whitearchey at gmail.com>
Date:   Wed Nov 6 10:54:04 2013 +0900

    qga: Fix shutdown command of guest agent to work with SysV
    
    For now guest agent uses following command to shutdown system:
    shutdown -P +0 "blabla"
    but this syntax works only with shutdown command from systemd or upstart,
    because SysV shutdown requires -h switch.
    
    Following patch changes the command so it works with systemd, upstart and SysV
    
    With upstart/systemd qga use one of thee commands, depending on 'mode' parameter:
      shutdown -P +0 "..."
      shutdown -H +0 "..."
      shutdown -r +0 "..."
    SysV equivalents for these are:
      shutdown -h -P +0 "..."
      shutdown -h -H +0 "..."
      shutdown -h -r +0 "..."
    and these retain their meaning with upstart/systemd.
    
    According to FreeBSD manpages, shutdown does not accept -P and -H options. Commands should be:
      shutdown -p +0 "..."
      shutdown -h +0 "..."
      shutdown -r +0 "..."
    
    shutdown in Solaris does not accept any of -hHpPr and does not accept time in "+0" format
    
    Signed-off-by: Michael Avdienko <whitearchey at gmail.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index f453132..10682f5 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -99,7 +99,7 @@ void qmp_guest_shutdown(bool has_mode, const char *mode, Error **err)
         reopen_fd_to_null(1);
         reopen_fd_to_null(2);
 
-        execle("/sbin/shutdown", "shutdown", shutdown_flag, "+0",
+        execle("/sbin/shutdown", "shutdown", "-h", shutdown_flag, "+0",
                "hypervisor initiated shutdown", (char*)NULL, environ);
         _exit(EXIT_FAILURE);
     } else if (pid < 0) {
commit 06d22aa36706a3d6051b74c8a183ab554a0cb808
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Thu Aug 8 17:44:52 2013 +0200

    block: Fail if requested driver is not available
    
    If an explicit driver option is present, but doesn't specify a valid
    driver, then bdrv_open() should fail instead of probing the format.
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index 38078f7..382ea71 100644
--- a/block.c
+++ b/block.c
@@ -1137,6 +1137,11 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
     if (drvname) {
         drv = bdrv_find_format(drvname);
         qdict_del(options, "driver");
+        if (!drv) {
+            error_setg(errp, "Invalid driver: '%s'", drvname);
+            ret = -EINVAL;
+            goto unlink_and_fail;
+        }
     }
 
     if (!drv) {
diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 0a4971d..3a75bda 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -78,6 +78,13 @@ run_qemu -drive file="$TEST_IMG",format=qcow2,unknown_opt=1234
 run_qemu -drive file="$TEST_IMG",format=qcow2,unknown_opt=foo
 
 echo
+echo === Invalid format ===
+echo
+
+run_qemu -drive file="$TEST_IMG",format=foo
+run_qemu -drive file="$TEST_IMG",driver=foo
+
+echo
 echo === Overriding backing file ===
 echo
 
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index d351935..8769c8e 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -17,6 +17,15 @@ Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,unknown_opt=foo
 QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=qcow2,unknown_opt=foo: could not open disk image TEST_DIR/t.qcow2: Block format 'qcow2' used by device 'ide0-hd0' doesn't support the option 'unknown_opt'
 
 
+=== Invalid format ===
+
+Testing: -drive file=TEST_DIR/t.qcow2,format=foo
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,format=foo: 'foo' invalid format
+
+Testing: -drive file=TEST_DIR/t.qcow2,driver=foo
+QEMU_PROG: -drive file=TEST_DIR/t.qcow2,driver=foo: could not open disk image TEST_DIR/t.qcow2: Invalid driver: 'foo'
+
+
 === Overriding backing file ===
 
 Testing: -drive file=TEST_DIR/t.qcow2,driver=qcow2,backing.file.filename=TEST_DIR/t.qcow2.orig -nodefaults
commit f05b328c9d85e57ab871ca73a36220493327a649
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Nov 13 10:33:10 2013 +0100

    MAINTAINERS: add block driver sub-maintainers
    
    There are a number of contributors who maintain block drivers (image
    formats and protocols).  They should be listed in the MAINTAINERS file
    so that get_maintainer.pl lists them.
    
    Note that commits are still merged through Kevin or Stefan's block tree
    but the block driver sub-maintainers are usually the ones to review
    patches.
    
    Acked-by: Kevin Wolf <kwolf at redhat.com>
    Acked-by: Richard W.M. Jones <rjones at redhat.com>
    Acked-by: Stefan Weil <sw at weilnetz.de>
    Acked-by: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
    Acked-by: Paolo Bonzini <pbonzini at redhat.com>
    Acked-by: Jeff Cody <jcody at redhat.com>
    Acked-by: Anthony Liguori <aliguori at amazon.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 836a024..c19133f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -863,3 +863,43 @@ Stable 0.10
 L: qemu-stable at nongnu.org
 T: git git://git.qemu-project.org/qemu-stable-0.10.git
 S: Orphan
+
+Block drivers
+-------------
+VMDK
+M: Fam Zheng <famz at redhat.com>
+S: Supported
+F: block/vmdk.c
+
+RBD
+M: Josh Durgin <josh.durgin at inktank.com>
+S: Supported
+F: block/rbd.c
+
+Sheepdog
+M: MORITA Kazutaka <morita.kazutaka at lab.ntt.co.jp>
+M: Liu Yuan <namei.unix at gmail.com>
+S: Supported
+F: block/sheepdog.c
+
+VHDX
+M: Jeff Cody <jcody at redhat.com>
+S: Supported
+F: block/vhdx*
+
+VDI
+M: Stefan Weil <sw at weilnetz.de>
+S: Maintained
+F: block/vdi.c
+
+iSCSI
+M: Ronnie Sahlberg <ronniesahlberg at gmail.com>
+M: Paolo Bonzini <pbonzini at redhat.com>
+M: Peter Lieven <pl at kamp.de>
+S: Supported
+F: block/iscsi.c
+
+SSH
+M: Richard W.M. Jones <rjones at redhat.com>
+S: Supported
+F: block/ssh.c
commit 36452f12f877c60f004b34641287d74b14c96208
Author: Fam Zheng <famz at redhat.com>
Date:   Wed Nov 13 20:26:49 2013 +0800

    qemu-img: Fix overwriting 'ret' before using
    
    This patch moves ret assignment after reporting original error.
    
    We were lucky to pass qemu-iotests 048 (qemu-img compare case) but when
    I tried to run with TEST_DIR=/tmp (tmpfs), it fails with a "wrong"
    mismatch offset. This fixes two bugs.
    
    In the first if branch, setting ret to 1 before using it makes dead code
    in the next line: pnum is never added to mismatch offset even if ret was
    0.
    
    In the other if branch, currently the output error is always -4:
      strerror(-4) -> Unknown error -4
    
    Added regression test in case 048.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Fam Zheng <famz at redhat.com>

diff --git a/qemu-img.c b/qemu-img.c
index bf3fb4f..b6b5644 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1020,10 +1020,10 @@ static int img_compare(int argc, char **argv)
                 }
                 ret = compare_sectors(buf1, buf2, nb_sectors, &pnum);
                 if (ret || pnum != nb_sectors) {
-                    ret = 1;
                     qprintf(quiet, "Content mismatch at offset %" PRId64 "!\n",
                             sectors_to_bytes(
                                 ret ? sector_num : sector_num + pnum));
+                    ret = 1;
                     goto out;
                 }
             }
@@ -1045,9 +1045,9 @@ static int img_compare(int argc, char **argv)
             }
             if (ret) {
                 if (ret < 0) {
-                    ret = 4;
                     error_report("Error while reading offset %" PRId64 ": %s",
                                  sectors_to_bytes(sector_num), strerror(-ret));
+                    ret = 4;
                 }
                 goto out;
             }
@@ -1092,10 +1092,10 @@ static int img_compare(int argc, char **argv)
                                           filename_over, buf1, quiet);
                 if (ret) {
                     if (ret < 0) {
-                        ret = 4;
                         error_report("Error while reading offset %" PRId64
                                      " of %s: %s", sectors_to_bytes(sector_num),
                                      filename_over, strerror(-ret));
+                        ret = 4;
                     }
                     goto out;
                 }
diff --git a/tests/qemu-iotests/048 b/tests/qemu-iotests/048
index 9b9d118..9def7fc 100755
--- a/tests/qemu-iotests/048
+++ b/tests/qemu-iotests/048
@@ -74,5 +74,39 @@ _compare
 io_pattern write 0 $CLUSTER_SIZE 0 1 123
 _compare
 
+# Test unaligned case of mismatch offsets in allocated clusters
+_make_test_img $size
+io_pattern write 0 512 0 1 100
+cp "$TEST_IMG" "$TEST_IMG2"
+io_pattern write 512 512 0 1 101
+_compare
+
+# Test cluster allocated in one, with IO error
+cat > "$TEST_DIR/blkdebug.conf"<<EOF
+[inject-error]
+event = "read_aio"
+errno = "5"
+once ="off"
+EOF
+_make_test_img $size
+cp "$TEST_IMG" "$TEST_IMG2"
+io_pattern write 512 512 0 1 102
+TEST_IMG="blkdebug:$TEST_DIR/blkdebug.conf:$TEST_IMG" _compare 2>&1 |\
+    _filter_testdir | _filter_imgfmt
+
+# Test cluster allocated in one, with different sizes and IO error in the part
+# that exists only in one image
+cat > "$TEST_DIR/blkdebug.conf"<<EOF
+[inject-error]
+event = "read_aio"
+errno = "5"
+once ="off"
+EOF
+_make_test_img $size
+TEST_IMG="$TEST_IMG2" _make_test_img 0
+io_pattern write 512 512 0 1 102
+TEST_IMG="blkdebug:$TEST_DIR/blkdebug.conf:$TEST_IMG" _compare 2>&1 |\
+    _filter_testdir | _filter_imgfmt
+
 # Cleanup
 status=0
diff --git a/tests/qemu-iotests/048.out b/tests/qemu-iotests/048.out
index 68f65d5..d141e05 100644
--- a/tests/qemu-iotests/048.out
+++ b/tests/qemu-iotests/048.out
@@ -1,5 +1,5 @@
 QA output created by 048
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
 === IO: pattern 45
 qemu-io> wrote 4096/4096 bytes at offset 524288
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
@@ -28,4 +28,29 @@ qemu-io> wrote 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-io> Content mismatch at offset 0!
 1
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
+=== IO: pattern 100
+qemu-io> wrote 512/512 bytes at offset 0
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> === IO: pattern 101
+qemu-io> wrote 512/512 bytes at offset 512
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> Content mismatch at offset 512!
+1
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
+=== IO: pattern 102
+qemu-io> wrote 512/512 bytes at offset 512
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> qemu-img: Error while reading offset 0 of blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+qemu-img: Error while reading offset 0: Input/output error
+4
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 
+Formatting 'TEST_DIR/t.IMGFMT.2', fmt=IMGFMT size=0 
+=== IO: pattern 102
+qemu-io> wrote 512/512 bytes at offset 512
+512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-io> qemu-img: Error while reading offset 0 of blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+qemu-img: Error while reading offset 0 of blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
+Warning: Image size mismatch!
+4
 Cleanup
commit a1144c0dbfa3f820916a135d2d3d6db5635adcc2
Author: Kevin Wolf <kwolf at redhat.com>
Date:   Wed Nov 13 12:00:10 2013 +0100

    qemu-iotests: Test qcow2 count_contiguous_clusters()
    
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/073 b/tests/qemu-iotests/073
new file mode 100755
index 0000000..392db54
--- /dev/null
+++ b/tests/qemu-iotests/073
@@ -0,0 +1,166 @@
+#!/bin/bash
+#
+# Test count_contiguous_clusters in qcow2
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# creator
+owner=kwolf at redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+
+_cleanup()
+{
+    _cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+
+_supported_fmt qcow2
+_supported_proto generic
+_supported_os Linux
+
+CLUSTER_SIZE=64k
+size=128M
+
+echo
+echo "== creating backing file =="
+
+TEST_IMG="$TEST_IMG.base" _make_test_img $size
+
+_make_test_img -b "$TEST_IMG.base"
+$QEMU_IO -c "write -P 0xa5 0 $size" "$TEST_IMG.base" | _filter_qemu_io
+
+echo
+echo "== normal -> unallocated =="
+
+$QEMU_IO -c "write -P 0x11 0 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x11 0x10000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x11 0 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== normal -> compressed =="
+
+$QEMU_IO -c "write -P 0x22 0x20000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -c -P 0x22 0x30000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x22 0x20000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== normal -> zero =="
+
+$QEMU_IO -c "write -P 0x33 0x40000 0x20000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x33 0x40000 0x20000" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "write -P 0 0x40000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -z 0x50000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0x40000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo
+echo "== unallocated -> normal =="
+
+$QEMU_IO -c "write -P 0x44 0x60000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x44 0x70000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x44 0x60000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== unallocated -> compressed =="
+
+$QEMU_IO -c "write -P 0x55 0x80000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "write -c -P 0x55 0x90000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x55 0x80000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== unallocated -> zero =="
+
+$QEMU_IO -c "write -P 0x66 0xa0000 0x20000" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "write -P 0 0xa0000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+$QEMU_IO -c "write -z 0xb0000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0xa0000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo
+echo "== compressed -> normal =="
+
+$QEMU_IO -c "write -c -P 0x77 0xc0000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x77 0xd0000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x77 0xc0000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== compressed -> unallocated =="
+
+$QEMU_IO -c "write -c -P 0x88 0xe0000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x88 0xf0000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0x88 0xe0000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== compressed -> zero =="
+
+$QEMU_IO -c "write -c -P 0 0x100000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -c -P 0x99 0x110000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -z 0x110000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0x100000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo
+echo "== zero -> normal =="
+
+$QEMU_IO -c "write -P 0xaa 0x120000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0 0x130000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -z 0x120000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0x120000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== zero -> unallocated =="
+
+$QEMU_IO -c "write -z 0x140000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -P 0 0x150000 0x10000" "$TEST_IMG.base" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0x140000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+echo
+echo "== zero -> compressed =="
+
+$QEMU_IO -c "write -c -P 0 0x170000 0x10000" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "write -z 0x160000 0x10000" "$TEST_IMG" | _filter_qemu_io
+
+$QEMU_IO -c "read -P 0 0x160000 0x20000" "$TEST_IMG" | _filter_qemu_io
+
+
+_check_test_img
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/073.out b/tests/qemu-iotests/073.out
new file mode 100644
index 0000000..c9b0076
--- /dev/null
+++ b/tests/qemu-iotests/073.out
@@ -0,0 +1,118 @@
+QA output created by 073
+
+== creating backing file ==
+Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728 
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file='TEST_DIR/t.IMGFMT.base' 
+wrote 134217728/134217728 bytes at offset 0
+128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== normal -> unallocated ==
+wrote 65536/65536 bytes at offset 0
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 65536
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 0
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== normal -> compressed ==
+wrote 65536/65536 bytes at offset 131072
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 196608
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 131072
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== normal -> zero ==
+wrote 131072/131072 bytes at offset 262144
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 131072/131072 bytes at offset 262144
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 262144
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 327680
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 262144
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+
+== unallocated -> normal ==
+wrote 65536/65536 bytes at offset 393216
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 458752
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 393216
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== unallocated -> compressed ==
+wrote 65536/65536 bytes at offset 524288
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 589824
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 524288
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== unallocated -> zero ==
+wrote 131072/131072 bytes at offset 655360
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 655360
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 720896
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 655360
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+
+== compressed -> normal ==
+wrote 65536/65536 bytes at offset 786432
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 851968
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 786432
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== compressed -> unallocated ==
+wrote 65536/65536 bytes at offset 917504
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 983040
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 917504
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== compressed -> zero ==
+wrote 65536/65536 bytes at offset 1048576
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1114112
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1114112
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 1048576
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+
+== zero -> normal ==
+wrote 65536/65536 bytes at offset 1179648
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1245184
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1179648
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 1179648
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== zero -> unallocated ==
+wrote 65536/65536 bytes at offset 1310720
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1376256
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 1310720
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+== zero -> compressed ==
+wrote 65536/65536 bytes at offset 1507328
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+wrote 65536/65536 bytes at offset 1441792
+64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 131072/131072 bytes at offset 1441792
+128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+No errors were found on the image.
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index b18b241..b63b18c 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -76,3 +76,4 @@
 068 rw auto
 069 rw auto
 070 rw auto
+073 rw auto
commit 8b7acc79b9adb4dda6cc867b90e3a1e873f4f7e8
Author: Sebastian Huber <sebastian.huber at embedded-brains.de>
Date:   Thu Nov 14 14:53:46 2013 +0100

    smc91c111: Fix receive starvation
    
    In case the smc91c111 interface signals that it cannot receive more
    packets the packets are queued and further reception will be disabled.
    In case the interface is again ready to receive packets notify the upper
    layer.
    
    Signed-off-by: Sebastian Huber <sebastian.huber at embedded-brains.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index f5963e2..a8e29b3 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -185,6 +185,7 @@ static void smc91c111_release_packet(smc91c111_state *s, int packet)
     s->allocated &= ~(1 << packet);
     if (s->tx_alloc == 0x80)
         smc91c111_tx_alloc(s);
+    qemu_flush_queued_packets(qemu_get_queue(s->nic));
 }
 
 /* Flush the TX FIFO.  */
commit 78a52ad5acca7053b774fcc80290e7b7e224c80a
Author: Peter Lieven <pl at kamp.de>
Date:   Tue Nov 12 13:48:07 2013 +0100

    qcow2: fix possible corruption when reading multiple clusters
    
    if multiple sectors spanning multiple clusters are read the
    function count_contiguous_clusters should ensure that the
    cluster type should not change between the clusters.
    
    Especially the for-loop should break when we have one
    or more normal clusters followed by a compressed cluster.
    
    Unfortunately the wrong macro was used in the mask to
    compare the flags.
    
    This was discovered while debugging a data corruption
    issue when converting a compressed qcow2 image to raw.
    qemu-img reads 2MB chunks which span multiple clusters.
    
    CC: qemu-stable at nongnu.org
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index f242244..791083a 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -290,7 +290,7 @@ static int count_contiguous_clusters(uint64_t nb_clusters, int cluster_size,
         uint64_t *l2_table, uint64_t stop_flags)
 {
     int i;
-    uint64_t mask = stop_flags | L2E_OFFSET_MASK | QCOW2_CLUSTER_COMPRESSED;
+    uint64_t mask = stop_flags | L2E_OFFSET_MASK | QCOW_OFLAG_COMPRESSED;
     uint64_t first_entry = be64_to_cpu(l2_table[0]);
     uint64_t offset = first_entry & mask;
 
commit 968854c8a106243eae7a68394ce1cb85dc138837
Author: Amos Kong <akong at redhat.com>
Date:   Sat Nov 9 12:15:47 2013 +0800

    qmp: access the local QemuOptsLists for drive option
    
    Currently we have three QemuOptsList (qemu_common_drive_opts,
    qemu_legacy_drive_opts, and qemu_drive_opts), only qemu_drive_opts
    is added to vm_config_groups[].
    
    This patch changes query-command-line-options to access three local
    QemuOptsLists for drive option, and merge the description items
    together.
    
    Signed-off-by: Amos Kong <akong at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index d955694..330aa4a 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -47,7 +47,6 @@
 #include "sysemu/arch_init.h"
 
 static QTAILQ_HEAD(drivelist, DriveInfo) drives = QTAILQ_HEAD_INITIALIZER(drives);
-extern QemuOptsList qemu_common_drive_opts;
 
 static const char *const if_name[IF_COUNT] = {
     [IF_NONE] = "none",
diff --git a/include/qemu/config-file.h b/include/qemu/config-file.h
index ad4a9e5..508428f 100644
--- a/include/qemu/config-file.h
+++ b/include/qemu/config-file.h
@@ -8,6 +8,7 @@
 QemuOptsList *qemu_find_opts(const char *group);
 QemuOptsList *qemu_find_opts_err(const char *group, Error **errp);
 void qemu_add_opts(QemuOptsList *list);
+void qemu_add_drive_opts(QemuOptsList *list);
 int qemu_set_option(const char *str);
 int qemu_global_option(const char *str);
 void qemu_add_globals(void);
diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
index cd5791e..495dae8 100644
--- a/include/sysemu/sysemu.h
+++ b/include/sysemu/sysemu.h
@@ -193,6 +193,8 @@ QemuOpts *qemu_get_machine_opts(void);
 
 bool usb_enabled(bool default_usb);
 
+extern QemuOptsList qemu_legacy_drive_opts;
+extern QemuOptsList qemu_common_drive_opts;
 extern QemuOptsList qemu_drive_opts;
 extern QemuOptsList qemu_chardev_opts;
 extern QemuOptsList qemu_device_opts;
diff --git a/util/qemu-config.c b/util/qemu-config.c
index a59568d..04da942 100644
--- a/util/qemu-config.c
+++ b/util/qemu-config.c
@@ -8,6 +8,7 @@
 #include "qmp-commands.h"
 
 static QemuOptsList *vm_config_groups[32];
+static QemuOptsList *drive_config_groups[4];
 
 static QemuOptsList *find_list(QemuOptsList **lists, const char *group,
                                Error **errp)
@@ -77,6 +78,59 @@ static CommandLineParameterInfoList *query_option_descs(const QemuOptDesc *desc)
     return param_list;
 }
 
+/* remove repeated entry from the info list */
+static void cleanup_infolist(CommandLineParameterInfoList *head)
+{
+    CommandLineParameterInfoList *pre_entry, *cur, *del_entry;
+
+    cur = head;
+    while (cur->next) {
+        pre_entry = head;
+        while (pre_entry != cur->next) {
+            if (!strcmp(pre_entry->value->name, cur->next->value->name)) {
+                del_entry = cur->next;
+                cur->next = cur->next->next;
+                g_free(del_entry);
+                break;
+            }
+            pre_entry = pre_entry->next;
+        }
+        cur = cur->next;
+    }
+}
+
+/* merge the description items of two parameter infolists */
+static void connect_infolist(CommandLineParameterInfoList *head,
+                             CommandLineParameterInfoList *new)
+{
+    CommandLineParameterInfoList *cur;
+
+    cur = head;
+    while (cur->next) {
+        cur = cur->next;
+    }
+    cur->next = new;
+}
+
+/* access all the local QemuOptsLists for drive option */
+static CommandLineParameterInfoList *get_drive_infolist(void)
+{
+    CommandLineParameterInfoList *head = NULL, *cur;
+    int i;
+
+    for (i = 0; drive_config_groups[i] != NULL; i++) {
+        if (!head) {
+            head = query_option_descs(drive_config_groups[i]->desc);
+        } else {
+            cur = query_option_descs(drive_config_groups[i]->desc);
+            connect_infolist(head, cur);
+        }
+    }
+    cleanup_infolist(head);
+
+    return head;
+}
+
 CommandLineOptionInfoList *qmp_query_command_line_options(bool has_option,
                                                           const char *option,
                                                           Error **errp)
@@ -89,7 +143,12 @@ CommandLineOptionInfoList *qmp_query_command_line_options(bool has_option,
         if (!has_option || !strcmp(option, vm_config_groups[i]->name)) {
             info = g_malloc0(sizeof(*info));
             info->option = g_strdup(vm_config_groups[i]->name);
-            info->parameters = query_option_descs(vm_config_groups[i]->desc);
+            if (!strcmp("drive", vm_config_groups[i]->name)) {
+                info->parameters = get_drive_infolist();
+            } else {
+                info->parameters =
+                    query_option_descs(vm_config_groups[i]->desc);
+            }
             entry = g_malloc0(sizeof(*entry));
             entry->value = info;
             entry->next = conf_list;
@@ -109,6 +168,22 @@ QemuOptsList *qemu_find_opts_err(const char *group, Error **errp)
     return find_list(vm_config_groups, group, errp);
 }
 
+void qemu_add_drive_opts(QemuOptsList *list)
+{
+    int entries, i;
+
+    entries = ARRAY_SIZE(drive_config_groups);
+    entries--; /* keep list NULL terminated */
+    for (i = 0; i < entries; i++) {
+        if (drive_config_groups[i] == NULL) {
+            drive_config_groups[i] = list;
+            return;
+        }
+    }
+    fprintf(stderr, "ran out of space in drive_config_groups");
+    abort();
+}
+
 void qemu_add_opts(QemuOptsList *list)
 {
     int entries, i;
diff --git a/vl.c b/vl.c
index 4ad15b8..a585257 100644
--- a/vl.c
+++ b/vl.c
@@ -2867,6 +2867,9 @@ int main(int argc, char **argv, char **envp)
     module_call_init(MODULE_INIT_QOM);
 
     qemu_add_opts(&qemu_drive_opts);
+    qemu_add_drive_opts(&qemu_legacy_drive_opts);
+    qemu_add_drive_opts(&qemu_common_drive_opts);
+    qemu_add_drive_opts(&qemu_drive_opts);
     qemu_add_opts(&qemu_chardev_opts);
     qemu_add_opts(&qemu_device_opts);
     qemu_add_opts(&qemu_netdev_opts);
commit d48adddac7d1839c8d734506aba6fd39fb9c3834
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Nov 6 16:06:25 2013 +0100

    MAINTAINERS: add block tree repo URLs
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 02b85ee..836a024 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -639,6 +639,8 @@ S: Supported
 F: block*
 F: block/
 F: hw/block/
+T: git git://repo.or.cz/qemu/kevin.git block
+T: git git://github.com/stefanha/qemu.git block
 
 Character Devices
 M: Anthony Liguori <aliguori at amazon.com>
commit c15badee200f9e743e3639cc5e3e7dd62c69332f
Author: Max Reitz <mreitz at redhat.com>
Date:   Wed Nov 6 19:50:45 2013 +0100

    qemu-iotests: Extend 041 for unbacked mirroring
    
    Add a new test case in file 041 for mirroring unbacked images in
    "absolute-paths" mode. This should work, if possible, but most
    importantly, qemu should never crash.
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Wenchao Xia <xiawenc at linux.vnet.ibm.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 6661c03..5d40265 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -677,5 +677,30 @@ class TestSetSpeed(ImageMirroringTestCase):
 
         self.wait_ready_and_cancel()
 
+class TestUnbackedSource(ImageMirroringTestCase):
+    image_len = 2 * 1024 * 1024 # MB
+
+    def setUp(self):
+        qemu_img('create', '-f', iotests.imgfmt, test_img,
+                 str(TestUnbackedSource.image_len))
+        self.vm = iotests.VM().add_drive(test_img)
+        self.vm.launch()
+
+    def tearDown(self):
+        self.vm.shutdown()
+        os.remove(test_img)
+        os.remove(target_img)
+
+    def test_absolute_paths(self):
+        self.assert_no_active_block_jobs()
+
+        for sync_mode in ['full', 'top', 'none']:
+            result = self.vm.qmp('drive-mirror', device='drive0',
+                                 sync=sync_mode, target=target_img,
+                                 mode='absolute-paths')
+            self.assert_qmp(result, 'return', {})
+            self.complete_and_wait()
+            self.assert_no_active_block_jobs()
+
 if __name__ == '__main__':
     iotests.main(supported_fmts=['qcow2', 'qed'])
diff --git a/tests/qemu-iotests/041.out b/tests/qemu-iotests/041.out
index 42314e9..4fd1c2d 100644
--- a/tests/qemu-iotests/041.out
+++ b/tests/qemu-iotests/041.out
@@ -1,5 +1,5 @@
-........................
+.........................
 ----------------------------------------------------------------------
-Ran 24 tests
+Ran 25 tests
 
 OK
commit 1452686495922b81d6cf43edf025c1aef15965c0
Author: Max Reitz <mreitz at redhat.com>
Date:   Wed Nov 6 19:50:44 2013 +0100

    block/drive-mirror: Check for NULL backing_hd
    
    It should be possible to execute the QMP "drive-mirror" command in
    "none" sync mode and "absolute-paths" mode even for block devices
    lacking a backing file.
    
    "absolute-paths" does in fact not require a backing file to be present,
    as can be seen from the "top" sync mode code path. "top" basically
    states that the device should indeed have a backing file - however, the
    current code catches the case if it doesn't and then simply treats it as
    "full" sync mode, creating a target image without a backing file (in
    "absolute-paths" mode). Thus, "absolute-paths" does not imply the target
    file must indeed have a backing file.
    
    Therefore, the target file may be left unbacked in case of "none" sync
    mode as well, if the specified device is not backed either. Currently,
    qemu will crash trying to dereference the backing file pointer since it
    assumes that it will always be non-NULL in that case ("none" with
    "absolute-paths").
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Wenchao Xia <xiawenc at linux.vnet.ibm.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index 86e6bff..d955694 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -2029,7 +2029,9 @@ void qmp_drive_mirror(const char *device, const char *target,
         return;
     }
 
-    if (sync == MIRROR_SYNC_MODE_FULL && mode != NEW_IMAGE_MODE_EXISTING) {
+    if ((sync == MIRROR_SYNC_MODE_FULL || !source)
+        && mode != NEW_IMAGE_MODE_EXISTING)
+    {
         /* create new image w/o backing file */
         assert(format && drv);
         bdrv_img_create(target, format,
commit 1296c2f0bc8283164c925bf587e497511de7f569
Author: Max Reitz <mreitz at redhat.com>
Date:   Thu Nov 7 19:47:48 2013 +0100

    qapi-schema: Update description for NewImageMode
    
    If the NewImageMode is "absolute-paths" but no backing file is available
    (e.g., when mirroring a device with an unbacked image), the target image
    will not be backed either. This patch updates the documentation in
    qapi-schema.json accordingly.
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index 76c98a7..83fa485 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -1736,7 +1736,8 @@
 # @existing: QEMU should look for an existing image file.
 #
 # @absolute-paths: QEMU should create a new image with absolute paths
-# for the backing file.
+# for the backing file. If there is no backing file available, the new
+# image will not be backed either.
 #
 # Since: 1.1
 ##
commit b04b6b6ec3a1e0ba90c2f58617286d9fc35fa372
Author: Fam Zheng <famz at redhat.com>
Date:   Fri Nov 8 11:26:49 2013 +0800

    block: Print its file name if backing file opening failed
    
    If backing file doesn't exist, the error message is confusing and
    misleading:
    
        $ qemu /tmp/a.qcow2
        qemu: could not open disk image /tmp/a.qcow2: Could not open file: No
        such file or directory
    
    But...
    
        $ ls /tmp/a.qcow2
        /tmp/a.qcow2
    
        $ qemu-img info /tmp/a.qcow2
        image: /tmp/a.qcow2
        file format: qcow2
        virtual size: 8.0G (8589934592 bytes)
        disk size: 196K
        cluster_size: 65536
        backing file: /tmp/b.qcow2
    
    Because...
    
        $ ls /tmp/b.qcow2
        ls: cannot access /tmp/b.qcow2: No such file or directory
    
    This is not intuitive. It's better to have the missing file's name in
    the error message. With this patch:
    
        $ qemu-io -c 'read 0 512' /tmp/a.qcow2
        qemu-io: can't open device /tmp/a.qcow2: Could not open backing
        file: Could not open '/stor/vm/arch.raw': No such file or directory
        no file open, try 'help open'
    
    Which is a little bit better.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Signed-off-by: Kevin Wolf <kwolf at redhat.com>

diff --git a/block.c b/block.c
index 6d5c804..38078f7 100644
--- a/block.c
+++ b/block.c
@@ -1009,7 +1009,9 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *options, Error **errp)
         bdrv_unref(bs->backing_hd);
         bs->backing_hd = NULL;
         bs->open_flags |= BDRV_O_NO_BACKING;
-        error_propagate(errp, local_err);
+        error_setg(errp, "Could not open backing file: %s",
+                   error_get_pretty(local_err));
+        error_free(local_err);
         return ret;
     }
     pstrcpy(bs->backing_file, sizeof(bs->backing_file),
diff --git a/block/raw-posix.c b/block/raw-posix.c
index ace5d96..f836c8e 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -310,7 +310,6 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
         if (ret == -EROFS) {
             ret = -EACCES;
         }
-        error_setg_errno(errp, -ret, "Could not open file");
         goto fail;
     }
     s->fd = fd;
diff --git a/block/raw-win32.c b/block/raw-win32.c
index 2741e4d..2bad5a3 100644
--- a/block/raw-win32.c
+++ b/block/raw-win32.c
@@ -280,7 +280,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
         } else {
             ret = -EINVAL;
         }
-        error_setg_errno(errp, -ret, "Could not open file");
         goto fail;
     }
 
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 15deef6..d351935 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -226,6 +226,6 @@ Testing: -drive file=foo:bar
 QEMU_PROG: -drive file=foo:bar: could not open disk image foo:bar: Unknown protocol
 
 Testing: -drive file.filename=foo:bar
-QEMU_PROG: -drive file.filename=foo:bar: could not open disk image ide0-hd0: Could not open file: No such file or directory
+QEMU_PROG: -drive file.filename=foo:bar: could not open disk image ide0-hd0: Could not open 'foo:bar': No such file or directory
 
 *** done
diff --git a/tests/qemu-iotests/069.out b/tests/qemu-iotests/069.out
index 3648814..b48306d 100644
--- a/tests/qemu-iotests/069.out
+++ b/tests/qemu-iotests/069.out
@@ -4,5 +4,5 @@ QA output created by 069
 
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=131072 
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=131072 backing_file='TEST_DIR/t.IMGFMT.base' 
-qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open file: No such file or directory
+qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open backing file: Could not open 'TEST_DIR/t.IMGFMT.base': No such file or directory
 *** done
commit 7f1bb742be39184b469d53c0901240b12bb85589
Author: Igor Mammedov <imammedo at redhat.com>
Date:   Wed Nov 6 13:48:40 2013 +0100

    pc: disable pci-info
    
    The BIOS that we ship in 1.7 does not use pci info
    from host and so far isn't going to use it.
    Taking in account problems it caused see 9604f70fdf and
    to avoid future incompatibility issues, it's safest to
    disable that interface by default for all machine types
    including 1.7 as it was never exposed/used by guest.
    And properly remove/cleanup it during 1.8 development cycle.
    
    Signed-off-by: Igor Mammedov <imammedo at redhat.com>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 4fdb7b6..094c421 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -58,7 +58,7 @@ static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
 static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
 
 static bool has_pvpanic;
-static bool has_pci_info = true;
+static bool has_pci_info;
 static bool has_acpi_build = true;
 
 /* PC hardware initialisation */
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 4c191d3..1af8e2b 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -48,7 +48,7 @@
 #define MAX_SATA_PORTS     6
 
 static bool has_pvpanic;
-static bool has_pci_info = true;
+static bool has_pci_info;
 static bool has_acpi_build = true;
 
 /* PC hardware initialisation */
commit 5c5432e7d630592ddcc1876ac8a1505f8f14ef15
Merge: 29c5b77 dce07e0
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:49:27 2013 -0800

    Merge remote-tracking branch 'luiz/queue/qmp' into staging
    
    # By Luiz Capitulino (1) and Richard Henderson (1)
    # Via Luiz Capitulino
    * luiz/queue/qmp:
      MAINTAINERS: add git tree info for HMP, QMP and QAPI
      Adjust qapi-visit for python-2.4.3
    
    Message-id: 1384281985-11100-1-git-send-email-lcapitulino at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 29c5b77d3dd7e970c7bd57cd1d73734ae01e29d2
Merge: b873a55 ef9e455
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:48:35 2013 -0800

    Merge remote-tracking branch 'mst/tags/for_anthony' into staging
    
    pci, pc, virtio bug fixes
    
    This reverts PCI master abort support - we'll want it
    eventually but it exposes too many core bugs to be safe for 1.7.
    This also reverts a recent exec.c change that was an
    attempt to work-around some of these core bugs.
    
    Also included are small fixes in pc and virtio,
    and a core loader fix for PPC bamboo.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    
    # gpg: Signature made Sun 10 Nov 2013 05:13:22 AM PST using RSA key ID D28D5469
    # gpg: Can't check signature: public key not found
    
    # By Michael S. Tsirkin (3) and others
    # Via Michael S. Tsirkin
    * mst/tags/for_anthony:
      Revert "exec: limit system memory size"
      Revert "hw/pci: partially handle pci master abort"
      loader: drop return value for rom_add_blob_fixed
      acpi-build: disable with -no-acpi
      virtio-net: only delete bh that existed
      Fix pc migration from qemu <= 1.5
    
    Message-id: 1384159176-31662-1-git-send-email-mst at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit b873a55cf45f1fbff7026de885848d52939d18e1
Merge: deb0f50 cc386e9
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:48:02 2013 -0800

    Merge remote-tracking branch 'stefanha/net' into staging
    
    # By Dmitry Fleytman (1) and others
    # Via Stefan Hajnoczi
    * stefanha/net:
      virtio-net: broken RX filtering logic fixed
      net: fix qemu_flush_queued_packets() in presence of a hub
      net: disallow to specify multicast MAC address
    
    Message-id: 1383928804-28866-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit deb0f500651317863922964c87b4fa64eecdbd73
Merge: 70c4c5b 7e38200
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:47:44 2013 -0800

    Merge remote-tracking branch 'stefanha/block' into staging
    
    # By Jeff Cody (26) and others
    # Via Stefan Hajnoczi
    * stefanha/block: (37 commits)
      block: Round up total_sectors
      block: vhdx qemu-iotest - log replay of data sector
      block: qemu-iotests for vhdx, add write test support
      block: vhdx - update _make_test_img() to filter out vhdx options
      block: vhdx - add .bdrv_create() support
      block: vhdx - fix comment typos in header, fix incorrect struct fields
      block: vhdx - break out code operations to functions
      block: vhdx - move more endian translations to vhdx-endian.c
      block: vhdx - remove BAT file offset bit shifting
      block: vhdx write support
      block: vhdx - add log write support
      block: vhdx - add region overlap detection for image files
      block: vhdx - log parsing, replay, and flush support
      block: vhdx code movement - move vhdx_close() above vhdx_open()
      block: vhdx - update log guid in header, and first write tracker
      block: vhdx - break endian translation functions out
      block: vhdx - log support struct and defines
      block: vhdx code movement - VHDXMetadataEntries and BDRVVHDXState to header.
      block: vhdx - add header update capability.
      block: vhdx - minor comments and typo correction.
      ...
    
    Message-id: 1383905551-16411-1-git-send-email-stefanha at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 70c4c5b5621f6d954843547bcab9db857d882e99
Merge: 9f43a3f ebbfd5a
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:47:06 2013 -0800

    Merge remote-tracking branch 'filippov/tags/20131108-xtensa' into staging
    
    Two small fixes for 1.7:
    
    - add missing debug feature to dc233c xtensa core;
    - fix qemu abort caused by gdb attempt to invalidate a breakpoint by
      virtual address for which there's no mapping.
    
    # gpg: Signature made Thu 07 Nov 2013 09:32:19 PM PST using RSA key ID F83FA044
    # gpg: Can't check signature: public key not found
    
    # By Max Filippov
    # Via Max Filippov
    * filippov/tags/20131108-xtensa:
      target-xtensa: add missing DEBUG section to dc233c config
      exec: fix breakpoint_invalidate when pc may not be translated
    
    Message-id: 1383889643-21621-1-git-send-email-jcmvbkbc at gmail.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 9f43a3f541019a5836247c8cfdfc5fef89cf077d
Merge: 6bddfae 73204cf
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:46:23 2013 -0800

    Merge remote-tracking branch 'kraxel/audio.3' into staging
    
    # By Gerd Hoffmann
    # Via Gerd Hoffmann
    * kraxel/audio.3:
      ossaudio: check for oss support in oss_audio_init
      Revert "ossaudio: do not enable by default"
    
    Message-id: 1383823947-5132-1-git-send-email-kraxel at redhat.com
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 6bddfae306001c6e474ff97ef59c518568ea5af4
Merge: 964668b 20d155b
Author: Anthony Liguori <aliguori at amazon.com>
Date:   Wed Nov 13 11:45:58 2013 -0800

    Merge remote-tracking branch 'sweil/mingw' into staging
    
    # By Stefan Weil
    # Via Stefan Weil
    * sweil/mingw:
      linux-user: Fix stat64 syscall for SPARC64
      configure: Add config.status to recreate the current configuration
      nsis: Improved support for parallel installation of 32 and 64 bit code
    
    Message-id: 1383804909-376-1-git-send-email-sw at weilnetz.de
    Signed-off-by: Anthony Liguori <aliguori at amazon.com>

commit 3325a83627de3e3bd9a97548f13bbb53b354d970
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Nov 10 15:58:19 2013 +0100

    console: Remove unused debug code
    
    The local function console_print_text_attributes is no longer used since
    commit 7d6ba01c3741bc32ae252bf64a5fd3f930c2df4f.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/ui/console.c b/ui/console.c
index aad4fc9..199ba69 100644
--- a/ui/console.c
+++ b/ui/console.c
@@ -409,39 +409,6 @@ static const pixman_color_t color_table_rgb[2][8] = {
     }
 };
 
-#ifdef DEBUG_CONSOLE
-static void console_print_text_attributes(TextAttributes *t_attrib, char ch)
-{
-    if (t_attrib->bold) {
-        printf("b");
-    } else {
-        printf(" ");
-    }
-    if (t_attrib->uline) {
-        printf("u");
-    } else {
-        printf(" ");
-    }
-    if (t_attrib->blink) {
-        printf("l");
-    } else {
-        printf(" ");
-    }
-    if (t_attrib->invers) {
-        printf("i");
-    } else {
-        printf(" ");
-    }
-    if (t_attrib->unvisible) {
-        printf("n");
-    } else {
-        printf(" ");
-    }
-
-    printf(" fg: %d bg: %d ch:'%2X' '%c'\n", t_attrib->fgcol, t_attrib->bgcol, ch, ch);
-}
-#endif
-
 static void vga_putcharxy(QemuConsole *s, int x, int y, int ch,
                           TextAttributes *t_attrib)
 {
commit ba1c29310904b34265203e86e133fe177e9f6511
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Nov 10 18:49:11 2013 +0100

    qga: Fix compilation for old versions of MinGW
    
    While MinGW-w64 can compile the qga code, MinGW from Debian lenny
    (gcc-mingw32 4.4.2-3) shows these errors:
    
    In file included from qga/vss-win32.c:17:
    qga/vss-win32/requester.h:31:
     error: expected »=«, »,«, »;«, »asm« or »__attribute__« before »requester_init«
    qga/vss-win32/requester.h:32:
     error: expected »=«, »,«, »;«, »asm« or »__attribute__« before »requester_deinit«
    
    The macro STDAPI is unknown, so add the missing include file which
    defines it.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qga/vss-win32/requester.h b/qga/vss-win32/requester.h
index cffec01..374f9b8 100644
--- a/qga/vss-win32/requester.h
+++ b/qga/vss-win32/requester.h
@@ -13,6 +13,7 @@
 #ifndef VSS_WIN32_REQUESTER_H
 #define VSS_WIN32_REQUESTER_H
 
+#include <basetyps.h>           /* STDAPI */
 #include "qemu/compiler.h"
 
 #ifdef __cplusplus
commit fe863ab9855478e693d63f306141eb242217b424
Author: Alex Bennée <alex at bennee.com>
Date:   Wed Nov 6 10:43:37 2013 +0000

    .travis.yml: basic compile and check recipes
    
    This adds a build matrix definition for travis-ci.org continuous
    integration service. It is usable on any public repository hosted on
    GitHub. Once you have created an account signed into Travis you can
    enable it on selected projects via travis-ci.org/profile. Alternatively
    you can configure the service hooks on GitHub via the repository
    Settings tab,then Service Hooks and selecting Travis.
    
    Once setup Travis will automatically test every push as well as any pull
    requests submitted to that repository.
    
    The build matrix is currently split by target architecture (see TARGETS
    environment variable) because a full build of QEMU can take some time.
    This way you get quick feedback for any obvious errors. The additional
    environment variables exist to allow additional builds to tweak the
    environment. These are:
    
    EXTRA_CONFIG - extra terms passed to configure
    EXTRA_PKGS - extra dev packages to install
    TEST_CMD - default "make check", can be overridden
    
    I've confined the additional stuff to x86/x86_64 for convenience.
    
    As Travis supports clang the main builds are done twice (once for gcc
    and once for clang). However clang is disabled for the debug/trace
    builds for the purposes of brevity.
    
    Other wrinkles:
    
     * The lttng user-space tracing back-end is disabled
       (it is currently horribly broken)
     * The ftrace back-end doesn't run "make check"
       (it requires a mounted debugfs to work)
     * There are two debug enabled build (with and without TCG interpreter)
    
    Signed-off-by: Alex Bennée <alex at bennee.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/.travis.yml b/.travis.yml
new file mode 100644
index 0000000..90f1676
--- /dev/null
+++ b/.travis.yml
@@ -0,0 +1,71 @@
+language: c
+python:
+  - "2.4"
+compiler:
+  - gcc
+  - clang
+env:
+  global:
+    - TEST_CMD="make check"
+    - EXTRA_CONFIG=""
+    # Development packages, EXTRA_PKGS saved for additional builds
+    - CORE_PKGS="libusb-1.0-0-dev libiscsi-dev librados-dev libncurses5-dev"
+    - NET_PKGS="libseccomp-dev libgnutls-dev libssh2-1-dev  libspice-server-dev libspice-protocol-dev libnss3-dev"
+    - GUI_PKGS="libgtk-3-dev libvte-2.90-dev libsdl1.2-dev libpng12-dev libpixman-1-dev"
+    - EXTRA_PKGS=""
+  matrix:
+  - TARGETS=alpha-softmmu,alpha-linux-user
+  - TARGETS=arm-softmmu,arm-linux-user
+  - TARGETS=cris-softmmu
+  - TARGETS=i386-softmmu,x86_64-softmmu
+  - TARGETS=lm32-softmmu
+  - TARGETS=m68k-softmmu
+  - TARGETS=microblaze-softmmu,microblazeel-softmmu
+  - TARGETS=mips-softmmu,mips64-softmmu,mips64el-softmmu,mipsel-softmmu
+  - TARGETS=moxie-softmmu
+  - TARGETS=or32-softmmu,
+  - TARGETS=ppc-softmmu,ppc64-softmmu,ppcemb-softmmu
+  - TARGETS=s390x-softmmu
+  - TARGETS=sh4-softmmu,sh4eb-softmmu
+  - TARGETS=sparc-softmmu,sparc64-softmmu
+  - TARGETS=unicore32-softmmu
+  - TARGETS=xtensa-softmmu,xtensaeb-softmmu
+before_install:
+  - git submodule update --init --recursive
+  - sudo apt-get update -qq
+  - sudo apt-get install -qq ${CORE_PKGS} ${NET_PKGS} ${GUI_PKGS} ${EXTRA_PKGS}
+script: "./configure --target-list=${TARGETS} ${EXTRA_CONFIG} && make && ${TEST_CMD}"
+matrix:
+  # We manually include a number of additional build for non-standard bits
+  include:
+    # Debug related options
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-debug"
+      compiler: gcc
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-debug --enable-tcg-interpreter"
+      compiler: gcc
+    # Currently configure doesn't force --disable-pie
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-gprof --enable-gcov --disable-pie"
+      compiler: gcc
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_PKGS="sparse"
+           EXTRA_CONFIG="--enable-sparse"
+      compiler: gcc
+    # All the trace backends (apart from dtrace)
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-trace-backend=stderr"
+      compiler: gcc
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-trace-backend=simple"
+      compiler: gcc
+    - env: TARGETS=i386-softmmu,x86_64-softmmu
+           EXTRA_CONFIG="--enable-trace-backend=ftrace"
+           TEST_CMD=""
+      compiler: gcc
+    # This disabled make check for the ftrace backend which needs more setting up
+    # Currently broken on 12.04 due to mis-packaged liburcu and changed API, will be pulled.
+    #- env: TARGETS=i386-softmmu,x86_64-softmmu
+    #       EXTRA_PKGS="liblttng-ust-dev liburcu-dev"
+    #       EXTRA_CONFIG="--enable-trace-backend=ust"
commit 25a666d2ec0ab6e84489d50495b4c3e250531426
Author: Cole Robinson <crobinso at redhat.com>
Date:   Fri Oct 11 11:52:30 2013 -0400

    pci-assign: Fix error_report of pci-stub message
    
    Using multiple calls to error_report here means every line is
    prefaced with the (potentially long) pci-assign command line
    arguments.
    
    Use a single error_printf to preserve the intended formatting.
    Since this code path is always preceded by an error_report call,
    we don't lose the command line reporting.
    
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Reviewed-by: Markus Armbruster <armbru at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index 011764f..aae4309 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -791,26 +791,22 @@ static void assign_failed_examine(AssignedDevice *dev)
         goto fail;
     }
 
-    error_report("*** The driver '%s' is occupying your device "
-                 "%04x:%02x:%02x.%x.",
-                 ns, dev->host.domain, dev->host.bus, dev->host.slot,
-                 dev->host.function);
-    error_report("***");
-    error_report("*** You can try the following commands to free it:");
-    error_report("***");
-    error_report("*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/"
-                 "new_id", vendor_id, device_id);
-    error_report("*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
-                 "%s/unbind",
-                 dev->host.domain, dev->host.bus, dev->host.slot,
-                 dev->host.function, ns);
-    error_report("*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
-                 "pci-stub/bind",
-                 dev->host.domain, dev->host.bus, dev->host.slot,
-                 dev->host.function);
-    error_report("*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub"
-                 "/remove_id", vendor_id, device_id);
-    error_report("***");
+    error_printf("*** The driver '%s' is occupying your device "
+        "%04x:%02x:%02x.%x.\n"
+        "***\n"
+        "*** You can try the following commands to free it:\n"
+        "***\n"
+        "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/new_id\n"
+        "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/%s/unbind\n"
+        "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
+        "pci-stub/bind\n"
+        "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/remove_id\n"
+        "***",
+        ns, dev->host.domain, dev->host.bus, dev->host.slot,
+        dev->host.function, vendor_id, device_id,
+        dev->host.domain, dev->host.bus, dev->host.slot, dev->host.function,
+        ns, dev->host.domain, dev->host.bus, dev->host.slot,
+        dev->host.function, vendor_id, device_id);
 
     return;
 
commit 669aa3f6bdf49663cb5cbceac605c020750263d6
Author: Fam Zheng <famz at redhat.com>
Date:   Fri Nov 1 17:35:29 2013 +0800

    qapi: Fix comment for create-type to match code.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/qapi-schema.json b/qapi-schema.json
index 81a375b..76c98a7 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -227,7 +227,7 @@
 ##
 # @ImageInfoSpecificVmdk:
 #
-# @create_type: The create type of VMDK image
+# @create-type: The create type of VMDK image
 #
 # @cid: Content id of image
 #
commit 8111d0287821a9b2a2faefbf0be1f345dbe93222
Author: Antony Pavlov <antonynpavlov at gmail.com>
Date:   Tue Oct 29 08:36:31 2013 +0400

    vl: fix build when configured with no graphic support
    
    The following error occurs when building with no graphic output support:
    
      vl.c: In function ‘main’:
      vl.c:2829:19: error: variable ‘ds’ set but not used [-Werror=unused-but-set-variable]
           DisplayState *ds;
                         ^
      cc1: all warnings being treated as errors
    
    To reproduce this issue, just run:
    
      $ ./configure \
          --disable-curses \
          --disable-sdl \
          --disable-cocoa \
          --disable-gtk \
          --disable-vnc \
          --enable-werror
      $ make vl.o
    
    Signed-off-by: Antony Pavlov <antonynpavlov at gmail.com>
    Reviewed-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/vl.c b/vl.c
index 4ad15b8..b5ec266 100644
--- a/vl.c
+++ b/vl.c
@@ -4267,6 +4267,7 @@ int main(int argc, char **argv, char **envp)
     /* init local displays */
     switch (display_type) {
     case DT_NOGRAPHIC:
+        (void)ds;	/* avoid warning if no display is configured */
         break;
 #if defined(CONFIG_CURSES)
     case DT_CURSES:
commit d9570cadd54115dd1b2bdff7d43c0d4f840e65e5
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Tue Oct 29 15:44:31 2013 +0100

    usb: drop unused USBNetState.inpkt field
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 660d774..4c532b7 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -637,7 +637,6 @@ typedef struct USBNetState {
     unsigned int out_ptr;
     uint8_t out_buf[2048];
 
-    USBPacket *inpkt;
     unsigned int in_ptr, in_len;
     uint8_t in_buf[2048];
 
commit 4c6968c7a03d5e4805dad09aba0491e12b16a596
Author: Jan Krupa <JKrupa at suse.com>
Date:   Wed Oct 16 14:40:06 2013 +0200

    qemu-char: add missing characters used in keymaps
    
    This patch adds all missing characters used in regional keymap
    files which already exist in QEMU. I checked for the missing
    characters by going through all of the keymaps and matching that
    with records in vnc_keysym.h. If the key wasn't found I looked
    it up in libxkbcommon library [1]. If I understood it correctly
    this is also the same place where most of the keymaps were
    exported from according to the comment on the first line in those
    files. I was able to find all symbols except "quotebl" used
    in Netherland keymap.
    
    I tested this update with Czech keyboard by myself. I also asked
    Matej Serc to test Slovenian keyboard layout - he reported problems
    with it few days ago on this mailing list. Both layouts seems
    to work fine. I wasn't able to test the remaining layouts but
    since this change doesn't modify any existing symbols, just adds
    new ones, I don't expect any sideeffects.
    
    [1] http://cgit.freedesktop.org/xorg/lib/libxkbcommon
    
    Signed-off-by: Jan Krupa <jkrupa at suse.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/ui/vnc_keysym.h b/ui/vnc_keysym.h
index 72c01d1..1dc039f 100644
--- a/ui/vnc_keysym.h
+++ b/ui/vnc_keysym.h
@@ -350,5 +350,370 @@ static const name2keysym_t name2keysym[]={
 {"Katakana_Real", 0xff25},
 {"Eisu_toggle", 0xff30},
 
+{"abovedot",                      0x01ff},  /* U+02D9 DOT ABOVE */
+{"amacron",                       0x03e0},  /* U+0101 LATIN SMALL LETTER A WITH MACRON */
+{"Amacron",                       0x03c0},  /* U+0100 LATIN CAPITAL LETTER A WITH MACRON */
+{"Arabic_ain",                    0x05d9},  /* U+0639 ARABIC LETTER AIN */
+{"Arabic_alef",                   0x05c7},  /* U+0627 ARABIC LETTER ALEF */
+{"Arabic_alefmaksura",            0x05e9},  /* U+0649 ARABIC LETTER ALEF MAKSURA */
+{"Arabic_beh",                    0x05c8},  /* U+0628 ARABIC LETTER BEH */
+{"Arabic_comma",                  0x05ac},  /* U+060C ARABIC COMMA */
+{"Arabic_dad",                    0x05d6},  /* U+0636 ARABIC LETTER DAD */
+{"Arabic_dal",                    0x05cf},  /* U+062F ARABIC LETTER DAL */
+{"Arabic_damma",                  0x05ef},  /* U+064F ARABIC DAMMA */
+{"Arabic_dammatan",               0x05ec},  /* U+064C ARABIC DAMMATAN */
+{"Arabic_fatha",                  0x05ee},  /* U+064E ARABIC FATHA */
+{"Arabic_fathatan",               0x05eb},  /* U+064B ARABIC FATHATAN */
+{"Arabic_feh",                    0x05e1},  /* U+0641 ARABIC LETTER FEH */
+{"Arabic_ghain",                  0x05da},  /* U+063A ARABIC LETTER GHAIN */
+{"Arabic_ha",                     0x05e7},  /* U+0647 ARABIC LETTER HEH */
+{"Arabic_hah",                    0x05cd},  /* U+062D ARABIC LETTER HAH */
+{"Arabic_hamza",                  0x05c1},  /* U+0621 ARABIC LETTER HAMZA */
+{"Arabic_hamzaonalef",            0x05c3},  /* U+0623 ARABIC LETTER ALEF WITH HAMZA ABOVE */
+{"Arabic_hamzaonwaw",             0x05c4},  /* U+0624 ARABIC LETTER WAW WITH HAMZA ABOVE */
+{"Arabic_hamzaonyeh",             0x05c6},  /* U+0626 ARABIC LETTER YEH WITH HAMZA ABOVE */
+{"Arabic_hamzaunderalef",         0x05c5},  /* U+0625 ARABIC LETTER ALEF WITH HAMZA BELOW */
+{"Arabic_jeem",                   0x05cc},  /* U+062C ARABIC LETTER JEEM */
+{"Arabic_kaf",                    0x05e3},  /* U+0643 ARABIC LETTER KAF */
+{"Arabic_kasra",                  0x05f0},  /* U+0650 ARABIC KASRA */
+{"Arabic_kasratan",               0x05ed},  /* U+064D ARABIC KASRATAN */
+{"Arabic_khah",                   0x05ce},  /* U+062E ARABIC LETTER KHAH */
+{"Arabic_lam",                    0x05e4},  /* U+0644 ARABIC LETTER LAM */
+{"Arabic_maddaonalef",            0x05c2},  /* U+0622 ARABIC LETTER ALEF WITH MADDA ABOVE */
+{"Arabic_meem",                   0x05e5},  /* U+0645 ARABIC LETTER MEEM */
+{"Arabic_noon",                   0x05e6},  /* U+0646 ARABIC LETTER NOON */
+{"Arabic_qaf",                    0x05e2},  /* U+0642 ARABIC LETTER QAF */
+{"Arabic_question_mark",          0x05bf},  /* U+061F ARABIC QUESTION MARK */
+{"Arabic_ra",                     0x05d1},  /* U+0631 ARABIC LETTER REH */
+{"Arabic_sad",                    0x05d5},  /* U+0635 ARABIC LETTER SAD */
+{"Arabic_seen",                   0x05d3},  /* U+0633 ARABIC LETTER SEEN */
+{"Arabic_semicolon",              0x05bb},  /* U+061B ARABIC SEMICOLON */
+{"Arabic_shadda",                 0x05f1},  /* U+0651 ARABIC SHADDA */
+{"Arabic_sheen",                  0x05d4},  /* U+0634 ARABIC LETTER SHEEN */
+{"Arabic_sukun",                  0x05f2},  /* U+0652 ARABIC SUKUN */
+{"Arabic_tah",                    0x05d7},  /* U+0637 ARABIC LETTER TAH */
+{"Arabic_tatweel",                0x05e0},  /* U+0640 ARABIC TATWEEL */
+{"Arabic_teh",                    0x05ca},  /* U+062A ARABIC LETTER TEH */
+{"Arabic_tehmarbuta",             0x05c9},  /* U+0629 ARABIC LETTER TEH MARBUTA */
+{"Arabic_thal",                   0x05d0},  /* U+0630 ARABIC LETTER THAL */
+{"Arabic_theh",                   0x05cb},  /* U+062B ARABIC LETTER THEH */
+{"Arabic_waw",                    0x05e8},  /* U+0648 ARABIC LETTER WAW */
+{"Arabic_yeh",                    0x05ea},  /* U+064A ARABIC LETTER YEH */
+{"Arabic_zah",                    0x05d8},  /* U+0638 ARABIC LETTER ZAH */
+{"Arabic_zain",                   0x05d2},  /* U+0632 ARABIC LETTER ZAIN */
+{"breve",                         0x01a2},  /* U+02D8 BREVE */
+{"caron",                         0x01b7},  /* U+02C7 CARON */
+{"Ccaron",                        0x01c8},  /* U+010C LATIN CAPITAL LETTER C WITH CARON */
+{"Cyrillic_a",                    0x06c1},  /* U+0430 CYRILLIC SMALL LETTER A */
+{"Cyrillic_A",                    0x06e1},  /* U+0410 CYRILLIC CAPITAL LETTER A */
+{"Cyrillic_be",                   0x06c2},  /* U+0431 CYRILLIC SMALL LETTER BE */
+{"Cyrillic_BE",                   0x06e2},  /* U+0411 CYRILLIC CAPITAL LETTER BE */
+{"Cyrillic_che",                  0x06de},  /* U+0447 CYRILLIC SMALL LETTER CHE */
+{"Cyrillic_CHE",                  0x06fe},  /* U+0427 CYRILLIC CAPITAL LETTER CHE */
+{"Cyrillic_de",                   0x06c4},  /* U+0434 CYRILLIC SMALL LETTER DE */
+{"Cyrillic_DE",                   0x06e4},  /* U+0414 CYRILLIC CAPITAL LETTER DE */
+{"Cyrillic_dzhe",                 0x06af},  /* U+045F CYRILLIC SMALL LETTER DZHE */
+{"Cyrillic_DZHE",                 0x06bf},  /* U+040F CYRILLIC CAPITAL LETTER DZHE */
+{"Cyrillic_e",                    0x06dc},  /* U+044D CYRILLIC SMALL LETTER E */
+{"Cyrillic_E",                    0x06fc},  /* U+042D CYRILLIC CAPITAL LETTER E */
+{"Cyrillic_ef",                   0x06c6},  /* U+0444 CYRILLIC SMALL LETTER EF */
+{"Cyrillic_EF",                   0x06e6},  /* U+0424 CYRILLIC CAPITAL LETTER EF */
+{"Cyrillic_el",                   0x06cc},  /* U+043B CYRILLIC SMALL LETTER EL */
+{"Cyrillic_EL",                   0x06ec},  /* U+041B CYRILLIC CAPITAL LETTER EL */
+{"Cyrillic_em",                   0x06cd},  /* U+043C CYRILLIC SMALL LETTER EM */
+{"Cyrillic_EM",                   0x06ed},  /* U+041C CYRILLIC CAPITAL LETTER EM */
+{"Cyrillic_en",                   0x06ce},  /* U+043D CYRILLIC SMALL LETTER EN */
+{"Cyrillic_EN",                   0x06ee},  /* U+041D CYRILLIC CAPITAL LETTER EN */
+{"Cyrillic_er",                   0x06d2},  /* U+0440 CYRILLIC SMALL LETTER ER */
+{"Cyrillic_ER",                   0x06f2},  /* U+0420 CYRILLIC CAPITAL LETTER ER */
+{"Cyrillic_es",                   0x06d3},  /* U+0441 CYRILLIC SMALL LETTER ES */
+{"Cyrillic_ES",                   0x06f3},  /* U+0421 CYRILLIC CAPITAL LETTER ES */
+{"Cyrillic_ghe",                  0x06c7},  /* U+0433 CYRILLIC SMALL LETTER GHE */
+{"Cyrillic_GHE",                  0x06e7},  /* U+0413 CYRILLIC CAPITAL LETTER GHE */
+{"Cyrillic_ha",                   0x06c8},  /* U+0445 CYRILLIC SMALL LETTER HA */
+{"Cyrillic_HA",                   0x06e8},  /* U+0425 CYRILLIC CAPITAL LETTER HA */
+{"Cyrillic_hardsign",             0x06df},  /* U+044A CYRILLIC SMALL LETTER HARD SIGN */
+{"Cyrillic_HARDSIGN",             0x06ff},  /* U+042A CYRILLIC CAPITAL LETTER HARD SIGN */
+{"Cyrillic_i",                    0x06c9},  /* U+0438 CYRILLIC SMALL LETTER I */
+{"Cyrillic_I",                    0x06e9},  /* U+0418 CYRILLIC CAPITAL LETTER I */
+{"Cyrillic_ie",                   0x06c5},  /* U+0435 CYRILLIC SMALL LETTER IE */
+{"Cyrillic_IE",                   0x06e5},  /* U+0415 CYRILLIC CAPITAL LETTER IE */
+{"Cyrillic_io",                   0x06a3},  /* U+0451 CYRILLIC SMALL LETTER IO */
+{"Cyrillic_IO",                   0x06b3},  /* U+0401 CYRILLIC CAPITAL LETTER IO */
+{"Cyrillic_je",                   0x06a8},  /* U+0458 CYRILLIC SMALL LETTER JE */
+{"Cyrillic_JE",                   0x06b8},  /* U+0408 CYRILLIC CAPITAL LETTER JE */
+{"Cyrillic_ka",                   0x06cb},  /* U+043A CYRILLIC SMALL LETTER KA */
+{"Cyrillic_KA",                   0x06eb},  /* U+041A CYRILLIC CAPITAL LETTER KA */
+{"Cyrillic_lje",                  0x06a9},  /* U+0459 CYRILLIC SMALL LETTER LJE */
+{"Cyrillic_LJE",                  0x06b9},  /* U+0409 CYRILLIC CAPITAL LETTER LJE */
+{"Cyrillic_nje",                  0x06aa},  /* U+045A CYRILLIC SMALL LETTER NJE */
+{"Cyrillic_NJE",                  0x06ba},  /* U+040A CYRILLIC CAPITAL LETTER NJE */
+{"Cyrillic_o",                    0x06cf},  /* U+043E CYRILLIC SMALL LETTER O */
+{"Cyrillic_O",                    0x06ef},  /* U+041E CYRILLIC CAPITAL LETTER O */
+{"Cyrillic_pe",                   0x06d0},  /* U+043F CYRILLIC SMALL LETTER PE */
+{"Cyrillic_PE",                   0x06f0},  /* U+041F CYRILLIC CAPITAL LETTER PE */
+{"Cyrillic_sha",                  0x06db},  /* U+0448 CYRILLIC SMALL LETTER SHA */
+{"Cyrillic_SHA",                  0x06fb},  /* U+0428 CYRILLIC CAPITAL LETTER SHA */
+{"Cyrillic_shcha",                0x06dd},  /* U+0449 CYRILLIC SMALL LETTER SHCHA */
+{"Cyrillic_SHCHA",                0x06fd},  /* U+0429 CYRILLIC CAPITAL LETTER SHCHA */
+{"Cyrillic_shorti",               0x06ca},  /* U+0439 CYRILLIC SMALL LETTER SHORT I */
+{"Cyrillic_SHORTI",               0x06ea},  /* U+0419 CYRILLIC CAPITAL LETTER SHORT I */
+{"Cyrillic_softsign",             0x06d8},  /* U+044C CYRILLIC SMALL LETTER SOFT SIGN */
+{"Cyrillic_SOFTSIGN",             0x06f8},  /* U+042C CYRILLIC CAPITAL LETTER SOFT SIGN */
+{"Cyrillic_te",                   0x06d4},  /* U+0442 CYRILLIC SMALL LETTER TE */
+{"Cyrillic_TE",                   0x06f4},  /* U+0422 CYRILLIC CAPITAL LETTER TE */
+{"Cyrillic_tse",                  0x06c3},  /* U+0446 CYRILLIC SMALL LETTER TSE */
+{"Cyrillic_TSE",                  0x06e3},  /* U+0426 CYRILLIC CAPITAL LETTER TSE */
+{"Cyrillic_u",                    0x06d5},  /* U+0443 CYRILLIC SMALL LETTER U */
+{"Cyrillic_U",                    0x06f5},  /* U+0423 CYRILLIC CAPITAL LETTER U */
+{"Cyrillic_ve",                   0x06d7},  /* U+0432 CYRILLIC SMALL LETTER VE */
+{"Cyrillic_VE",                   0x06f7},  /* U+0412 CYRILLIC CAPITAL LETTER VE */
+{"Cyrillic_ya",                   0x06d1},  /* U+044F CYRILLIC SMALL LETTER YA */
+{"Cyrillic_YA",                   0x06f1},  /* U+042F CYRILLIC CAPITAL LETTER YA */
+{"Cyrillic_yeru",                 0x06d9},  /* U+044B CYRILLIC SMALL LETTER YERU */
+{"Cyrillic_YERU",                 0x06f9},  /* U+042B CYRILLIC CAPITAL LETTER YERU */
+{"Cyrillic_yu",                   0x06c0},  /* U+044E CYRILLIC SMALL LETTER YU */
+{"Cyrillic_YU",                   0x06e0},  /* U+042E CYRILLIC CAPITAL LETTER YU */
+{"Cyrillic_ze",                   0x06da},  /* U+0437 CYRILLIC SMALL LETTER ZE */
+{"Cyrillic_ZE",                   0x06fa},  /* U+0417 CYRILLIC CAPITAL LETTER ZE */
+{"Cyrillic_zhe",                  0x06d6},  /* U+0436 CYRILLIC SMALL LETTER ZHE */
+{"Cyrillic_ZHE",                  0x06f6},  /* U+0416 CYRILLIC CAPITAL LETTER ZHE */
+{"doubleacute",                   0x01bd},  /* U+02DD DOUBLE ACUTE ACCENT */
+{"doublelowquotemark",            0x0afe},  /* U+201E DOUBLE LOW-9 QUOTATION MARK */
+{"downarrow",                     0x08fe},  /* U+2193 DOWNWARDS ARROW */
+{"dstroke",                       0x01f0},  /* U+0111 LATIN SMALL LETTER D WITH STROKE */
+{"Dstroke",                       0x01d0},  /* U+0110 LATIN CAPITAL LETTER D WITH STROKE */
+{"eabovedot",                     0x03ec},  /* U+0117 LATIN SMALL LETTER E WITH DOT ABOVE */
+{"Eabovedot",                     0x03cc},  /* U+0116 LATIN CAPITAL LETTER E WITH DOT ABOVE */
+{"emacron",                       0x03ba},  /* U+0113 LATIN SMALL LETTER E WITH MACRON */
+{"Emacron",                       0x03aa},  /* U+0112 LATIN CAPITAL LETTER E WITH MACRON */
+{"endash",                        0x0aaa},  /* U+2013 EN DASH */
+{"eng",                           0x03bf},  /* U+014B LATIN SMALL LETTER ENG */
+{"ENG",                           0x03bd},  /* U+014A LATIN CAPITAL LETTER ENG */
+{"Execute",                       0xff62},  /* Execute, run, do */
+{"F16",                           0xffcd},
+{"F17",                           0xffce},
+{"F18",                           0xffcf},
+{"F19",                           0xffd0},
+{"F20",                           0xffd1},
+{"F21",                           0xffd2},
+{"F22",                           0xffd3},
+{"F23",                           0xffd4},
+{"F24",                           0xffd5},
+{"F25",                           0xffd6},
+{"F26",                           0xffd7},
+{"F27",                           0xffd8},
+{"F28",                           0xffd9},
+{"F29",                           0xffda},
+{"F30",                           0xffdb},
+{"F31",                           0xffdc},
+{"F32",                           0xffdd},
+{"F33",                           0xffde},
+{"F34",                           0xffdf},
+{"F35",                           0xffe0},
+{"fiveeighths",                   0x0ac5},  /* U+215D VULGAR FRACTION FIVE EIGHTHS */
+{"gbreve",                        0x02bb},  /* U+011F LATIN SMALL LETTER G WITH BREVE */
+{"Gbreve",                        0x02ab},  /* U+011E LATIN CAPITAL LETTER G WITH BREVE */
+{"gcedilla",                      0x03bb},  /* U+0123 LATIN SMALL LETTER G WITH CEDILLA */
+{"Gcedilla",                      0x03ab},  /* U+0122 LATIN CAPITAL LETTER G WITH CEDILLA */
+{"Greek_OMEGA",                   0x07d9},  /* U+03A9 GREEK CAPITAL LETTER OMEGA */
+{"Henkan_Mode",                   0xff23},  /* Start/Stop Conversion */
+{"horizconnector",                0x08a3},  /*(U+2500 BOX DRAWINGS LIGHT HORIZONTAL)*/
+{"hstroke",                       0x02b1},  /* U+0127 LATIN SMALL LETTER H WITH STROKE */
+{"Hstroke",                       0x02a1},  /* U+0126 LATIN CAPITAL LETTER H WITH STROKE */
+{"Iabovedot",                     0x02a9},  /* U+0130 LATIN CAPITAL LETTER I WITH DOT ABOVE */
+{"idotless",                      0x02b9},  /* U+0131 LATIN SMALL LETTER DOTLESS I */
+{"imacron",                       0x03ef},  /* U+012B LATIN SMALL LETTER I WITH MACRON */
+{"Imacron",                       0x03cf},  /* U+012A LATIN CAPITAL LETTER I WITH MACRON */
+{"iogonek",                       0x03e7},  /* U+012F LATIN SMALL LETTER I WITH OGONEK */
+{"Iogonek",                       0x03c7},  /* U+012E LATIN CAPITAL LETTER I WITH OGONEK */
+{"ISO_First_Group",               0xfe0c},
+{"ISO_Last_Group",                0xfe0e},
+{"ISO_Next_Group",                0xfe08},
+{"kana_a",                        0x04a7},  /* U+30A1 KATAKANA LETTER SMALL A */
+{"kana_A",                        0x04b1},  /* U+30A2 KATAKANA LETTER A */
+{"kana_CHI",                      0x04c1},  /* U+30C1 KATAKANA LETTER TI */
+{"kana_closingbracket",           0x04a3},  /* U+300D RIGHT CORNER BRACKET */
+{"kana_comma",                    0x04a4},  /* U+3001 IDEOGRAPHIC COMMA */
+{"kana_conjunctive",              0x04a5},  /* U+30FB KATAKANA MIDDLE DOT */
+{"kana_e",                        0x04aa},  /* U+30A7 KATAKANA LETTER SMALL E */
+{"kana_E",                        0x04b4},  /* U+30A8 KATAKANA LETTER E */
+{"kana_FU",                       0x04cc},  /* U+30D5 KATAKANA LETTER HU */
+{"kana_fullstop",                 0x04a1},  /* U+3002 IDEOGRAPHIC FULL STOP */
+{"kana_HA",                       0x04ca},  /* U+30CF KATAKANA LETTER HA */
+{"kana_HE",                       0x04cd},  /* U+30D8 KATAKANA LETTER HE */
+{"kana_HI",                       0x04cb},  /* U+30D2 KATAKANA LETTER HI */
+{"kana_HO",                       0x04ce},  /* U+30DB KATAKANA LETTER HO */
+{"kana_i",                        0x04a8},  /* U+30A3 KATAKANA LETTER SMALL I */
+{"kana_I",                        0x04b2},  /* U+30A4 KATAKANA LETTER I */
+{"kana_KA",                       0x04b6},  /* U+30AB KATAKANA LETTER KA */
+{"kana_KE",                       0x04b9},  /* U+30B1 KATAKANA LETTER KE */
+{"kana_KI",                       0x04b7},  /* U+30AD KATAKANA LETTER KI */
+{"kana_KO",                       0x04ba},  /* U+30B3 KATAKANA LETTER KO */
+{"kana_KU",                       0x04b8},  /* U+30AF KATAKANA LETTER KU */
+{"kana_MA",                       0x04cf},  /* U+30DE KATAKANA LETTER MA */
+{"kana_ME",                       0x04d2},  /* U+30E1 KATAKANA LETTER ME */
+{"kana_MI",                       0x04d0},  /* U+30DF KATAKANA LETTER MI */
+{"kana_MO",                       0x04d3},  /* U+30E2 KATAKANA LETTER MO */
+{"kana_MU",                       0x04d1},  /* U+30E0 KATAKANA LETTER MU */
+{"kana_N",                        0x04dd},  /* U+30F3 KATAKANA LETTER N */
+{"kana_NA",                       0x04c5},  /* U+30CA KATAKANA LETTER NA */
+{"kana_NE",                       0x04c8},  /* U+30CD KATAKANA LETTER NE */
+{"kana_NI",                       0x04c6},  /* U+30CB KATAKANA LETTER NI */
+{"kana_NO",                       0x04c9},  /* U+30CE KATAKANA LETTER NO */
+{"kana_NU",                       0x04c7},  /* U+30CC KATAKANA LETTER NU */
+{"kana_o",                        0x04ab},  /* U+30A9 KATAKANA LETTER SMALL O */
+{"kana_O",                        0x04b5},  /* U+30AA KATAKANA LETTER O */
+{"kana_openingbracket",           0x04a2},  /* U+300C LEFT CORNER BRACKET */
+{"kana_RA",                       0x04d7},  /* U+30E9 KATAKANA LETTER RA */
+{"kana_RE",                       0x04da},  /* U+30EC KATAKANA LETTER RE */
+{"kana_RI",                       0x04d8},  /* U+30EA KATAKANA LETTER RI */
+{"kana_RU",                       0x04d9},  /* U+30EB KATAKANA LETTER RU */
+{"kana_SA",                       0x04bb},  /* U+30B5 KATAKANA LETTER SA */
+{"kana_SE",                       0x04be},  /* U+30BB KATAKANA LETTER SE */
+{"kana_SHI",                      0x04bc},  /* U+30B7 KATAKANA LETTER SI */
+{"kana_SO",                       0x04bf},  /* U+30BD KATAKANA LETTER SO */
+{"kana_SU",                       0x04bd},  /* U+30B9 KATAKANA LETTER SU */
+{"kana_TA",                       0x04c0},  /* U+30BF KATAKANA LETTER TA */
+{"kana_TE",                       0x04c3},  /* U+30C6 KATAKANA LETTER TE */
+{"kana_TO",                       0x04c4},  /* U+30C8 KATAKANA LETTER TO */
+{"kana_tsu",                      0x04af},  /* U+30C3 KATAKANA LETTER SMALL TU */
+{"kana_TSU",                      0x04c2},  /* U+30C4 KATAKANA LETTER TU */
+{"kana_u",                        0x04a9},  /* U+30A5 KATAKANA LETTER SMALL U */
+{"kana_U",                        0x04b3},  /* U+30A6 KATAKANA LETTER U */
+{"kana_WA",                       0x04dc},  /* U+30EF KATAKANA LETTER WA */
+{"kana_WO",                       0x04a6},  /* U+30F2 KATAKANA LETTER WO */
+{"kana_ya",                       0x04ac},  /* U+30E3 KATAKANA LETTER SMALL YA */
+{"kana_YA",                       0x04d4},  /* U+30E4 KATAKANA LETTER YA */
+{"kana_yo",                       0x04ae},  /* U+30E7 KATAKANA LETTER SMALL YO */
+{"kana_YO",                       0x04d6},  /* U+30E8 KATAKANA LETTER YO */
+{"kana_yu",                       0x04ad},  /* U+30E5 KATAKANA LETTER SMALL YU */
+{"kana_YU",                       0x04d5},  /* U+30E6 KATAKANA LETTER YU */
+{"Kanji",                         0xff21},  /* Kanji, Kanji convert */
+{"kcedilla",                      0x03f3},  /* U+0137 LATIN SMALL LETTER K WITH CEDILLA */
+{"Kcedilla",                      0x03d3},  /* U+0136 LATIN CAPITAL LETTER K WITH CEDILLA */
+{"kra",                           0x03a2},  /* U+0138 LATIN SMALL LETTER KRA */
+{"lcedilla",                      0x03b6},  /* U+013C LATIN SMALL LETTER L WITH CEDILLA */
+{"Lcedilla",                      0x03a6},  /* U+013B LATIN CAPITAL LETTER L WITH CEDILLA */
+{"leftarrow",                     0x08fb},  /* U+2190 LEFTWARDS ARROW */
+{"leftdoublequotemark",           0x0ad2},  /* U+201C LEFT DOUBLE QUOTATION MARK */
+{"Macedonia_dse",                 0x06a5},  /* U+0455 CYRILLIC SMALL LETTER DZE */
+{"Macedonia_DSE",                 0x06b5},  /* U+0405 CYRILLIC CAPITAL LETTER DZE */
+{"Macedonia_gje",                 0x06a2},  /* U+0453 CYRILLIC SMALL LETTER GJE */
+{"Macedonia_GJE",                 0x06b2},  /* U+0403 CYRILLIC CAPITAL LETTER GJE */
+{"Macedonia_kje",                 0x06ac},  /* U+045C CYRILLIC SMALL LETTER KJE */
+{"Macedonia_KJE",                 0x06bc},  /* U+040C CYRILLIC CAPITAL LETTER KJE */
+{"ncedilla",                      0x03f1},  /* U+0146 LATIN SMALL LETTER N WITH CEDILLA */
+{"Ncedilla",                      0x03d1},  /* U+0145 LATIN CAPITAL LETTER N WITH CEDILLA */
+{"oe",                            0x13bd},  /* U+0153 LATIN SMALL LIGATURE OE */
+{"OE",                            0x13bc},  /* U+0152 LATIN CAPITAL LIGATURE OE */
+{"ogonek",                        0x01b2},  /* U+02DB OGONEK */
+{"omacron",                       0x03f2},  /* U+014D LATIN SMALL LETTER O WITH MACRON */
+{"Omacron",                       0x03d2},  /* U+014C LATIN CAPITAL LETTER O WITH MACRON */
+{"oneeighth",                     0x0ac3},  /* U+215B VULGAR FRACTION ONE EIGHTH */
+{"rcedilla",                      0x03b3},  /* U+0157 LATIN SMALL LETTER R WITH CEDILLA */
+{"Rcedilla",                      0x03a3},  /* U+0156 LATIN CAPITAL LETTER R WITH CEDILLA */
+{"rightarrow",                    0x08fd},  /* U+2192 RIGHTWARDS ARROW */
+{"rightdoublequotemark",          0x0ad3},  /* U+201D RIGHT DOUBLE QUOTATION MARK */
+{"Scaron",                        0x01a9},  /* U+0160 LATIN CAPITAL LETTER S WITH CARON */
+{"scedilla",                      0x01ba},  /* U+015F LATIN SMALL LETTER S WITH CEDILLA */
+{"Scedilla",                      0x01aa},  /* U+015E LATIN CAPITAL LETTER S WITH CEDILLA */
+{"semivoicedsound",               0x04df},  /* U+309C KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK */
+{"seveneighths",                  0x0ac6},  /* U+215E VULGAR FRACTION SEVEN EIGHTHS */
+{"Thai_baht",                     0x0ddf},  /* U+0E3F THAI CURRENCY SYMBOL BAHT */
+{"Thai_bobaimai",                 0x0dba},  /* U+0E1A THAI CHARACTER BO BAIMAI */
+{"Thai_chochan",                  0x0da8},  /* U+0E08 THAI CHARACTER CHO CHAN */
+{"Thai_chochang",                 0x0daa},  /* U+0E0A THAI CHARACTER CHO CHANG */
+{"Thai_choching",                 0x0da9},  /* U+0E09 THAI CHARACTER CHO CHING */
+{"Thai_chochoe",                  0x0dac},  /* U+0E0C THAI CHARACTER CHO CHOE */
+{"Thai_dochada",                  0x0dae},  /* U+0E0E THAI CHARACTER DO CHADA */
+{"Thai_dodek",                    0x0db4},  /* U+0E14 THAI CHARACTER DO DEK */
+{"Thai_fofa",                     0x0dbd},  /* U+0E1D THAI CHARACTER FO FA */
+{"Thai_fofan",                    0x0dbf},  /* U+0E1F THAI CHARACTER FO FAN */
+{"Thai_hohip",                    0x0dcb},  /* U+0E2B THAI CHARACTER HO HIP */
+{"Thai_honokhuk",                 0x0dce},  /* U+0E2E THAI CHARACTER HO NOKHUK */
+{"Thai_khokhai",                  0x0da2},  /* U+0E02 THAI CHARACTER KHO KHAI */
+{"Thai_khokhon",                  0x0da5},  /* U+0E05 THAI CHARACTER KHO KHON */
+{"Thai_khokhuat",                 0x0da3},  /* U+0E03 THAI CHARACTER KHO KHUAT */
+{"Thai_khokhwai",                 0x0da4},  /* U+0E04 THAI CHARACTER KHO KHWAI */
+{"Thai_khorakhang",               0x0da6},  /* U+0E06 THAI CHARACTER KHO RAKHANG */
+{"Thai_kokai",                    0x0da1},  /* U+0E01 THAI CHARACTER KO KAI */
+{"Thai_lakkhangyao",              0x0de5},  /* U+0E45 THAI CHARACTER LAKKHANGYAO */
+{"Thai_lekchet",                  0x0df7},  /* U+0E57 THAI DIGIT SEVEN */
+{"Thai_lekha",                    0x0df5},  /* U+0E55 THAI DIGIT FIVE */
+{"Thai_lekhok",                   0x0df6},  /* U+0E56 THAI DIGIT SIX */
+{"Thai_lekkao",                   0x0df9},  /* U+0E59 THAI DIGIT NINE */
+{"Thai_leknung",                  0x0df1},  /* U+0E51 THAI DIGIT ONE */
+{"Thai_lekpaet",                  0x0df8},  /* U+0E58 THAI DIGIT EIGHT */
+{"Thai_leksam",                   0x0df3},  /* U+0E53 THAI DIGIT THREE */
+{"Thai_leksi",                    0x0df4},  /* U+0E54 THAI DIGIT FOUR */
+{"Thai_leksong",                  0x0df2},  /* U+0E52 THAI DIGIT TWO */
+{"Thai_leksun",                   0x0df0},  /* U+0E50 THAI DIGIT ZERO */
+{"Thai_lochula",                  0x0dcc},  /* U+0E2C THAI CHARACTER LO CHULA */
+{"Thai_loling",                   0x0dc5},  /* U+0E25 THAI CHARACTER LO LING */
+{"Thai_lu",                       0x0dc6},  /* U+0E26 THAI CHARACTER LU */
+{"Thai_maichattawa",              0x0deb},  /* U+0E4B THAI CHARACTER MAI CHATTAWA */
+{"Thai_maiek",                    0x0de8},  /* U+0E48 THAI CHARACTER MAI EK */
+{"Thai_maihanakat",               0x0dd1},  /* U+0E31 THAI CHARACTER MAI HAN-AKAT */
+{"Thai_maitaikhu",                0x0de7},  /* U+0E47 THAI CHARACTER MAITAIKHU */
+{"Thai_maitho",                   0x0de9},  /* U+0E49 THAI CHARACTER MAI THO */
+{"Thai_maitri",                   0x0dea},  /* U+0E4A THAI CHARACTER MAI TRI */
+{"Thai_maiyamok",                 0x0de6},  /* U+0E46 THAI CHARACTER MAIYAMOK */
+{"Thai_moma",                     0x0dc1},  /* U+0E21 THAI CHARACTER MO MA */
+{"Thai_ngongu",                   0x0da7},  /* U+0E07 THAI CHARACTER NGO NGU */
+{"Thai_nikhahit",                 0x0ded},  /* U+0E4D THAI CHARACTER NIKHAHIT */
+{"Thai_nonen",                    0x0db3},  /* U+0E13 THAI CHARACTER NO NEN */
+{"Thai_nonu",                     0x0db9},  /* U+0E19 THAI CHARACTER NO NU */
+{"Thai_oang",                     0x0dcd},  /* U+0E2D THAI CHARACTER O ANG */
+{"Thai_paiyannoi",                0x0dcf},  /* U+0E2F THAI CHARACTER PAIYANNOI */
+{"Thai_phinthu",                  0x0dda},  /* U+0E3A THAI CHARACTER PHINTHU */
+{"Thai_phophan",                  0x0dbe},  /* U+0E1E THAI CHARACTER PHO PHAN */
+{"Thai_phophung",                 0x0dbc},  /* U+0E1C THAI CHARACTER PHO PHUNG */
+{"Thai_phosamphao",               0x0dc0},  /* U+0E20 THAI CHARACTER PHO SAMPHAO */
+{"Thai_popla",                    0x0dbb},  /* U+0E1B THAI CHARACTER PO PLA */
+{"Thai_rorua",                    0x0dc3},  /* U+0E23 THAI CHARACTER RO RUA */
+{"Thai_ru",                       0x0dc4},  /* U+0E24 THAI CHARACTER RU */
+{"Thai_saraa",                    0x0dd0},  /* U+0E30 THAI CHARACTER SARA A */
+{"Thai_saraaa",                   0x0dd2},  /* U+0E32 THAI CHARACTER SARA AA */
+{"Thai_saraae",                   0x0de1},  /* U+0E41 THAI CHARACTER SARA AE */
+{"Thai_saraaimaimalai",           0x0de4},  /* U+0E44 THAI CHARACTER SARA AI MAIMALAI */
+{"Thai_saraaimaimuan",            0x0de3},  /* U+0E43 THAI CHARACTER SARA AI MAIMUAN */
+{"Thai_saraam",                   0x0dd3},  /* U+0E33 THAI CHARACTER SARA AM */
+{"Thai_sarae",                    0x0de0},  /* U+0E40 THAI CHARACTER SARA E */
+{"Thai_sarai",                    0x0dd4},  /* U+0E34 THAI CHARACTER SARA I */
+{"Thai_saraii",                   0x0dd5},  /* U+0E35 THAI CHARACTER SARA II */
+{"Thai_sarao",                    0x0de2},  /* U+0E42 THAI CHARACTER SARA O */
+{"Thai_sarau",                    0x0dd8},  /* U+0E38 THAI CHARACTER SARA U */
+{"Thai_saraue",                   0x0dd6},  /* U+0E36 THAI CHARACTER SARA UE */
+{"Thai_sarauee",                  0x0dd7},  /* U+0E37 THAI CHARACTER SARA UEE */
+{"Thai_sarauu",                   0x0dd9},  /* U+0E39 THAI CHARACTER SARA UU */
+{"Thai_sorusi",                   0x0dc9},  /* U+0E29 THAI CHARACTER SO RUSI */
+{"Thai_sosala",                   0x0dc8},  /* U+0E28 THAI CHARACTER SO SALA */
+{"Thai_soso",                     0x0dab},  /* U+0E0B THAI CHARACTER SO SO */
+{"Thai_sosua",                    0x0dca},  /* U+0E2A THAI CHARACTER SO SUA */
+{"Thai_thanthakhat",              0x0dec},  /* U+0E4C THAI CHARACTER THANTHAKHAT */
+{"Thai_thonangmontho",            0x0db1},  /* U+0E11 THAI CHARACTER THO NANGMONTHO */
+{"Thai_thophuthao",               0x0db2},  /* U+0E12 THAI CHARACTER THO PHUTHAO */
+{"Thai_thothahan",                0x0db7},  /* U+0E17 THAI CHARACTER THO THAHAN */
+{"Thai_thothan",                  0x0db0},  /* U+0E10 THAI CHARACTER THO THAN */
+{"Thai_thothong",                 0x0db8},  /* U+0E18 THAI CHARACTER THO THONG */
+{"Thai_thothung",                 0x0db6},  /* U+0E16 THAI CHARACTER THO THUNG */
+{"Thai_topatak",                  0x0daf},  /* U+0E0F THAI CHARACTER TO PATAK */
+{"Thai_totao",                    0x0db5},  /* U+0E15 THAI CHARACTER TO TAO */
+{"Thai_wowaen",                   0x0dc7},  /* U+0E27 THAI CHARACTER WO WAEN */
+{"Thai_yoyak",                    0x0dc2},  /* U+0E22 THAI CHARACTER YO YAK */
+{"Thai_yoying",                   0x0dad},  /* U+0E0D THAI CHARACTER YO YING */
+{"threeeighths",                  0x0ac4},  /* U+215C VULGAR FRACTION THREE EIGHTHS */
+{"trademark",                     0x0ac9},  /* U+2122 TRADE MARK SIGN */
+{"tslash",                        0x03bc},  /* U+0167 LATIN SMALL LETTER T WITH STROKE */
+{"Tslash",                        0x03ac},  /* U+0166 LATIN CAPITAL LETTER T WITH STROKE */
+{"umacron",                       0x03fe},  /* U+016B LATIN SMALL LETTER U WITH MACRON */
+{"Umacron",                       0x03de},  /* U+016A LATIN CAPITAL LETTER U WITH MACRON */
+{"uogonek",                       0x03f9},  /* U+0173 LATIN SMALL LETTER U WITH OGONEK */
+{"Uogonek",                       0x03d9},  /* U+0172 LATIN CAPITAL LETTER U WITH OGONEK */
+{"uparrow",                       0x08fc},  /* U+2191 UPWARDS ARROW */
+{"voicedsound",                   0x04de},  /* U+309B KATAKANA-HIRAGANA VOICED SOUND MARK */
+{"Zcaron",                        0x01ae},  /* U+017D LATIN CAPITAL LETTER Z WITH CARON */
+
 {NULL,0},
 };
commit 828071592470d0703a283433ea195295dab0ad7d
Author: Jan Krupa <JKrupa at suse.com>
Date:   Wed Oct 16 14:40:05 2013 +0200

    qemu-char: add support for U-prefixed symbols
    
    This patch adds support for Unicode symbols in keymap files. This
    feature was already used in some keyboard layouts in QEMU generated
    from XKB (e.g. Arabic) but it wasn't implemented in QEMU source code.
    
    There is no need for check of validity of the hex string after U character
    because strtol returns 0 in case the conversion was unsuccessful.
    
    Signed-off-by: Jan Krupa <jkrupa at suse.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/ui/keymaps.c b/ui/keymaps.c
index f373cc5..80d658d 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -33,6 +33,12 @@ static int get_keysym(const name2keysym_t *table,
         if (!strcmp(p->name, name))
             return p->keysym;
     }
+    if (name[0] == 'U' && strlen(name) == 5) { /* try unicode Uxxxx */
+        char *end;
+        int ret = (int)strtoul(name + 1, &end, 16);
+        if (*end == '\0' && ret > 0)
+          return ret;
+    }
     return 0;
 }
 
commit 3751e72246b3efd9902bddc7fbd20df8f86bab21
Author: Jan Krupa <JKrupa at suse.com>
Date:   Wed Oct 16 14:40:04 2013 +0200

    qemu-char: add Czech keymap file
    
    This patch adds Czech keyboard layout to available keymap files
    and Makefile.
    
    Signed-off-by: Jan Krupa <jkrupa at suse.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/Makefile b/Makefile
index b15003f..55817c1 100644
--- a/Makefile
+++ b/Makefile
@@ -280,7 +280,7 @@ distclean: clean
 KEYMAPS=da     en-gb  et  fr     fr-ch  is  lt  modifiers  no  pt-br  sv \
 ar      de     en-us  fi  fr-be  hr     it  lv  nl         pl  ru     th \
 common  de-ch  es     fo  fr-ca  hu     ja  mk  nl-be      pt  sl     tr \
-bepo
+bepo    cz
 
 ifdef INSTALL_BLOBS
 BLOBS=bios.bin sgabios.bin vgabios.bin vgabios-cirrus.bin \
diff --git a/pc-bios/keymaps/cz b/pc-bios/keymaps/cz
new file mode 100644
index 0000000..6584bfb
--- /dev/null
+++ b/pc-bios/keymaps/cz
@@ -0,0 +1,94 @@
+include common
+
+# Czech qwertz layout
+# comments are czech descriptions of the characters
+
+# -----------
+#  First row
+# -----------
+
+# strednik, kolecko
+semicolon 0x29
+dead_abovering 0x29 shift
+
+# numbers
+plus 0x2
+1 0x2 shift
+ecaron 0x3
+2 0x3 shift
+scaron 0x4
+3 0x4 shift
+ccaron 0x5
+4 0x5 shift
+rcaron 0x6
+5 0x6 shift
+zcaron 0x7
+6 0x7 shift
+yacute 0x8
+7 0x8 shift
+aacute 0x9
+8 0x9 shift
+iacute 0xa
+9 0xa shift
+eacute 0xb
+0 0xb shift
+
+# rovnitko
+equal 0x0c
+percent 0x0c shift
+
+# carka, hacek
+dead_acute 0x0d
+dead_caron 0x0d shift
+
+# ------------
+#  Second row
+# ------------
+
+z 0x15 addupper
+
+# u s carkou, zpetne lomitko
+uacute 0x1a
+slash 0x1a shift
+
+# prava zavorka, leva zavorka
+parenright 0x1b
+parenleft 0x1b shift
+
+# -----------
+#  Third row
+# -----------
+
+# u s krouzkem, uvozovky
+uring 0x27
+quotedbl 0x27 shift
+
+# paragraf, vykricnik
+section 0x28
+exclam 0x28 shift
+
+# vodorovna dvojtecka, apostrof
+dead_diaeresis 0x2b
+apostrophe 0x2b shift
+
+# ------------
+#  Fourth row
+# ------------
+
+# zpetne lomitko, roura
+backslash 0x2b
+bar 0x2b shift
+
+y 0x2c addupper
+
+# carka, otaznik
+comma 0x33
+question 0x33 shift
+
+# tecka, dvojtecka
+period 0x34
+colon 0x34 shift
+
+# minus, podtrzitko
+minus 0x35
+underscore 0x35 shift
commit 018715f96cc1315df355743a1f807e1b95d2a10f
Author: Jan Krupa <JKrupa at suse.com>
Date:   Wed Oct 16 14:40:03 2013 +0200

    qemu-char: add Czech characters to VNC keysyms
    
    This patch adds missing Czech characters to the VNC keysym table.
    
    Signed-off-by: Jan Krupa <jkrupa at suse.com>
    Signed-off-by: Michael Tokarev <mjt at tls.msk.ru>

diff --git a/ui/vnc_keysym.h b/ui/vnc_keysym.h
index 6250bec..72c01d1 100644
--- a/ui/vnc_keysym.h
+++ b/ui/vnc_keysym.h
@@ -224,6 +224,14 @@ static const name2keysym_t name2keysym[]={
 { "odoubleacute",         0x1f5},
 { "udoubleacute",         0x1fb},
 
+/* Czech national characters */
+{ "ecaron",               0x1ec},
+{ "scaron",               0x1b9},
+{ "ccaron",               0x1e8},
+{ "rcaron",               0x1f8},
+{ "zcaron",               0x1be},
+{ "uring",                0x1f9},
+
     /* modifiers */
 {"ISO_Level3_Shift", 0xfe03}, /* XK_ISO_Level3_Shift */
 {"Control_L", 0xffe3}, /* XK_Control_L */
commit dce07e0b2b172ccce43955fdee2149ab2413251b
Author: Luiz Capitulino <lcapitulino at redhat.com>
Date:   Tue Nov 5 16:09:37 2013 -0500

    MAINTAINERS: add git tree info for HMP, QMP and QAPI
    
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index 77edacf..02b85ee 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -699,6 +699,7 @@ S: Supported
 F: monitor.c
 F: hmp.c
 F: hmp-commands.hx
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp
 
 Network device layer
 M: Anthony Liguori <aliguori at amazon.com>
@@ -720,6 +721,7 @@ M: Luiz Capitulino <lcapitulino at redhat.com>
 M: Michael Roth <mdroth at linux.vnet.ibm.com>
 S: Supported
 F: qapi/
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp
 
 QAPI Schema
 M: Eric Blake <eblake at redhat.com>
@@ -727,6 +729,7 @@ M: Luiz Capitulino <lcapitulino at redhat.com>
 M: Markus Armbruster <armbru at redhat.com>
 S: Supported
 F: qapi-schema.json
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp
 
 QMP
 M: Luiz Capitulino <lcapitulino at redhat.com>
@@ -735,6 +738,7 @@ F: qmp.c
 F: monitor.c
 F: qmp-commands.hx
 F: QMP/
+T: git git://repo.or.cz/qemu/qmp-unstable.git queue/qmp
 
 SLIRP
 M: Jan Kiszka <jan.kiszka at siemens.com>
commit 7b75d9d61bf9b7b43f6df2fb2fbfc38c4eb9d2e9
Author: Richard Henderson <rth at twiddle.net>
Date:   Thu Oct 31 13:26:01 2013 -0700

    Adjust qapi-visit for python-2.4.3
    
    We say we support python 2.4, but python 2.4.3 does not
    support the "expr if test else expr" syntax used here.
    
    This allows QEMU to compile on RHEL 5.3, the last release for ia64.
    
    Signed-off-by: Richard Henderson <rth at twiddle.net>
    Reviewed-by: Michael Roth <mdroth at linux.vnet.ibm.com>
    Signed-off-by: Luiz Capitulino <lcapitulino at redhat.com>

diff --git a/scripts/qapi-visit.py b/scripts/qapi-visit.py
index c39e628..65f1a54 100644
--- a/scripts/qapi-visit.py
+++ b/scripts/qapi-visit.py
@@ -20,7 +20,10 @@ import errno
 def generate_visit_struct_fields(name, field_prefix, fn_prefix, members, base = None):
     substructs = []
     ret = ''
-    full_name = name if not fn_prefix else "%s_%s" % (name, fn_prefix)
+    if not fn_prefix:
+        full_name = name
+    else:
+        full_name = "%s_%s" % (name, fn_prefix)
 
     for argname, argentry, optional, structured in parse_args(members):
         if structured:
@@ -97,7 +100,10 @@ if (!error_is_set(errp)) {
 ''')
     push_indent()
 
-    full_name = name if not field_prefix else "%s_%s" % (field_prefix, name)
+    if not field_prefix:
+        full_name = name
+    else:
+        full_name = "%s_%s" % (field_prefix, name)
 
     if len(field_prefix):
         ret += mcgen('''
@@ -283,12 +289,17 @@ void visit_type_%(name)s(Visitor *m, %(name)s ** obj, const char *name, Error **
             name=name)
 
     pop_indent()
+
+    if not discriminator:
+        desc_type = "type"
+    else:
+        desc_type = discriminator
     ret += mcgen('''
         visit_type_%(name)sKind(m, &(*obj)->kind, "%(type)s", &err);
         if (!err) {
             switch ((*obj)->kind) {
 ''',
-                 name=name, type="type" if not discriminator else discriminator)
+                 name=name, type=desc_type)
 
     for key in members:
         if not discriminator:
commit ef9e455d645bed6d2360cd658dc00ca11a849877
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Nov 10 11:54:33 2013 +0200

    Revert "exec: limit system memory size"
    
    This reverts commit 818f86b88394b7b2b59d313e51043fe15a8004db.
    
    This was a work-around for bugs elsewhere in the system,
    exposed by commit a53ae8e934cd54686875b5bcfc2f434244ee55d6:
        "hw/pci: partially handle pci master abort"
    since that's reverted now, the work-around is not required for 1.7
    anymore.
    The proper fix is supporting full 64 bit addresses in the radix tree.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Tested-by: Marcel Apfelbaum <marcel.a at redhat.com>

diff --git a/exec.c b/exec.c
index 79610ce..b453713 100644
--- a/exec.c
+++ b/exec.c
@@ -1741,12 +1741,7 @@ void address_space_destroy_dispatch(AddressSpace *as)
 static void memory_map_init(void)
 {
     system_memory = g_malloc(sizeof(*system_memory));
-
-    assert(TARGET_PHYS_ADDR_SPACE_BITS <= 64);
-
-    memory_region_init(system_memory, NULL, "system",
-                       TARGET_PHYS_ADDR_SPACE_BITS == 64 ?
-                       UINT64_MAX : (0x1ULL << TARGET_PHYS_ADDR_SPACE_BITS));
+    memory_region_init(system_memory, NULL, "system", INT64_MAX);
     address_space_init(&address_space_memory, system_memory, "memory");
 
     system_io = g_malloc(sizeof(*system_io));
commit 0fbf50b6ec126600dca115adb1563c657cc27695
Author: Marcel Apfelbaum <marcel.a at redhat.com>
Date:   Sun Nov 10 11:49:57 2013 +0200

    Revert "hw/pci: partially handle pci master abort"
    
    This reverts commit a53ae8e934cd54686875b5bcfc2f434244ee55d6.
    
    The patch being reverted introduced a low-priority memory region
    covering all 64 bit pci address space.  This exposed the following bugs
    elsewhere in the code:
     1. Some memory regions have INT64_MAX size, where the
        intent was all 64 bit address space.
        This results in a sub-page region, should be UINT64_MAX.
     2. page table rendering in exec.c ignores physical address bits
        above TARGET_PHYS_ADDR_SPACE_BITS.
        Access outside this range (e.g. from device DMA, or gdb stub)
        ends up with a wrong region.  Registering a region outside this
        range leads to page table corruption.
     3. Some regions overlap PCI hole and have same priority.
        This only works as long as no device uses the overlapping address.
    
    It doesn't look like we can resolve all issues in time for 1.7.
    Let's fix the bugs first and apply afterwards for 1.8.
    
    Signed-off-by: Marcel Apfelbaum <marcel.a at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index a98c8a0..ed32059 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -283,24 +283,6 @@ const char *pci_root_bus_path(PCIDevice *dev)
     return rootbus->qbus.name;
 }
 
-static uint64_t master_abort_mem_read(void *opaque, hwaddr addr, unsigned size)
-{
-   return -1ULL;
-}
-
-static void master_abort_mem_write(void *opaque, hwaddr addr, uint64_t val,
-                                   unsigned size)
-{
-}
-
-static const MemoryRegionOps master_abort_mem_ops = {
-    .read = master_abort_mem_read,
-    .write = master_abort_mem_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-#define MASTER_ABORT_MEM_PRIORITY INT_MIN
-
 static void pci_bus_init(PCIBus *bus, DeviceState *parent,
                          const char *name,
                          MemoryRegion *address_space_mem,
@@ -312,14 +294,6 @@ static void pci_bus_init(PCIBus *bus, DeviceState *parent,
     bus->address_space_mem = address_space_mem;
     bus->address_space_io = address_space_io;
 
-
-    memory_region_init_io(&bus->master_abort_mem, OBJECT(bus),
-                          &master_abort_mem_ops, bus, "pci-master-abort",
-                          memory_region_size(bus->address_space_mem));
-    memory_region_add_subregion_overlap(bus->address_space_mem,
-                                        0, &bus->master_abort_mem,
-                                        MASTER_ABORT_MEM_PRIORITY);
-
     /* host bridge */
     QLIST_INIT(&bus->child);
 
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 2ad5edb..9df1788 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -23,7 +23,6 @@ struct PCIBus {
     PCIDevice *parent_dev;
     MemoryRegion *address_space_mem;
     MemoryRegion *address_space_io;
-    MemoryRegion master_abort_mem;
 
     QLIST_HEAD(, PCIBus) child; /* this will be replaced by qdev later */
     QLIST_ENTRY(PCIBus) sibling;/* this will be replaced by qdev later */
commit fe1479aa251971abd3842dee4a783d4ebace8fb8
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Nov 10 11:53:30 2013 +0200

    loader: drop return value for rom_add_blob_fixed
    
    rom_add_blob never fails, and neither does rom_add_blob_fixed,
    so there's no need to return value from it.
    
    In fact, rom_add_blob_fixed was erroneously returning -1 unconditionally
    which made the only system that checked the return value -M bamboo fail
    to start.
    
    Drop the return value and drop checks from ppc440_bamboo to
    fix this failure.
    
    Reported-by: Alexander Graf <agraf at suse.de>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 655e499..67597df 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -110,8 +110,9 @@ static int bamboo_load_device_tree(hwaddr addr,
     qemu_devtree_setprop_cell(fdt, "/cpus/cpu at 0", "timebase-frequency",
                               tb_freq);
 
-    ret = rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
+    rom_add_blob_fixed(BINARY_DEVICE_TREE_FILE, fdt, fdt_size, addr);
     g_free(fdt);
+    return 0;
 
 out:
 
diff --git a/include/hw/loader.h b/include/hw/loader.h
index 58eca98..7a23d6b 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -55,7 +55,7 @@ void do_info_roms(Monitor *mon, const QDict *qdict);
 #define rom_add_file_fixed(_f, _a, _i)          \
     rom_add_file(_f, NULL, _a, _i)
 #define rom_add_blob_fixed(_f, _b, _l, _a)      \
-    (rom_add_blob(_f, _b, _l, _a, NULL, NULL, NULL) ? 0 : -1)
+    rom_add_blob(_f, _b, _l, _a, NULL, NULL, NULL)
 
 #define PC_ROM_MIN_VGA     0xc0000
 #define PC_ROM_MIN_OPTION  0xc8000
commit 81adc5131534ca7554cebe64cd8f86bac28dbd1b
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Thu Nov 7 14:12:05 2013 +0200

    acpi-build: disable with -no-acpi
    
    QEMU will currently crash if started with -no-acpi flag
    since acpi build code probes the PM device which isn't present
    in this configuration.
    
    To fix, don't expose ACPI tables to guest when acpi has been
    disabled from command line.
    
    Fixes LP# 1248854
    https://bugs.launchpad.net/qemu/+bug/1248854
    
    Reported-by: chao zhou <chao.zhou at intel.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Reviewed-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 6cfa044..486e705 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1182,6 +1182,11 @@ void acpi_setup(PcGuestInfo *guest_info)
         return;
     }
 
+    if (!acpi_enabled) {
+        ACPI_BUILD_DPRINTF(3, "ACPI disabled. Bailing out.\n");
+        return;
+    }
+
     build_state = g_malloc0(sizeof *build_state);
 
     build_state->guest_info = guest_info;
commit 6b9b8758c15f3bc2875dbd6e2d03c5362b8d6902
Author: Jason Wang <jasowang at redhat.com>
Date:   Wed Nov 6 16:58:08 2013 +0800

    virtio-net: only delete bh that existed
    
    We delete without check whether it existed during exit. This will lead NULL
    pointer deference since it was created conditionally depends on guest driver
    status and features. So add a check of existence before trying to delete it.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Jason Wang <jasowang at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 22dbd05..ae51d96 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1601,7 +1601,7 @@ static int virtio_net_device_exit(DeviceState *qdev)
         if (q->tx_timer) {
             timer_del(q->tx_timer);
             timer_free(q->tx_timer);
-        } else {
+        } else if (q->tx_bh) {
             qemu_bh_delete(q->tx_bh);
         }
     }
commit 04c7d8b8dea724f1007f0f6e76047ff03b4cb24f
Author: Cole Robinson <crobinso at redhat.com>
Date:   Tue Nov 5 18:46:27 2013 -0500

    Fix pc migration from qemu <= 1.5
    
    The following commit introduced a migration incompatibility:
    
    commit 568f0690fd9aa4d39d84b04c1a5dbb53a915c3fe
    Author: David Gibson <david at gibson.dropbear.id.au>
    Date:   Thu Jun 6 18:48:49 2013 +1000
    
        pci: Replace pci_find_domain() with more general pci_root_bus_path()
    
    The issue is that i440fx savevm idstr went from 0000:00:00.0/I440FX to
    0000:00.0/I440FX. Unfortunately we are stuck with the breakage for
    1.6 machine types.
    
    Add a compat property to maintain the busted idstr for the 1.6 machine
    types, but revert to the old style format for 1.7+, and <= 1.5.
    
    Tested with migration from qemu 1.5, qemu 1.6, and qemu.git.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Cole Robinson <crobinso at redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index bad3953..edc974e 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -48,6 +48,7 @@ typedef struct I440FXState {
     PCIHostState parent_obj;
     PcPciInfo pci_info;
     uint64_t pci_hole64_size;
+    uint32_t short_root_bus;
 } I440FXState;
 
 #define PIIX_NUM_PIC_IRQS       16      /* i8259 * 2 */
@@ -720,13 +721,19 @@ static const TypeInfo i440fx_info = {
 static const char *i440fx_pcihost_root_bus_path(PCIHostState *host_bridge,
                                                 PCIBus *rootbus)
 {
+    I440FXState *s = I440FX_PCI_HOST_BRIDGE(host_bridge);
+
     /* For backwards compat with old device paths */
-    return "0000";
+    if (s->short_root_bus) {
+        return "0000";
+    }
+    return "0000:00";
 }
 
 static Property i440fx_props[] = {
     DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, I440FXState,
                      pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
+    DEFINE_PROP_UINT32("short_root_bus", I440FXState, short_root_bus, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index b8feed1..c043998 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -61,8 +61,13 @@ static void q35_host_realize(DeviceState *dev, Error **errp)
 static const char *q35_host_root_bus_path(PCIHostState *host_bridge,
                                           PCIBus *rootbus)
 {
-    /* For backwards compat with old device paths */
-    return "0000";
+    Q35PCIHost *s = Q35_HOST_DEVICE(host_bridge);
+
+     /* For backwards compat with old device paths */
+    if (s->mch.short_root_bus) {
+        return "0000";
+    }
+    return "0000:00";
 }
 
 static void q35_host_get_pci_hole_start(Object *obj, Visitor *v,
@@ -124,6 +129,7 @@ static Property mch_props[] = {
                         MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT),
     DEFINE_PROP_SIZE(PCI_HOST_PROP_PCI_HOLE64_SIZE, Q35PCIHost,
                      mch.pci_hole64_size, DEFAULT_PCI_HOLE64_SIZE),
+    DEFINE_PROP_UINT32("short_root_bus", Q35PCIHost, mch.short_root_bus, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 03cc0ba..57e8d16 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -260,6 +260,14 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .driver   = "qemu32-" TYPE_X86_CPU,\
             .property = "model",\
             .value    = stringify(3),\
+        },{\
+            .driver   = "i440FX-pcihost",\
+            .property = "short_root_bus",\
+            .value    = stringify(1),\
+        },{\
+            .driver   = "q35-pcihost",\
+            .property = "short_root_bus",\
+            .value    = stringify(1),\
         }
 
 #define PC_COMPAT_1_5 \
@@ -296,6 +304,14 @@ int e820_add_entry(uint64_t, uint64_t, uint32_t);
             .driver = TYPE_X86_CPU,\
             .property = "pmu",\
             .value = "on",\
+        },{\
+            .driver   = "i440FX-pcihost",\
+            .property = "short_root_bus",\
+            .value    = stringify(0),\
+        },{\
+            .driver   = "q35-pcihost",\
+            .property = "short_root_bus",\
+            .value    = stringify(0),\
         }
 
 #define PC_COMPAT_1_4 \
diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
index aee91aa..309065f 100644
--- a/include/hw/pci-host/q35.h
+++ b/include/hw/pci-host/q35.h
@@ -61,6 +61,7 @@ typedef struct MCHPCIState {
     ram_addr_t above_4g_mem_size;
     uint64_t pci_hole64_size;
     PcGuestInfo *guest_info;
+    uint32_t short_root_bus;
 } MCHPCIState;
 
 typedef struct Q35PCIHost {
commit cc386e96727442f5b67052d4e0a602f6f652ffe6
Author: Dmitry Fleytman <dfleytma at redhat.com>
Date:   Sun Sep 22 18:09:13 2013 +0300

    virtio-net: broken RX filtering logic fixed
    
    Upon processing of VIRTIO_NET_CTRL_MAC_TABLE_SET command
    multicast list overwrites unicast list in mac_table.
    This leads to broken logic for both unicast and multicast RX filtering.
    
    Signed-off-by: Dmitry Fleytman <dfleytma at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index ae51d96..613f144 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -657,7 +657,8 @@ static int virtio_net_handle_mac(VirtIONet *n, uint8_t cmd,
     }
 
     if (n->mac_table.in_use + mac_data.entries <= MAC_TABLE_ENTRIES) {
-        s = iov_to_buf(iov, iov_cnt, 0, n->mac_table.macs,
+        s = iov_to_buf(iov, iov_cnt, 0,
+                       &n->mac_table.macs[n->mac_table.in_use * ETH_ALEN],
                        mac_data.entries * ETH_ALEN);
         if (s != mac_data.entries * ETH_ALEN) {
             goto error;
commit 1597591cca8a8fa20b8872937b859ec2aaccba6c
Author: Sergey Fedorov <s.fedorov at samsung.com>
Date:   Tue Nov 5 10:54:29 2013 +0400

    net: fix qemu_flush_queued_packets() in presence of a hub
    
    Do not return after net_hub_flush(). Always flush callee network client
    incoming queue.
    
    Signed-off-by: Sergey Fedorov <s.fedorov at samsung.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/net/net.c b/net/net.c
index 870d3bb..0a88e68 100644
--- a/net/net.c
+++ b/net/net.c
@@ -443,7 +443,6 @@ void qemu_flush_queued_packets(NetClientState *nc)
         if (net_hub_flush(nc->peer)) {
             qemu_notify_event();
         }
-        return;
     }
     if (qemu_net_queue_flush(nc->incoming_queue)) {
         /* We emptied the queue successfully, signal to the IO thread to repoll
commit d60b20cf2ae6644b05159b9361cba83fb6c0cb84
Author: Dmitry Krivenok <krivenok.dmitry at gmail.com>
Date:   Mon Oct 21 12:08:44 2013 +0400

    net: disallow to specify multicast MAC address
    
    [Assigning a multicast MAC address to a NIC leads to confusing behavior.
    Reject multicast MAC addresses so users are alerted to their error
    straight away.
    
    The "net/eth.h" in6_addr rename prevents a name collision with
    <netinet/in.h> on Linux.
    -- Stefan]
    
    Signed-off-by: Dmitry V. Krivenok <krivenok.dmitry at gmail.com>
    Reviewed-by: Amos Kong <kongjianjun at gmail.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/include/net/eth.h b/include/net/eth.h
index 1d48e06..b3273b8 100644
--- a/include/net/eth.h
+++ b/include/net/eth.h
@@ -84,7 +84,7 @@ typedef struct ip_pseudo_header {
 } ip_pseudo_header;
 
 /* IPv6 address */
-struct in6_addr {
+struct in6_address {
     union {
         uint8_t __u6_addr8[16];
     } __in6_u;
@@ -105,8 +105,8 @@ struct ip6_header {
             uint8_t  ip6_un3_ecn;  /* 2 bits ECN, top 6 bits payload length */
         } ip6_un3;
     } ip6_ctlun;
-    struct in6_addr ip6_src;     /* source address */
-    struct in6_addr ip6_dst;     /* destination address */
+    struct in6_address ip6_src;    /* source address */
+    struct in6_address ip6_dst;    /* destination address */
 };
 
 struct ip6_ext_hdr {
diff --git a/net/net.c b/net/net.c
index c330c9a..870d3bb 100644
--- a/net/net.c
+++ b/net/net.c
@@ -27,6 +27,7 @@
 #include "clients.h"
 #include "hub.h"
 #include "net/slirp.h"
+#include "net/eth.h"
 #include "util.h"
 
 #include "monitor/monitor.h"
@@ -689,6 +690,11 @@ static int net_init_nic(const NetClientOptions *opts, const char *name,
         error_report("invalid syntax for ethernet address");
         return -1;
     }
+    if (nic->has_macaddr &&
+        is_multicast_ether_addr(nd->macaddr.a)) {
+        error_report("NIC cannot have multicast MAC address (odd 1st byte)");
+        return -1;
+    }
     qemu_macaddr_default_if_unset(&nd->macaddr);
 
     if (nic->has_vectors) {
commit 7e382003f1bd9d8a441ecc5ac8a74bad3564d943
Author: Fam Zheng <famz at redhat.com>
Date:   Wed Nov 6 19:48:06 2013 +0800

    block: Round up total_sectors
    
    Since b94a2610, bdrv_getlength() is omitted when probing image. VMDK
    monolithicFlat is broken by that because a file < 512 bytes can't be
    read with its total_sectors truncated to 0. This patch round up the size
    to BDRV_SECTOR_SIZE, when a image size is not sector aligned.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index 0e96a22..6d5c804 100644
--- a/block.c
+++ b/block.c
@@ -640,7 +640,7 @@ static int refresh_total_sectors(BlockDriverState *bs, int64_t hint)
         if (length < 0) {
             return length;
         }
-        hint = length >> BDRV_SECTOR_BITS;
+        hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
     }
 
     bs->total_sectors = hint;
commit ebbfd5a094ead6f28d45718f97b4837bd3e7f916
Author: Max Filippov <jcmvbkbc at gmail.com>
Date:   Sun Oct 20 04:15:23 2013 +0400

    target-xtensa: add missing DEBUG section to dc233c config
    
    This fixes missing debug feature opcodes of dc233c core variant.
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Max Filippov <jcmvbkbc at gmail.com>

diff --git a/target-xtensa/core-dc233c.c b/target-xtensa/core-dc233c.c
index 11acbf3..738d543 100644
--- a/target-xtensa/core-dc233c.c
+++ b/target-xtensa/core-dc233c.c
@@ -49,6 +49,7 @@ static const XtensaConfig dc233c = {
     EXCEPTIONS_SECTION,
     INTERRUPTS_SECTION,
     TLB_SECTION,
+    DEBUG_SECTION,
     .clock_freq_khz = 10000,
 };
 
commit e8262a1b5b7cfbcbc80c46e4ce6ff7c517b7b2f6
Author: Max Filippov <jcmvbkbc at gmail.com>
Date:   Fri Sep 27 22:29:17 2013 +0400

    exec: fix breakpoint_invalidate when pc may not be translated
    
    This fixes qemu abort with the following message:
    
        include/qemu/int128.h:22: int128_get64: Assertion `!a.hi' failed.
    
    which happens due to attempt to invalidate breakpoint by virtual address
    for which get_phys_page_debug couldn't find mapping.
    
    For more details see
    http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg04582.html
    
    Cc: qemu-stable at nongnu.org
    Signed-off-by: Max Filippov <jcmvbkbc at gmail.com>
    Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/exec.c b/exec.c
index 79610ce..6492b0c 100644
--- a/exec.c
+++ b/exec.c
@@ -409,8 +409,10 @@ static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 #else
 static void breakpoint_invalidate(CPUState *cpu, target_ulong pc)
 {
-    tb_invalidate_phys_addr(cpu_get_phys_page_debug(cpu, pc) |
-            (pc & ~TARGET_PAGE_MASK));
+    hwaddr phys = cpu_get_phys_page_debug(cpu, pc);
+    if (phys != -1) {
+        tb_invalidate_phys_addr(phys | (pc & ~TARGET_PAGE_MASK));
+    }
 }
 #endif
 #endif /* TARGET_HAS_ICE */
commit 9d0e1dac108ce90cbe62c89af57a7ace006f5152
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Tue Oct 15 16:00:33 2013 +1100

    pseries: Update SLOF firmware image
    
    SLOF git commit is e2e8ac901e617573ea383f9cffd136146d0675a4
    
    The main changes are:
    * fixed bug with not passing arguments from -append
    * client-architecture-support hypercall
    * netboot
    * USB stack fixes
    
    The full list of changes:
      > client-architecture-support: fix wrong version read
      > client-architecture-support: fix redundant stack drop
      > Update device tree returned by CAS hypercall
      > fdt: introduce fdt-init
      > Add ibm,client-architecture-support method
      > Kernel parameter passed from qemu commandline ignored
      > Allow more than one client to open net devices simultaneously
      > ci: add missing close in else condition
      > Add GPT support
      > pci: fix interrupt-map for bridges
      > usb-ohci: preserve the toggleCarry bit in ED
      > usb-ohci: done_head processing fixes
      > usb-ohci: update init and rationalize timings
      > usb-msc: handle stall and other fixes
      > scsi: make probe more error resilient
      > usb-core: Add CLEAR FEATURE api
      > Implement range allocator
      > Remove bcm57xx network driver as module
      > Remove e1000 network driver as module
      > Remove virtio-net network driver as module
      > Remove veth network driver as module
      > Add missing close-dev in ping
      > Remove lodable network driver modules and related functions
      > Add bcm57xx network driver in libbcm
      > Add e1000 network driver in libe1k
      > Add virtio-net driver in libvirtio
      > Add veth driver in libveth
      > Get MAC address for client interface module
      > Add SLOF usleep wrapper
      > Add SLOF pci wrapper functions
      > Fix 'canon' client interface
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/pc-bios/README b/pc-bios/README
index b4138d1..1501cf1 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -17,7 +17,7 @@
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
   https://github.com/aik/SLOF, and the image currently in qemu is
-  built from git tag qemu-slof-20130827.
+  built from git tag qemu-slof-20131015.
 
 - sgabios (the Serial Graphics Adapter option ROM) provides a means for
   legacy x86 software to communicate with an attached serial console as
diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin
index 0e8b51a..92a9831 100644
Binary files a/pc-bios/slof.bin and b/pc-bios/slof.bin differ
diff --git a/roms/SLOF b/roms/SLOF
index a523d1b..e2e8ac9 160000
--- a/roms/SLOF
+++ b/roms/SLOF
@@ -1 +1 @@
-Subproject commit a523d1b0cd6e96cf5e393f0a10f897e8ed639fdc
+Subproject commit e2e8ac901e617573ea383f9cffd136146d0675a4
commit 29fdedfed54db4b04fe391ce8a4d9bf5ff86218e
Author: Alexey Kardashevskiy <aik at ozlabs.ru>
Date:   Fri Oct 11 14:08:20 2013 +1100

    spapr: add vio-bus devices to categories
    
    In order to get devices appear in output of
    "./qemu-system-ppc64 -device ?",
    they must be assigned to one of DEVICE_CATEGORY_XXXX.
    
    This puts VIO devices classes to corresponding categories.
    
    Signed-off-by: Alexey Kardashevskiy <aik at ozlabs.ru>
    Signed-off-by: Alexander Graf <agraf at suse.de>

diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 9c2aef8..f8a4981 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -168,6 +168,7 @@ static void spapr_vty_class_init(ObjectClass *klass, void *data)
     k->dt_name = "vty";
     k->dt_type = "serial";
     k->dt_compatible = "hvterm1";
+    set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     dc->props = spapr_vty_properties;
     dc->vmsd = &vmstate_spapr_vty;
 }
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 4ff0411..1bd6f50 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -531,6 +531,7 @@ static void spapr_vlan_class_init(ObjectClass *klass, void *data)
     k->dt_type = "network";
     k->dt_compatible = "IBM,l-lan";
     k->signal_mask = 0x1;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
     dc->props = spapr_vlan_properties;
     k->rtce_window_size = 0x10000000;
     dc->vmsd = &vmstate_spapr_llan;
diff --git a/hw/nvram/spapr_nvram.c b/hw/nvram/spapr_nvram.c
index eb4500e..beaad68 100644
--- a/hw/nvram/spapr_nvram.c
+++ b/hw/nvram/spapr_nvram.c
@@ -182,6 +182,7 @@ static void spapr_nvram_class_init(ObjectClass *klass, void *data)
     k->dt_name = "nvram";
     k->dt_type = "nvram";
     k->dt_compatible = "qemu,spapr-nvram";
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->props = spapr_nvram_properties;
 }
 
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 2a26042..c0c46d7 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -1223,6 +1223,7 @@ static void spapr_vscsi_class_init(ObjectClass *klass, void *data)
     k->dt_type = "vscsi";
     k->dt_compatible = "IBM,v-scsi";
     k->signal_mask = 0x00000001;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->props = spapr_vscsi_properties;
     k->rtce_window_size = 0x10000000;
     dc->vmsd = &vmstate_spapr_vscsi;
commit e78835b722eb26f5a56370166e99b69e9751ea2a
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:56 2013 -0400

    block: vhdx qemu-iotest - log replay of data sector
    
    This tests the replay of a data sector in a VHDX image file.
    
    The image file is a 10G dynamic image, with 4MB block size.  The
    image was created with qemu-img, and the log left unplayed by
    modification of the vhdx image format driver.
    
    It was verified under both QEMU and Hyper-V that the image file,
    post log replay, matched.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/070 b/tests/qemu-iotests/070
new file mode 100755
index 0000000..41bf100
--- /dev/null
+++ b/tests/qemu-iotests/070
@@ -0,0 +1,67 @@
+#!/bin/bash
+#
+# Test VHDX log replay from an image with a journal that needs to be
+# replayed
+#
+# Copyright (C) 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+# creator
+owner=jcody at redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+
+_cleanup()
+{
+    _cleanup_test_img
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ./common.rc
+. ./common.filter
+
+_supported_fmt vhdx
+_supported_proto generic
+_supported_os Linux
+
+# With the log replayed, the pattern 0xa5 extends to 0xc025000
+# If the log was not replayed, it would only extend to 0xc000000
+#
+# This image is a 10G dynamic image, with 4M block size, and 1 unplayed
+# data sector in the log
+#
+# This image was created with qemu-img, however it was verified using
+# Hyper-V to properly replay the logs and give the same post-replay
+# image as qemu.
+_use_sample_img iotest-dirtylog-10G-4M.vhdx.bz2
+
+echo
+echo "=== Verify open image read-only fails, due to dirty log ==="
+$QEMU_IO -r -c "read -pP 0xa5 0 18M" "$TEST_IMG" 2>&1 | grep -o "Permission denied"
+
+echo "=== Verify open image replays log  ==="
+$QEMU_IO  -c "read -pP 0xa5 0 18M" "$TEST_IMG" | _filter_qemu_io
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/070.out b/tests/qemu-iotests/070.out
new file mode 100644
index 0000000..9db8ff2
--- /dev/null
+++ b/tests/qemu-iotests/070.out
@@ -0,0 +1,8 @@
+QA output created by 070
+
+=== Verify open image read-only fails, due to dirty log ===
+Permission denied
+=== Verify open image replays log  ===
+read 18874368/18874368 bytes at offset 0
+18 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+*** done
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index c57ff35..b18b241 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -75,3 +75,4 @@
 067 rw auto
 068 rw auto
 069 rw auto
+070 rw auto
diff --git a/tests/qemu-iotests/sample_images/iotest-dirtylog-10G-4M.vhdx.bz2 b/tests/qemu-iotests/sample_images/iotest-dirtylog-10G-4M.vhdx.bz2
new file mode 100644
index 0000000..4b91cfc
Binary files /dev/null and b/tests/qemu-iotests/sample_images/iotest-dirtylog-10G-4M.vhdx.bz2 differ
commit 751aec24cdcd4359b5927df5cebfe6b8d3e74515
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:55 2013 -0400

    block: qemu-iotests for vhdx, add write test support
    
    This removes the IMGFMT_GENERIC blocker for read-only, so existing
    iotests run read/write tests for vhdx images created by qemu-img (e.g.
    tests 001, 002, 003).
    
    In addition, this updates the sample image test for the Hyper-V
    created image, to verify we can write it as well.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/064 b/tests/qemu-iotests/064
index 6789aa6..1c74c31 100755
--- a/tests/qemu-iotests/064
+++ b/tests/qemu-iotests/064
@@ -56,6 +56,17 @@ echo
 echo "=== Verify pattern 0x00, 66M - 1024M ==="
 $QEMU_IO -r -c "read -pP 0x00 66M 958M" "$TEST_IMG" | _filter_qemu_io
 
+echo
+echo "=== Verify pattern write, 0xc3 99M-157M ==="
+$QEMU_IO -c "write -pP 0xc3 99M 58M" "$TEST_IMG" | _filter_qemu_io
+# first verify we didn't write where we should not have
+$QEMU_IO -c "read -pP 0xa5 0 33M" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "read -pP 0x96 33M 33M" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "read -pP 0x00 66M 33M" "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -c "read -pP 0x00 157MM 867MM" "$TEST_IMG" | _filter_qemu_io
+# now verify what we should have actually written
+$QEMU_IO -c "read -pP 0xc3 99M 58M" "$TEST_IMG" | _filter_qemu_io
+
 # success, all done
 echo "*** done"
 rm -f $seq.full
diff --git a/tests/qemu-iotests/064.out b/tests/qemu-iotests/064.out
index b9e8e4a..5346a4e 100644
--- a/tests/qemu-iotests/064.out
+++ b/tests/qemu-iotests/064.out
@@ -11,4 +11,18 @@ read 34603008/34603008 bytes at offset 34603008
 === Verify pattern 0x00, 66M - 1024M ===
 read 1004535808/1004535808 bytes at offset 69206016
 958 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Verify pattern write, 0xc3 99M-157M ===
+wrote 60817408/60817408 bytes at offset 103809024
+58 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 34603008/34603008 bytes at offset 0
+33 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 34603008/34603008 bytes at offset 34603008
+33 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 34603008/34603008 bytes at offset 69206016
+33 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 909115392/909115392 bytes at offset 164626432
+867 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 60817408/60817408 bytes at offset 103809024
+58 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 *** done
diff --git a/tests/qemu-iotests/common b/tests/qemu-iotests/common
index 2932e14..8cde7f1 100644
--- a/tests/qemu-iotests/common
+++ b/tests/qemu-iotests/common
@@ -200,7 +200,6 @@ testlist options
         -vhdx)
             IMGFMT=vhdx
             xpand=false
-            IMGFMT_GENERIC=false
             ;;
 
         -rbd)
commit 228b234dd73383408743d749d29a6c37e9d99981
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:54 2013 -0400

    block: vhdx - update _make_test_img() to filter out vhdx options
    
    The non-global option output is suppresed in _make_test_img() for
    output verification in the 0?? tests.  This adds suppression for
    the vhdx-unique options as well.  This allows check -vhdx to run
    successfully.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index d24de2c..7f62457 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -157,7 +157,10 @@ _make_test_img()
             -e "s# zeroed_grain=\\(on\\|off\\)##g" \
             -e "s# subformat='[^']*'##g" \
             -e "s# adapter_type='[^']*'##g" \
-            -e "s# lazy_refcounts=\\(on\\|off\\)##g"
+            -e "s# lazy_refcounts=\\(on\\|off\\)##g" \
+            -e "s# block_size=[0-9]\\+##g" \
+            -e "s# block_state_zero=\\(on\\|off\\)##g" \
+            -e "s# log_size=[0-9]\\+##g"
 
     # Start an NBD server on the image file, which is what we'll be talking to
     if [ $IMGPROTO = "nbd" ]; then
commit 3412f7b1bd8f250c34c9f933767d06b9444bb821
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:53 2013 -0400

    block: vhdx - add .bdrv_create() support
    
    This adds support for VHDX image creation, for images of type "Fixed"
    and "Dynamic".  "Differencing" types (i.e., VHDX images with backing
    files) are currently not supported.
    
    Options for image creation include:
        * log size:
            The size of the journaling log for VHDX.  Minimum is 1MB,
            and it must be a multiple of 1MB. Invalid log sizes will be
            silently fixed by rounding up to the nearest MB.
    
            Default is 1MB.
    
        * block size:
            This is the size of a payload block.  The range is 1MB to 256MB,
            inclusive, and must be a multiple of 1MB as well.  Invalid sizes
            and multiples will be silently fixed.  If '0' is passed, then
            a sane size is chosen (depending on virtual image size).
    
            Default is 0 (Auto-select).
    
        * subformat:
            - "dynamic"
                An image without data pre-allocated.
            - "fixed"
                An image with data pre-allocated.
    
            Default is "dynamic"
    
    When creating the image file, the lettered sections are created:
    
    -----------------------------------------------------------------.
    |   (A)    |   (B)    |    (C)    |     (D)       |     (E)
    |  File ID |  Header1 |  Header 2 |  Region Tbl 1 |  Region Tbl 2
    |          |          |           |               |
    .-----------------------------------------------------------------.
    0         64KB      128KB       192KB           256KB          320KB
    
    .---- ~ ----------- ~ ------------ ~ ---------------- ~ -----------.
    |     (F)     |     (G)       |    (H)    |
    | Journal Log |  BAT / Bitmap |  Metadata |  .... data ......
    |             |               |           |
    .---- ~ ----------- ~ ------------ ~ ---------------- ~ -----------.
    1MB         (var.)          (var.)      (var.)
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 7bf7cd6..7d1af96 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -23,6 +23,19 @@
 #include "migration/migration.h"
 
 #include <uuid/uuid.h>
+#include <glib.h>
+
+/* Options for VHDX creation */
+
+#define VHDX_BLOCK_OPT_LOG_SIZE   "log_size"
+#define VHDX_BLOCK_OPT_BLOCK_SIZE "block_size"
+#define VHDX_BLOCK_OPT_ZERO "block_state_zero"
+
+typedef enum VHDXImageType {
+    VHDX_TYPE_DYNAMIC = 0,
+    VHDX_TYPE_FIXED,
+    VHDX_TYPE_DIFFERENCING,   /* Currently unsupported */
+} VHDXImageType;
 
 /* Several metadata and region table data entries are identified by
  * guids in  a MS-specific GUID format. */
@@ -1320,6 +1333,548 @@ exit:
 }
 
 
+
+/*
+ * Create VHDX Headers
+ *
+ * There are 2 headers, and the highest sequence number will represent
+ * the active header
+ */
+static int vhdx_create_new_headers(BlockDriverState *bs, uint64_t image_size,
+                                   uint32_t log_size)
+{
+    int ret = 0;
+    VHDXHeader *hdr = NULL;
+
+    hdr = g_malloc0(sizeof(VHDXHeader));
+
+    hdr->signature       = VHDX_HEADER_SIGNATURE;
+    hdr->sequence_number = g_random_int();
+    hdr->log_version     = 0;
+    hdr->version         = 1;
+    hdr->log_length      = log_size;
+    hdr->log_offset      = VHDX_HEADER_SECTION_END;
+    vhdx_guid_generate(&hdr->file_write_guid);
+    vhdx_guid_generate(&hdr->data_write_guid);
+
+    ret = vhdx_write_header(bs, hdr, VHDX_HEADER1_OFFSET, false);
+    if (ret < 0) {
+        goto exit;
+    }
+    hdr->sequence_number++;
+    ret = vhdx_write_header(bs, hdr, VHDX_HEADER2_OFFSET, false);
+    if (ret < 0) {
+        goto exit;
+    }
+
+exit:
+    g_free(hdr);
+    return ret;
+}
+
+
+/*
+ * Create the Metadata entries.
+ *
+ * For more details on the entries, see section 3.5 (pg 29) in the
+ * VHDX 1.00 specification.
+ *
+ * We support 5 metadata entries (all required by spec):
+ *          File Parameters,
+ *          Virtual Disk Size,
+ *          Page 83 Data,
+ *          Logical Sector Size,
+ *          Physical Sector Size
+ *
+ * The first 64KB of the Metadata section is reserved for the metadata
+ * header and entries; beyond that, the metadata items themselves reside.
+ */
+static int vhdx_create_new_metadata(BlockDriverState *bs,
+                                    uint64_t image_size,
+                                    uint32_t block_size,
+                                    uint32_t sector_size,
+                                    uint64_t metadata_offset,
+                                    VHDXImageType type)
+{
+    int ret = 0;
+    uint32_t offset = 0;
+    void *buffer = NULL;
+    void *entry_buffer;
+    VHDXMetadataTableHeader *md_table;;
+    VHDXMetadataTableEntry  *md_table_entry;
+
+    /* Metadata entries */
+    VHDXFileParameters     *mt_file_params;
+    VHDXVirtualDiskSize    *mt_virtual_size;
+    VHDXPage83Data         *mt_page83;
+    VHDXVirtualDiskLogicalSectorSize  *mt_log_sector_size;
+    VHDXVirtualDiskPhysicalSectorSize *mt_phys_sector_size;
+
+    entry_buffer = g_malloc0(sizeof(VHDXFileParameters)               +
+                             sizeof(VHDXVirtualDiskSize)              +
+                             sizeof(VHDXPage83Data)                   +
+                             sizeof(VHDXVirtualDiskLogicalSectorSize) +
+                             sizeof(VHDXVirtualDiskPhysicalSectorSize));
+
+    mt_file_params = entry_buffer;
+    offset += sizeof(VHDXFileParameters);
+    mt_virtual_size = entry_buffer + offset;
+    offset += sizeof(VHDXVirtualDiskSize);
+    mt_page83 = entry_buffer + offset;
+    offset += sizeof(VHDXPage83Data);
+    mt_log_sector_size = entry_buffer + offset;
+    offset += sizeof(VHDXVirtualDiskLogicalSectorSize);
+    mt_phys_sector_size = entry_buffer + offset;
+
+    mt_file_params->block_size = cpu_to_le32(block_size);
+    if (type == VHDX_TYPE_FIXED) {
+        mt_file_params->data_bits |= VHDX_PARAMS_LEAVE_BLOCKS_ALLOCED;
+        cpu_to_le32s(&mt_file_params->data_bits);
+    }
+
+    vhdx_guid_generate(&mt_page83->page_83_data);
+    cpu_to_leguids(&mt_page83->page_83_data);
+    mt_virtual_size->virtual_disk_size        = cpu_to_le64(image_size);
+    mt_log_sector_size->logical_sector_size   = cpu_to_le32(sector_size);
+    mt_phys_sector_size->physical_sector_size = cpu_to_le32(sector_size);
+
+    buffer = g_malloc0(VHDX_HEADER_BLOCK_SIZE);
+    md_table = buffer;
+
+    md_table->signature   = VHDX_METADATA_SIGNATURE;
+    md_table->entry_count = 5;
+    vhdx_metadata_header_le_export(md_table);
+
+
+    /* This will reference beyond the reserved table portion */
+    offset = 64 * KiB;
+
+    md_table_entry = buffer + sizeof(VHDXMetadataTableHeader);
+
+    md_table_entry[0].item_id = file_param_guid;
+    md_table_entry[0].offset  = offset;
+    md_table_entry[0].length  = sizeof(VHDXFileParameters);
+    md_table_entry[0].data_bits |= VHDX_META_FLAGS_IS_REQUIRED;
+    offset += md_table_entry[0].length;
+    vhdx_metadata_entry_le_export(&md_table_entry[0]);
+
+    md_table_entry[1].item_id = virtual_size_guid;
+    md_table_entry[1].offset  = offset;
+    md_table_entry[1].length  = sizeof(VHDXVirtualDiskSize);
+    md_table_entry[1].data_bits |= VHDX_META_FLAGS_IS_REQUIRED |
+                                   VHDX_META_FLAGS_IS_VIRTUAL_DISK;
+    offset += md_table_entry[1].length;
+    vhdx_metadata_entry_le_export(&md_table_entry[1]);
+
+    md_table_entry[2].item_id = page83_guid;
+    md_table_entry[2].offset  = offset;
+    md_table_entry[2].length  = sizeof(VHDXPage83Data);
+    md_table_entry[2].data_bits |= VHDX_META_FLAGS_IS_REQUIRED |
+                                   VHDX_META_FLAGS_IS_VIRTUAL_DISK;
+    offset += md_table_entry[2].length;
+    vhdx_metadata_entry_le_export(&md_table_entry[2]);
+
+    md_table_entry[3].item_id = logical_sector_guid;
+    md_table_entry[3].offset  = offset;
+    md_table_entry[3].length  = sizeof(VHDXVirtualDiskLogicalSectorSize);
+    md_table_entry[3].data_bits |= VHDX_META_FLAGS_IS_REQUIRED |
+                                   VHDX_META_FLAGS_IS_VIRTUAL_DISK;
+    offset += md_table_entry[3].length;
+    vhdx_metadata_entry_le_export(&md_table_entry[3]);
+
+    md_table_entry[4].item_id = phys_sector_guid;
+    md_table_entry[4].offset  = offset;
+    md_table_entry[4].length  = sizeof(VHDXVirtualDiskPhysicalSectorSize);
+    md_table_entry[4].data_bits |= VHDX_META_FLAGS_IS_REQUIRED |
+                                   VHDX_META_FLAGS_IS_VIRTUAL_DISK;
+    vhdx_metadata_entry_le_export(&md_table_entry[4]);
+
+    ret = bdrv_pwrite(bs, metadata_offset, buffer, VHDX_HEADER_BLOCK_SIZE);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    ret = bdrv_pwrite(bs, metadata_offset + (64 * KiB), entry_buffer,
+                      VHDX_HEADER_BLOCK_SIZE);
+    if (ret < 0) {
+        goto exit;
+    }
+
+
+exit:
+    g_free(buffer);
+    g_free(entry_buffer);
+    return ret;
+}
+
+/* This create the actual BAT itself.  We currently only support
+ * 'Dynamic' and 'Fixed' image types.
+ *
+ *  Dynamic images: default state of the BAT is all zeroes.
+ *
+ *  Fixed images: default state of the BAT is fully populated, with
+ *                file offsets and state PAYLOAD_BLOCK_FULLY_PRESENT.
+ */
+static int vhdx_create_bat(BlockDriverState *bs, BDRVVHDXState *s,
+                           uint64_t image_size, VHDXImageType type,
+                           bool use_zero_blocks, VHDXRegionTableEntry *rt_bat)
+{
+    int ret = 0;
+    uint64_t data_file_offset;
+    uint64_t total_sectors = 0;
+    uint64_t sector_num = 0;
+    uint64_t unused;
+    int block_state;
+    VHDXSectorInfo sinfo;
+
+    assert(s->bat == NULL);
+
+    /* this gives a data start after BAT/bitmap entries, and well
+     * past any metadata entries (with a 4 MB buffer for future
+     * expansion */
+    data_file_offset = rt_bat->file_offset + rt_bat->length + 5 * MiB;
+    total_sectors = image_size >> s->logical_sector_size_bits;
+
+    if (type == VHDX_TYPE_DYNAMIC) {
+        /* All zeroes, so we can just extend the file - the end of the BAT
+         * is the furthest thing we have written yet */
+        ret = bdrv_truncate(bs, data_file_offset);
+        if (ret < 0) {
+            goto exit;
+        }
+    } else if (type == VHDX_TYPE_FIXED) {
+        ret = bdrv_truncate(bs, data_file_offset + image_size);
+        if (ret < 0) {
+            goto exit;
+        }
+    } else {
+        ret = -ENOTSUP;
+        goto exit;
+    }
+
+    if (type == VHDX_TYPE_FIXED ||
+                use_zero_blocks ||
+                bdrv_has_zero_init(bs) == 0) {
+        /* for a fixed file, the default BAT entry is not zero */
+        s->bat = g_malloc0(rt_bat->length);
+        block_state = type == VHDX_TYPE_FIXED ? PAYLOAD_BLOCK_FULLY_PRESENT :
+                                                PAYLOAD_BLOCK_NOT_PRESENT;
+        block_state = use_zero_blocks ? PAYLOAD_BLOCK_ZERO : block_state;
+        /* fill the BAT by emulating sector writes of sectors_per_block size */
+        while (sector_num < total_sectors) {
+            vhdx_block_translate(s, sector_num, s->sectors_per_block, &sinfo);
+            sinfo.file_offset = data_file_offset +
+                                (sector_num << s->logical_sector_size_bits);
+            sinfo.file_offset = ROUND_UP(sinfo.file_offset, MiB);
+            vhdx_update_bat_table_entry(bs, s, &sinfo, &unused, &unused,
+                                        block_state);
+            cpu_to_le64s(&s->bat[sinfo.bat_idx]);
+            sector_num += s->sectors_per_block;
+        }
+        ret = bdrv_pwrite(bs, rt_bat->file_offset, s->bat, rt_bat->length);
+        if (ret < 0) {
+            goto exit;
+        }
+    }
+
+
+
+exit:
+    g_free(s->bat);
+    return ret;
+}
+
+/* Creates the region table header, and region table entries.
+ * There are 2 supported region table entries: BAT, and Metadata/
+ *
+ * As the calculations for the BAT region table are also needed
+ * to create the BAT itself, we will also cause the BAT to be
+ * created.
+ */
+static int vhdx_create_new_region_table(BlockDriverState *bs,
+                                        uint64_t image_size,
+                                        uint32_t block_size,
+                                        uint32_t sector_size,
+                                        uint32_t log_size,
+                                        bool use_zero_blocks,
+                                        VHDXImageType type,
+                                        uint64_t *metadata_offset)
+{
+    int ret = 0;
+    uint32_t offset = 0;
+    void *buffer = NULL;
+    BDRVVHDXState *s = NULL;
+    VHDXRegionTableHeader *region_table;
+    VHDXRegionTableEntry *rt_bat;
+    VHDXRegionTableEntry *rt_metadata;
+
+    assert(metadata_offset != NULL);
+
+    /* Populate enough of the BDRVVHDXState to be able to use the
+     * pre-existing BAT calculation, translation, and update functions */
+    s = g_malloc0(sizeof(BDRVVHDXState));
+
+    s->chunk_ratio = (VHDX_MAX_SECTORS_PER_BLOCK) *
+                     (uint64_t) sector_size / (uint64_t) block_size;
+
+    s->sectors_per_block = block_size / sector_size;
+    s->virtual_disk_size = image_size;
+    s->block_size = block_size;
+    s->logical_sector_size = sector_size;
+
+    vhdx_set_shift_bits(s);
+
+    vhdx_calc_bat_entries(s);
+
+    /* At this point the VHDX state is populated enough for creation */
+
+    /* a single buffer is used so we can calculate the checksum over the
+     * entire 64KB block */
+    buffer = g_malloc0(VHDX_HEADER_BLOCK_SIZE);
+    region_table = buffer;
+    offset += sizeof(VHDXRegionTableHeader);
+    rt_bat = buffer + offset;
+    offset += sizeof(VHDXRegionTableEntry);
+    rt_metadata  = buffer + offset;
+
+    region_table->signature = VHDX_REGION_SIGNATURE;
+    region_table->entry_count = 2;   /* BAT and Metadata */
+
+    rt_bat->guid        = bat_guid;
+    rt_bat->length      = ROUND_UP(s->bat_entries * sizeof(VHDXBatEntry), MiB);
+    rt_bat->file_offset = ROUND_UP(VHDX_HEADER_SECTION_END + log_size, MiB);
+    s->bat_offset = rt_bat->file_offset;
+
+    rt_metadata->guid        = metadata_guid;
+    rt_metadata->file_offset = ROUND_UP(rt_bat->file_offset + rt_bat->length,
+                                        MiB);
+    rt_metadata->length      = 1 * MiB; /* min size, and more than enough */
+    *metadata_offset = rt_metadata->file_offset;
+
+    vhdx_update_checksum(buffer, VHDX_HEADER_BLOCK_SIZE,
+                         offsetof(VHDXRegionTableHeader, checksum));
+
+
+    /* The region table gives us the data we need to create the BAT,
+     * so do that now */
+    ret = vhdx_create_bat(bs, s, image_size, type, use_zero_blocks, rt_bat);
+
+    /* Now write out the region headers to disk */
+    vhdx_region_header_le_export(region_table);
+    vhdx_region_entry_le_export(rt_bat);
+    vhdx_region_entry_le_export(rt_metadata);
+
+    ret = bdrv_pwrite(bs, VHDX_REGION_TABLE_OFFSET, buffer,
+                      VHDX_HEADER_BLOCK_SIZE);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    ret = bdrv_pwrite(bs, VHDX_REGION_TABLE2_OFFSET, buffer,
+                      VHDX_HEADER_BLOCK_SIZE);
+    if (ret < 0) {
+        goto exit;
+    }
+
+
+exit:
+    g_free(s);
+    g_free(buffer);
+    return ret;
+}
+
+/* We need to create the following elements:
+ *
+ *    .-----------------------------------------------------------------.
+ *    |   (A)    |   (B)    |    (C)    |     (D)       |     (E)       |
+ *    |  File ID |  Header1 |  Header 2 |  Region Tbl 1 |  Region Tbl 2 |
+ *    |          |          |           |               |               |
+ *    .-----------------------------------------------------------------.
+ *    0         64KB      128KB       192KB           256KB           320KB
+ *
+ *
+ *    .---- ~ ----------- ~ ------------ ~ ---------------- ~ -----------.
+ *    |     (F)     |     (G)       |    (H)    |                        |
+ *    | Journal Log |  BAT / Bitmap |  Metadata |  .... data ......      |
+ *    |             |               |           |                        |
+ *    .---- ~ ----------- ~ ------------ ~ ---------------- ~ -----------.
+ *   1MB
+ */
+static int vhdx_create(const char *filename, QEMUOptionParameter *options,
+                       Error **errp)
+{
+    int ret = 0;
+    uint64_t image_size = (uint64_t) 2 * GiB;
+    uint32_t log_size   = 1 * MiB;
+    uint32_t block_size = 0;
+    uint64_t signature;
+    uint64_t metadata_offset;
+    bool use_zero_blocks = false;
+
+    gunichar2 *creator = NULL;
+    glong creator_items;
+    BlockDriverState *bs;
+    const char *type = NULL;
+    VHDXImageType image_type;
+    Error *local_err = NULL;
+
+    while (options && options->name) {
+        if (!strcmp(options->name, BLOCK_OPT_SIZE)) {
+            image_size = options->value.n;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_LOG_SIZE)) {
+            log_size = options->value.n;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_BLOCK_SIZE)) {
+            block_size = options->value.n;
+        } else if (!strcmp(options->name, BLOCK_OPT_SUBFMT)) {
+            type = options->value.s;
+        } else if (!strcmp(options->name, VHDX_BLOCK_OPT_ZERO)) {
+            use_zero_blocks = options->value.n != 0;
+        }
+        options++;
+    }
+
+    if (image_size > VHDX_MAX_IMAGE_SIZE) {
+        error_setg_errno(errp, EINVAL, "Image size too large; max of 64TB");
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    if (type == NULL) {
+        type = "dynamic";
+    }
+
+    if (!strcmp(type, "dynamic")) {
+        image_type = VHDX_TYPE_DYNAMIC;
+    } else if (!strcmp(type, "fixed")) {
+        image_type = VHDX_TYPE_FIXED;
+    } else if (!strcmp(type, "differencing")) {
+        error_setg_errno(errp, ENOTSUP,
+                         "Differencing files not yet supported");
+        ret = -ENOTSUP;
+        goto exit;
+    } else {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    /* These are pretty arbitrary, and mainly designed to keep the BAT
+     * size reasonable to load into RAM */
+    if (block_size == 0) {
+        if (image_size > 32 * TiB) {
+            block_size = 64 * MiB;
+        } else if (image_size > (uint64_t) 100 * GiB) {
+            block_size = 32 * MiB;
+        } else if (image_size > 1 * GiB) {
+            block_size = 16 * MiB;
+        } else {
+            block_size = 8 * MiB;
+        }
+    }
+
+
+    /* make the log size close to what was specified, but must be
+     * min 1MB, and multiple of 1MB */
+    log_size = ROUND_UP(log_size, MiB);
+
+    block_size = ROUND_UP(block_size, MiB);
+    block_size = block_size > VHDX_BLOCK_SIZE_MAX ? VHDX_BLOCK_SIZE_MAX :
+                                                    block_size;
+
+    ret = bdrv_create_file(filename, options, &local_err);
+    if (ret < 0) {
+        error_propagate(errp, local_err);
+        goto exit;
+    }
+
+    ret = bdrv_file_open(&bs, filename, NULL, BDRV_O_RDWR, &local_err);
+    if (ret < 0) {
+        error_propagate(errp, local_err);
+        goto exit;
+    }
+
+    /* Create (A) */
+
+    /* The creator field is optional, but may be useful for
+     * debugging / diagnostics */
+    creator = g_utf8_to_utf16("QEMU v" QEMU_VERSION, -1, NULL,
+                              &creator_items, NULL);
+    signature = cpu_to_le64(VHDX_FILE_SIGNATURE);
+    bdrv_pwrite(bs, VHDX_FILE_ID_OFFSET, &signature, sizeof(signature));
+    if (ret < 0) {
+        goto delete_and_exit;
+    }
+    if (creator) {
+        bdrv_pwrite(bs, VHDX_FILE_ID_OFFSET + sizeof(signature), creator,
+                    creator_items * sizeof(gunichar2));
+        if (ret < 0) {
+            goto delete_and_exit;
+        }
+    }
+
+
+    /* Creates (B),(C) */
+    ret = vhdx_create_new_headers(bs, image_size, log_size);
+    if (ret < 0) {
+        goto delete_and_exit;
+    }
+
+    /* Creates (D),(E),(G) explicitly. (F) created as by-product */
+    ret = vhdx_create_new_region_table(bs, image_size, block_size, 512,
+                                       log_size, use_zero_blocks, image_type,
+                                       &metadata_offset);
+    if (ret < 0) {
+        goto delete_and_exit;
+    }
+
+    /* Creates (H) */
+    ret = vhdx_create_new_metadata(bs, image_size, block_size, 512,
+                                   metadata_offset, image_type);
+    if (ret < 0) {
+        goto delete_and_exit;
+    }
+
+
+
+delete_and_exit:
+    bdrv_unref(bs);
+exit:
+    g_free(creator);
+    return ret;
+}
+
+static QEMUOptionParameter vhdx_create_options[] = {
+    {
+        .name = BLOCK_OPT_SIZE,
+        .type = OPT_SIZE,
+        .help = "Virtual disk size; max of 64TB."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_LOG_SIZE,
+        .type = OPT_SIZE,
+        .value.n = 1 * MiB,
+        .help = "Log size; min 1MB."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_BLOCK_SIZE,
+        .type = OPT_SIZE,
+        .value.n = 0,
+        .help = "Block Size; min 1MB, max 256MB. " \
+                "0 means auto-calculate based on image size."
+    },
+    {
+        .name = BLOCK_OPT_SUBFMT,
+        .type = OPT_STRING,
+        .help = "VHDX format type, can be either 'dynamic' or 'fixed'. "\
+                "Default is 'dynamic'."
+    },
+    {
+        .name = VHDX_BLOCK_OPT_ZERO,
+        .type = OPT_FLAG,
+        .help = "Force use of payload blocks of type 'ZERO'.  Non-standard."
+    },
+    { NULL }
+};
+
 static BlockDriver bdrv_vhdx = {
     .format_name            = "vhdx",
     .instance_size          = sizeof(BDRVVHDXState),
@@ -1329,6 +1884,9 @@ static BlockDriver bdrv_vhdx = {
     .bdrv_reopen_prepare    = vhdx_reopen_prepare,
     .bdrv_co_readv          = vhdx_co_readv,
     .bdrv_co_writev         = vhdx_co_writev,
+    .bdrv_create            = vhdx_create,
+
+    .create_options         = vhdx_create_options,
 };
 
 static void bdrv_vhdx_init(void)
diff --git a/block/vhdx.h b/block/vhdx.h
index f222d18..51183b2 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -18,6 +18,11 @@
 #ifndef BLOCK_VHDX_H
 #define BLOCK_VHDX_H
 
+#define KiB              (1 * 1024)
+#define MiB            (KiB * 1024)
+#define GiB            (MiB * 1024)
+#define TiB ((uint64_t) GiB * 1024)
+
 /* Structures and fields present in the VHDX file */
 
 /* The header section has the following blocks,
@@ -36,8 +41,9 @@
 #define VHDX_HEADER1_OFFSET         (VHDX_HEADER_BLOCK_SIZE * 1)
 #define VHDX_HEADER2_OFFSET         (VHDX_HEADER_BLOCK_SIZE * 2)
 #define VHDX_REGION_TABLE_OFFSET    (VHDX_HEADER_BLOCK_SIZE * 3)
+#define VHDX_REGION_TABLE2_OFFSET   (VHDX_HEADER_BLOCK_SIZE * 4)
 
-
+#define VHDX_HEADER_SECTION_END     (1 * MiB)
 /*
  * A note on the use of MS-GUID fields.  For more details on the GUID,
  * please see: https://en.wikipedia.org/wiki/Globally_unique_identifier.
@@ -55,6 +61,7 @@
 /* These structures are ones that are defined in the VHDX specification
  * document */
 
+#define VHDX_FILE_SIGNATURE 0x656C696678646876  /* "vhdxfile" in ASCII */
 typedef struct VHDXFileIdentifier {
     uint64_t    signature;              /* "vhdxfile" in ASCII */
     uint16_t    creator[256];           /* optional; utf-16 string to identify
@@ -85,6 +92,7 @@ typedef struct QEMU_PACKED MSGUID {
 /* The full header is 4KB, although the actual header data is much smaller.
  * But for the checksum calculation, it is over the entire 4KB structure,
  * not just the defined portion of it */
+#define VHDX_HEADER_SIGNATURE 0x64616568
 typedef struct QEMU_PACKED VHDXHeader {
     uint32_t    signature;              /* "head" in ASCII */
     uint32_t    checksum;               /* CRC-32C hash of the whole header */
@@ -125,6 +133,7 @@ typedef struct QEMU_PACKED VHDXHeader {
 } VHDXHeader;
 
 /* Header for the region table block */
+#define VHDX_REGION_SIGNATURE  0x69676572  /* "regi" in ASCII */
 typedef struct QEMU_PACKED VHDXRegionTableHeader {
     uint32_t    signature;              /* "regi" in ASCII */
     uint32_t    checksum;               /* CRC-32C hash of the 64KB table */
@@ -238,6 +247,7 @@ typedef uint64_t VHDXBatEntry;
 #define VHDX_METADATA_MAX_ENTRIES 2047  /* not including the header */
 #define VHDX_METADATA_TABLE_MAX_SIZE \
     (VHDX_METADATA_ENTRY_SIZE * (VHDX_METADATA_MAX_ENTRIES+1))
+#define VHDX_METADATA_SIGNATURE 0x617461646174656D  /* "metadata" in ASCII */
 typedef struct QEMU_PACKED VHDXMetadataTableHeader {
     uint64_t    signature;              /* "metadata" in ASCII */
     uint16_t    reserved;
@@ -267,6 +277,8 @@ typedef struct QEMU_PACKED VHDXMetadataTableEntry {
                                                    If set indicates a fixed
                                                    size VHDX file */
 #define VHDX_PARAMS_HAS_PARENT           0x02    /* has parent / backing file */
+#define VHDX_BLOCK_SIZE_MIN             (1   * MiB)
+#define VHDX_BLOCK_SIZE_MAX             (256 * MiB)
 typedef struct QEMU_PACKED VHDXFileParameters {
     uint32_t    block_size;             /* size of each payload block, always
                                            power of 2, <= 256MB and >= 1MB. */
@@ -274,6 +286,7 @@ typedef struct QEMU_PACKED VHDXFileParameters {
                                            the rest are reserved (see above) */
 } VHDXFileParameters;
 
+#define VHDX_MAX_IMAGE_SIZE  ((uint64_t) 64 * TiB)
 typedef struct QEMU_PACKED VHDXVirtualDiskSize {
     uint64_t    virtual_disk_size;      /* Size of the virtual disk, in bytes.
                                            Must be multiple of the sector size,
commit 61c02e5687dcc581c9d3413b61040b023adeaa9c
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:52 2013 -0400

    block: vhdx - fix comment typos in header, fix incorrect struct fields
    
    VHDXPage83Data and VHDXParentLocatorHeader both incorrectly had their
    MSGUID fields set as arrays of 16.  This is incorrect (it stems from
    an early version where those fields were uint_8 arrays).  Those fields
    were, up to this patch, unused.
    
    Also, there were a couple of typos and incorrect wording in comments,
    and those have been fixed up as well.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.h b/block/vhdx.h
index 15486c7..f222d18 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -58,7 +58,7 @@
 typedef struct VHDXFileIdentifier {
     uint64_t    signature;              /* "vhdxfile" in ASCII */
     uint16_t    creator[256];           /* optional; utf-16 string to identify
-                                           the vhdx file creator.  Diagnotistic
+                                           the vhdx file creator.  Diagnostic
                                            only */
 } VHDXFileIdentifier;
 
@@ -114,8 +114,8 @@ typedef struct QEMU_PACKED VHDXHeader {
                                            there is no valid log. If non-zero,
                                            log entries with this guid are
                                            valid. */
-    uint16_t    log_version;            /* version of the log format. Mustn't be
-                                           zero, unless log_guid is also zero */
+    uint16_t    log_version;            /* version of the log format. Must be
+                                           set to zero */
     uint16_t    version;                /* version of the vhdx file.  Currently,
                                            only supported version is "1" */
     uint32_t    log_length;             /* length of the log.  Must be multiple
@@ -281,7 +281,7 @@ typedef struct QEMU_PACKED VHDXVirtualDiskSize {
 } VHDXVirtualDiskSize;
 
 typedef struct QEMU_PACKED VHDXPage83Data {
-    MSGUID      page_83_data[16];       /* unique id for scsi devices that
+    MSGUID      page_83_data;           /* unique id for scsi devices that
                                            support page 0x83 */
 } VHDXPage83Data;
 
@@ -296,7 +296,7 @@ typedef struct QEMU_PACKED VHDXVirtualDiskPhysicalSectorSize {
 } VHDXVirtualDiskPhysicalSectorSize;
 
 typedef struct QEMU_PACKED VHDXParentLocatorHeader {
-    MSGUID      locator_type[16];       /* type of the parent virtual disk. */
+    MSGUID      locator_type;           /* type of the parent virtual disk. */
     uint16_t    reserved;
     uint16_t    key_value_count;        /* number of key/value pairs for this
                                            locator */
commit 1e74a971cb3229813112c74dca81e599812b66f3
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:51 2013 -0400

    block: vhdx - break out code operations to functions
    
    This is preperation for vhdx_create().  The ability to write headers,
    and calculate the number of BAT entries will be needed within the
    create() functions, so move this relevant code into helper functions.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 7da149a..7bf7cd6 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -248,6 +248,14 @@ static void vhdx_region_unregister_all(BDRVVHDXState *s)
     }
 }
 
+static void vhdx_set_shift_bits(BDRVVHDXState *s)
+{
+    s->logical_sector_size_bits = 31 - clz32(s->logical_sector_size);
+    s->sectors_per_block_bits =   31 - clz32(s->sectors_per_block);
+    s->chunk_ratio_bits =         63 - clz64(s->chunk_ratio);
+    s->block_size_bits =          31 - clz32(s->block_size);
+}
+
 /*
  * Per the MS VHDX Specification, for every VHDX file:
  *      - The header section is fixed size - 1 MB
@@ -267,6 +275,50 @@ static int vhdx_probe(const uint8_t *buf, int buf_size, const char *filename)
     return 0;
 }
 
+/*
+ * Writes the header to the specified offset.
+ *
+ * This will optionally read in buffer data from disk (otherwise zero-fill),
+ * and then update the header checksum.  Header is converted to proper
+ * endianness before being written to the specified file offset
+ */
+static int vhdx_write_header(BlockDriverState *bs_file, VHDXHeader *hdr,
+                             uint64_t offset, bool read)
+{
+    uint8_t *buffer = NULL;
+    int ret;
+    VHDXHeader header_le;
+
+    assert(bs_file != NULL);
+    assert(hdr != NULL);
+
+    /* the header checksum is not over just the packed size of VHDXHeader,
+     * but rather over the entire 'reserved' range for the header, which is
+     * 4KB (VHDX_HEADER_SIZE). */
+
+    buffer = qemu_blockalign(bs_file, VHDX_HEADER_SIZE);
+    if (read) {
+        /* if true, we can't assume the extra reserved bytes are 0 */
+        ret = bdrv_pread(bs_file, offset, buffer, VHDX_HEADER_SIZE);
+        if (ret < 0) {
+            goto exit;
+        }
+    } else {
+        memset(buffer, 0, VHDX_HEADER_SIZE);
+    }
+
+    /* overwrite the actual VHDXHeader portion */
+    memcpy(buffer, hdr, sizeof(VHDXHeader));
+    hdr->checksum = vhdx_update_checksum(buffer, VHDX_HEADER_SIZE,
+                                         offsetof(VHDXHeader, checksum));
+    vhdx_header_le_export(hdr, &header_le);
+    ret = bdrv_pwrite_sync(bs_file, offset, &header_le, sizeof(VHDXHeader));
+
+exit:
+    qemu_vfree(buffer);
+    return ret;
+}
+
 /* Update the VHDX headers
  *
  * This follows the VHDX spec procedures for header updates.
@@ -282,8 +334,6 @@ static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
 
     VHDXHeader *active_header;
     VHDXHeader *inactive_header;
-    VHDXHeader header_le;
-    uint8_t *buffer;
 
     /* operate on the non-current header */
     if (s->curr_header == 0) {
@@ -311,31 +361,13 @@ static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
         inactive_header->log_guid = *log_guid;
     }
 
-    /* the header checksum is not over just the packed size of VHDXHeader,
-     * but rather over the entire 'reserved' range for the header, which is
-     * 4KB (VHDX_HEADER_SIZE). */
-
-    buffer = qemu_blockalign(bs, VHDX_HEADER_SIZE);
-    /* we can't assume the extra reserved bytes are 0 */
-    ret = bdrv_pread(bs->file, header_offset, buffer, VHDX_HEADER_SIZE);
-    if (ret < 0) {
-        goto exit;
-    }
-    /* overwrite the actual VHDXHeader portion */
-    memcpy(buffer, inactive_header, sizeof(VHDXHeader));
-    inactive_header->checksum =
-                        vhdx_update_checksum(buffer, VHDX_HEADER_SIZE,
-                                             offsetof(VHDXHeader, checksum));
-    vhdx_header_le_export(inactive_header, &header_le);
-    ret = bdrv_pwrite_sync(bs->file, header_offset, &header_le,
-                           sizeof(VHDXHeader));
+    vhdx_write_header(bs->file, inactive_header, header_offset, true);
     if (ret < 0) {
         goto exit;
     }
     s->curr_header = hdr_idx;
 
 exit:
-    qemu_vfree(buffer);
     return ret;
 }
 
@@ -773,10 +805,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
         goto exit;
     }
 
-    s->logical_sector_size_bits = 31 - clz32(s->logical_sector_size);
-    s->sectors_per_block_bits =   31 - clz32(s->sectors_per_block);
-    s->chunk_ratio_bits =         63 - clz64(s->chunk_ratio);
-    s->block_size_bits =          31 - clz32(s->block_size);
+    vhdx_set_shift_bits(s);
 
     ret = 0;
 
@@ -785,6 +814,31 @@ exit:
     return ret;
 }
 
+/*
+ * Calculate the number of BAT entries, including sector
+ * bitmap entries.
+ */
+static void vhdx_calc_bat_entries(BDRVVHDXState *s)
+{
+    uint32_t data_blocks_cnt, bitmap_blocks_cnt;
+
+    data_blocks_cnt = s->virtual_disk_size >> s->block_size_bits;
+    if (s->virtual_disk_size - (data_blocks_cnt << s->block_size_bits)) {
+        data_blocks_cnt++;
+    }
+    bitmap_blocks_cnt = data_blocks_cnt >> s->chunk_ratio_bits;
+    if (data_blocks_cnt - (bitmap_blocks_cnt << s->chunk_ratio_bits)) {
+        bitmap_blocks_cnt++;
+    }
+
+    if (s->parent_entries) {
+        s->bat_entries = bitmap_blocks_cnt * (s->chunk_ratio + 1);
+    } else {
+        s->bat_entries = data_blocks_cnt +
+                         ((data_blocks_cnt - 1) >> s->chunk_ratio_bits);
+    }
+
+}
 
 static void vhdx_close(BlockDriverState *bs)
 {
@@ -811,7 +865,6 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     int ret = 0;
     uint32_t i;
     uint64_t signature;
-    uint32_t data_blocks_cnt, bitmap_blocks_cnt;
     bool log_flushed = false;
 
 
@@ -862,21 +915,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
      * logical_sector_size */
     bs->total_sectors = s->virtual_disk_size >> s->logical_sector_size_bits;
 
-    data_blocks_cnt = s->virtual_disk_size >> s->block_size_bits;
-    if (s->virtual_disk_size - (data_blocks_cnt << s->block_size_bits)) {
-        data_blocks_cnt++;
-    }
-    bitmap_blocks_cnt = data_blocks_cnt >> s->chunk_ratio_bits;
-    if (data_blocks_cnt - (bitmap_blocks_cnt << s->chunk_ratio_bits)) {
-        bitmap_blocks_cnt++;
-    }
-
-    if (s->parent_entries) {
-        s->bat_entries = bitmap_blocks_cnt * (s->chunk_ratio + 1);
-    } else {
-        s->bat_entries = data_blocks_cnt +
-                         ((data_blocks_cnt - 1) >> s->chunk_ratio_bits);
-    }
+    vhdx_calc_bat_entries(s);
 
     s->bat_offset = s->bat_rt.file_offset;
 
commit c325ee1de84dde5b2a90c30e1b788defa31c5d53
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:50 2013 -0400

    block: vhdx - move more endian translations to vhdx-endian.c
    
    In preparation for vhdx_create(), move more endian translation
    functions out to vhdx-endian.c.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx-endian.c b/block/vhdx-endian.c
index 3e93e63..fe879ed 100644
--- a/block/vhdx-endian.c
+++ b/block/vhdx-endian.c
@@ -139,3 +139,78 @@ void vhdx_log_entry_hdr_le_export(VHDXLogEntryHeader *hdr)
 }
 
 
+/* Region table entries */
+void vhdx_region_header_le_import(VHDXRegionTableHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    le32_to_cpus(&hdr->signature);
+    le32_to_cpus(&hdr->checksum);
+    le32_to_cpus(&hdr->entry_count);
+}
+
+void vhdx_region_header_le_export(VHDXRegionTableHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    cpu_to_le32s(&hdr->signature);
+    cpu_to_le32s(&hdr->checksum);
+    cpu_to_le32s(&hdr->entry_count);
+}
+
+void vhdx_region_entry_le_import(VHDXRegionTableEntry *e)
+{
+    assert(e != NULL);
+
+    leguid_to_cpus(&e->guid);
+    le64_to_cpus(&e->file_offset);
+    le32_to_cpus(&e->length);
+    le32_to_cpus(&e->data_bits);
+}
+
+void vhdx_region_entry_le_export(VHDXRegionTableEntry *e)
+{
+    assert(e != NULL);
+
+    cpu_to_leguids(&e->guid);
+    cpu_to_le64s(&e->file_offset);
+    cpu_to_le32s(&e->length);
+    cpu_to_le32s(&e->data_bits);
+}
+
+
+/* Metadata headers & table */
+void vhdx_metadata_header_le_import(VHDXMetadataTableHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    le64_to_cpus(&hdr->signature);
+    le16_to_cpus(&hdr->entry_count);
+}
+
+void vhdx_metadata_header_le_export(VHDXMetadataTableHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    cpu_to_le64s(&hdr->signature);
+    cpu_to_le16s(&hdr->entry_count);
+}
+
+void vhdx_metadata_entry_le_import(VHDXMetadataTableEntry *e)
+{
+    assert(e != NULL);
+
+    leguid_to_cpus(&e->item_id);
+    le32_to_cpus(&e->offset);
+    le32_to_cpus(&e->length);
+    le32_to_cpus(&e->data_bits);
+}
+void vhdx_metadata_entry_le_export(VHDXMetadataTableEntry *e)
+{
+    assert(e != NULL);
+
+    cpu_to_leguids(&e->item_id);
+    cpu_to_le32s(&e->offset);
+    cpu_to_le32s(&e->length);
+    cpu_to_le32s(&e->data_bits);
+}
diff --git a/block/vhdx.c b/block/vhdx.c
index 158edab..7da149a 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -472,10 +472,7 @@ static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
         goto fail;
     }
     memcpy(&s->rt, buffer, sizeof(s->rt));
-    le32_to_cpus(&s->rt.signature);
-    le32_to_cpus(&s->rt.checksum);
-    le32_to_cpus(&s->rt.entry_count);
-    le32_to_cpus(&s->rt.reserved);
+    vhdx_region_header_le_import(&s->rt);
     offset += sizeof(s->rt);
 
     if (!vhdx_checksum_is_valid(buffer, VHDX_HEADER_BLOCK_SIZE, 4) ||
@@ -494,10 +491,7 @@ static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
         memcpy(&rt_entry, buffer + offset, sizeof(rt_entry));
         offset += sizeof(rt_entry);
 
-        leguid_to_cpus(&rt_entry.guid);
-        le64_to_cpus(&rt_entry.file_offset);
-        le32_to_cpus(&rt_entry.length);
-        le32_to_cpus(&rt_entry.data_bits);
+        vhdx_region_entry_le_import(&rt_entry);
 
         /* check for region overlap between these entries, and any
          * other memory regions in the file */
@@ -587,9 +581,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
     memcpy(&s->metadata_hdr, buffer, sizeof(s->metadata_hdr));
     offset += sizeof(s->metadata_hdr);
 
-    le64_to_cpus(&s->metadata_hdr.signature);
-    le16_to_cpus(&s->metadata_hdr.reserved);
-    le16_to_cpus(&s->metadata_hdr.entry_count);
+    vhdx_metadata_header_le_import(&s->metadata_hdr);
 
     if (memcmp(&s->metadata_hdr.signature, "metadata", 8)) {
         ret = -EINVAL;
@@ -608,11 +600,7 @@ static int vhdx_parse_metadata(BlockDriverState *bs, BDRVVHDXState *s)
         memcpy(&md_entry, buffer + offset, sizeof(md_entry));
         offset += sizeof(md_entry);
 
-        leguid_to_cpus(&md_entry.item_id);
-        le32_to_cpus(&md_entry.offset);
-        le32_to_cpus(&md_entry.length);
-        le32_to_cpus(&md_entry.data_bits);
-        le32_to_cpus(&md_entry.reserved2);
+        vhdx_metadata_entry_le_import(&md_entry);
 
         if (guid_eq(md_entry.item_id, file_param_guid)) {
             if (s->metadata_entries.present & META_FILE_PARAMETER_PRESENT) {
diff --git a/block/vhdx.h b/block/vhdx.h
index d3598e0..15486c7 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -421,7 +421,14 @@ void vhdx_log_desc_le_export(VHDXLogDescriptor *d);
 void vhdx_log_data_le_export(VHDXLogDataSector *d);
 void vhdx_log_entry_hdr_le_import(VHDXLogEntryHeader *hdr);
 void vhdx_log_entry_hdr_le_export(VHDXLogEntryHeader *hdr);
-
+void vhdx_region_header_le_import(VHDXRegionTableHeader *hdr);
+void vhdx_region_header_le_export(VHDXRegionTableHeader *hdr);
+void vhdx_region_entry_le_import(VHDXRegionTableEntry *e);
+void vhdx_region_entry_le_export(VHDXRegionTableEntry *e);
+void vhdx_metadata_header_le_import(VHDXMetadataTableHeader *hdr);
+void vhdx_metadata_header_le_export(VHDXMetadataTableHeader *hdr);
+void vhdx_metadata_entry_le_import(VHDXMetadataTableEntry *e);
+void vhdx_metadata_entry_le_export(VHDXMetadataTableEntry *e);
 int vhdx_user_visible_write(BlockDriverState *bs, BDRVVHDXState *s);
 
 #endif
commit 0b7da092b40734538631c3ad461c1753a87535fc
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:49 2013 -0400

    block: vhdx - remove BAT file offset bit shifting
    
    Bit shifting can be fun, but in this case it was unnecessary.  The
    upper 44 bits of the 64-bit BAT entry is specifies the File Offset,
    so we shifted the bits to get access to the value.
    
    However, per the spec the value is in MB.  So we dutifully shifted back
    to the left by 20 bits, to convert to a true uint64_t file offset.
    
    This replaces those steps with just a bit mask, to get rid of the lower
    20 bits instead.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 050f071..158edab 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -985,7 +985,7 @@ static void vhdx_block_translate(BDRVVHDXState *s, int64_t sector_num,
 
     sinfo->bytes_avail = sinfo->sectors_avail << s->logical_sector_size_bits;
 
-    sinfo->file_offset = s->bat[sinfo->bat_idx] >> VHDX_BAT_FILE_OFF_BITS;
+    sinfo->file_offset = s->bat[sinfo->bat_idx] & VHDX_BAT_FILE_OFF_MASK;
 
     sinfo->block_offset = block_offset << s->logical_sector_size_bits;
 
@@ -999,7 +999,6 @@ static void vhdx_block_translate(BDRVVHDXState *s, int64_t sector_num,
      * in the block, and add in the payload data block offset
      * in the file, in bytes, to get the final read address */
 
-    sinfo->file_offset <<= 20;  /* now in bytes, rather than 1MB units */
     sinfo->file_offset += sinfo->block_offset;
 }
 
@@ -1098,8 +1097,7 @@ static void vhdx_update_bat_table_entry(BlockDriverState *bs, BDRVVHDXState *s,
 {
     /* The BAT entry is a uint64, with 44 bits for the file offset in units of
      * 1MB, and 3 bits for the block state. */
-    s->bat[sinfo->bat_idx]  = ((sinfo->file_offset>>20) <<
-                               VHDX_BAT_FILE_OFF_BITS);
+    s->bat[sinfo->bat_idx]  = sinfo->file_offset;
 
     s->bat[sinfo->bat_idx] |= state & VHDX_BAT_STATE_BIT_MASK;
 
diff --git a/block/vhdx.h b/block/vhdx.h
index f331548..d3598e0 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -229,7 +229,6 @@ typedef struct QEMU_PACKED VHDXLogDataSector {
 /* upper 44 bits are the file offset in 1MB units lower 3 bits are the state
    other bits are reserved */
 #define VHDX_BAT_STATE_BIT_MASK 0x07
-#define VHDX_BAT_FILE_OFF_BITS (64 - 44)
 #define VHDX_BAT_FILE_OFF_MASK  0xFFFFFFFFFFF00000 /* upper 44 bits */
 typedef uint64_t VHDXBatEntry;
 
commit d92aa8833c051b53d3bf2614ff885df0037f10bb
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:48 2013 -0400

    block: vhdx write support
    
    This adds support for writing to VHDX image files, using coroutines.
    Writes into the BAT table goes through the VHDX log.  Currently, BAT
    table writes occur when expanding a dynamic VHDX file, and allocating a
    new BAT entry.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 574ac4c..050f071 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -914,7 +914,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
         if (payblocks--) {
             /* payload bat entries */
             if ((s->bat[i] & VHDX_BAT_STATE_BIT_MASK) ==
-                    PAYLOAD_BLOCK_FULL_PRESENT) {
+                    PAYLOAD_BLOCK_FULLY_PRESENT) {
                 ret = vhdx_region_check(s, s->bat[i] & VHDX_BAT_FILE_OFF_MASK,
                                         s->block_size);
                 if (ret < 0) {
@@ -935,7 +935,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
         }
     }
 
-    /* TODO: differencing files, write */
+    /* TODO: differencing files */
 
     /* Disable migration when VHDX images are used */
     error_set(&s->migration_blocker,
@@ -1040,7 +1040,7 @@ static coroutine_fn int vhdx_co_readv(BlockDriverState *bs, int64_t sector_num,
                 /* return zero */
                 qemu_iovec_memset(&hd_qiov, 0, 0, sinfo.bytes_avail);
                 break;
-            case PAYLOAD_BLOCK_FULL_PRESENT:
+            case PAYLOAD_BLOCK_FULLY_PRESENT:
                 qemu_co_mutex_unlock(&s->lock);
                 ret = bdrv_co_readv(bs->file,
                                     sinfo.file_offset >> BDRV_SECTOR_BITS,
@@ -1070,7 +1070,43 @@ exit:
     return ret;
 }
 
+/*
+ * Allocate a new payload block at the end of the file.
+ *
+ * Allocation will happen at 1MB alignment inside the file
+ *
+ * Returns the file offset start of the new payload block
+ */
+static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
+                                    uint64_t *new_offset)
+{
+    *new_offset = bdrv_getlength(bs->file);
+
+    /* per the spec, the address for a block is in units of 1MB */
+    *new_offset = ROUND_UP(*new_offset, 1024 * 1024);
+
+    return bdrv_truncate(bs->file, *new_offset + s->block_size);
+}
+
+/*
+ * Update the BAT table entry with the new file offset, and the new entry
+ * state */
+static void vhdx_update_bat_table_entry(BlockDriverState *bs, BDRVVHDXState *s,
+                                       VHDXSectorInfo *sinfo,
+                                       uint64_t *bat_entry_le,
+                                       uint64_t *bat_offset, int state)
+{
+    /* The BAT entry is a uint64, with 44 bits for the file offset in units of
+     * 1MB, and 3 bits for the block state. */
+    s->bat[sinfo->bat_idx]  = ((sinfo->file_offset>>20) <<
+                               VHDX_BAT_FILE_OFF_BITS);
 
+    s->bat[sinfo->bat_idx] |= state & VHDX_BAT_STATE_BIT_MASK;
+
+    *bat_entry_le = cpu_to_le64(s->bat[sinfo->bat_idx]);
+    *bat_offset = s->bat_offset + sinfo->bat_idx * sizeof(VHDXBatEntry);
+
+}
 
 /* Per the spec, on the first write of guest-visible data to the file the
  * data write guid must be updated in the header */
@@ -1087,7 +1123,175 @@ int vhdx_user_visible_write(BlockDriverState *bs, BDRVVHDXState *s)
 static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
                                       int nb_sectors, QEMUIOVector *qiov)
 {
-    return -ENOTSUP;
+    int ret = -ENOTSUP;
+    BDRVVHDXState *s = bs->opaque;
+    VHDXSectorInfo sinfo;
+    uint64_t bytes_done = 0;
+    uint64_t bat_entry = 0;
+    uint64_t bat_entry_offset = 0;
+    QEMUIOVector hd_qiov;
+    struct iovec iov1 = { 0 };
+    struct iovec iov2 = { 0 };
+    int sectors_to_write;
+    int bat_state;
+    uint64_t bat_prior_offset = 0;
+    bool bat_update = false;
+
+    qemu_iovec_init(&hd_qiov, qiov->niov);
+
+    qemu_co_mutex_lock(&s->lock);
+
+    ret = vhdx_user_visible_write(bs, s);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    while (nb_sectors > 0) {
+        bool use_zero_buffers = false;
+        bat_update = false;
+        if (s->params.data_bits & VHDX_PARAMS_HAS_PARENT) {
+            /* not supported yet */
+            ret = -ENOTSUP;
+            goto exit;
+        } else {
+            vhdx_block_translate(s, sector_num, nb_sectors, &sinfo);
+            sectors_to_write = sinfo.sectors_avail;
+
+            qemu_iovec_reset(&hd_qiov);
+            /* check the payload block state */
+            bat_state = s->bat[sinfo.bat_idx] & VHDX_BAT_STATE_BIT_MASK;
+            switch (bat_state) {
+            case PAYLOAD_BLOCK_ZERO:
+                /* in this case, we need to preserve zero writes for
+                 * data that is not part of this write, so we must pad
+                 * the rest of the buffer to zeroes */
+
+                /* if we are on a posix system with ftruncate() that extends
+                 * a file, then it is zero-filled for us.  On Win32, the raw
+                 * layer uses SetFilePointer and SetFileEnd, which does not
+                 * zero fill AFAIK */
+
+                /* Queue another write of zero buffers if the underlying file
+                 * does not zero-fill on file extension */
+
+                if (bdrv_has_zero_init(bs->file) == 0) {
+                    use_zero_buffers = true;
+
+                    /* zero fill the front, if any */
+                    if (sinfo.block_offset) {
+                        iov1.iov_len = sinfo.block_offset;
+                        iov1.iov_base = qemu_blockalign(bs, iov1.iov_len);
+                        memset(iov1.iov_base, 0, iov1.iov_len);
+                        qemu_iovec_concat_iov(&hd_qiov, &iov1, 1, 0,
+                                              sinfo.block_offset);
+                        sectors_to_write += iov1.iov_len >> BDRV_SECTOR_BITS;
+                    }
+
+                    /* our actual data */
+                    qemu_iovec_concat(&hd_qiov, qiov,  bytes_done,
+                                      sinfo.bytes_avail);
+
+                    /* zero fill the back, if any */
+                    if ((sinfo.bytes_avail - sinfo.block_offset) <
+                         s->block_size) {
+                        iov2.iov_len = s->block_size -
+                                      (sinfo.bytes_avail + sinfo.block_offset);
+                        iov2.iov_base = qemu_blockalign(bs, iov2.iov_len);
+                        memset(iov2.iov_base, 0, iov2.iov_len);
+                        qemu_iovec_concat_iov(&hd_qiov, &iov2, 1, 0,
+                                              sinfo.block_offset);
+                        sectors_to_write += iov2.iov_len >> BDRV_SECTOR_BITS;
+                    }
+                }
+
+                /* fall through */
+            case PAYLOAD_BLOCK_NOT_PRESENT: /* fall through */
+            case PAYLOAD_BLOCK_UNMAPPED:    /* fall through */
+            case PAYLOAD_BLOCK_UNDEFINED:   /* fall through */
+                bat_prior_offset = sinfo.file_offset;
+                ret = vhdx_allocate_block(bs, s, &sinfo.file_offset);
+                if (ret < 0) {
+                    goto exit;
+                }
+                /* once we support differencing files, this may also be
+                 * partially present */
+                /* update block state to the newly specified state */
+                vhdx_update_bat_table_entry(bs, s, &sinfo, &bat_entry,
+                                            &bat_entry_offset,
+                                            PAYLOAD_BLOCK_FULLY_PRESENT);
+                bat_update = true;
+                /* since we just allocated a block, file_offset is the
+                 * beginning of the payload block. It needs to be the
+                 * write address, which includes the offset into the block */
+                if (!use_zero_buffers) {
+                    sinfo.file_offset += sinfo.block_offset;
+                }
+                /* fall through */
+            case PAYLOAD_BLOCK_FULLY_PRESENT:
+                /* if the file offset address is in the header zone,
+                 * there is a problem */
+                if (sinfo.file_offset < (1024 * 1024)) {
+                    ret = -EFAULT;
+                    goto error_bat_restore;
+                }
+
+                if (!use_zero_buffers) {
+                    qemu_iovec_concat(&hd_qiov, qiov,  bytes_done,
+                                      sinfo.bytes_avail);
+                }
+                /* block exists, so we can just overwrite it */
+                qemu_co_mutex_unlock(&s->lock);
+                ret = bdrv_co_writev(bs->file,
+                                    sinfo.file_offset >> BDRV_SECTOR_BITS,
+                                    sectors_to_write, &hd_qiov);
+                qemu_co_mutex_lock(&s->lock);
+                if (ret < 0) {
+                    goto error_bat_restore;
+                }
+                break;
+            case PAYLOAD_BLOCK_PARTIALLY_PRESENT:
+                /* we don't yet support difference files, fall through
+                 * to error */
+            default:
+                ret = -EIO;
+                goto exit;
+                break;
+            }
+
+            if (bat_update) {
+                /* this will update the BAT entry into the log journal, and
+                 * then flush the log journal out to disk */
+                ret =  vhdx_log_write_and_flush(bs, s, &bat_entry,
+                                                sizeof(VHDXBatEntry),
+                                                bat_entry_offset);
+                if (ret < 0) {
+                    goto exit;
+                }
+            }
+
+            nb_sectors -= sinfo.sectors_avail;
+            sector_num += sinfo.sectors_avail;
+            bytes_done += sinfo.bytes_avail;
+
+        }
+    }
+
+    goto exit;
+
+error_bat_restore:
+    if (bat_update) {
+        /* keep metadata in sync, and restore the bat entry state
+         * if error. */
+        sinfo.file_offset = bat_prior_offset;
+        vhdx_update_bat_table_entry(bs, s, &sinfo, &bat_entry,
+                                    &bat_entry_offset, bat_state);
+    }
+exit:
+    qemu_vfree(iov1.iov_base);
+    qemu_vfree(iov2.iov_base);
+    qemu_co_mutex_unlock(&s->lock);
+    qemu_iovec_destroy(&hd_qiov);
+    return ret;
 }
 
 
diff --git a/block/vhdx.h b/block/vhdx.h
index 6abbf50..f331548 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -217,7 +217,7 @@ typedef struct QEMU_PACKED VHDXLogDataSector {
 #define PAYLOAD_BLOCK_UNDEFINED         1
 #define PAYLOAD_BLOCK_ZERO              2
 #define PAYLOAD_BLOCK_UNMAPPED          5
-#define PAYLOAD_BLOCK_FULL_PRESENT      6
+#define PAYLOAD_BLOCK_FULLY_PRESENT     6
 #define PAYLOAD_BLOCK_PARTIALLY_PRESENT 7
 
 #define SB_BLOCK_NOT_PRESENT    0
commit 8adc52336d9c44ab4c7b9358a7be22ac0ef962bf
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:47 2013 -0400

    block: vhdx - add log write support
    
    This adds support for writing to the VHDX log.
    
    For spec details, see VHDX Specification Format v1.00:
    https://www.microsoft.com/en-us/download/details.aspx?id=34750
    
    There are a few limitations to this log support:
    1.) There is no caching yet
    2.) The log is flushed after each entry
    
    The primary write interface, vhdx_log_write_and_flush(), performs a log
    write followed by an immediate flush of the log.
    
    As each log entry sector is a minimum of 4KB, partial sector writes are
    filled in with data from the disk write destination.
    
    If the current file log GUID is 0, a new GUID is generated and updated
    in the header.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx-log.c b/block/vhdx-log.c
index 0284729..ee5583c 100644
--- a/block/vhdx-log.c
+++ b/block/vhdx-log.c
@@ -156,6 +156,55 @@ exit:
     return ret;
 }
 
+/* Writes num_sectors to the log (all log sectors are 4096 bytes),
+ * from buffer 'buffer'.  Upon return, *sectors_written will contain
+ * the number of sectors successfully written.
+ *
+ * It is assumed that 'buffer' is at least 4096*num_sectors large.
+ *
+ * 0 is returned on success, -errno otherwise */
+static int vhdx_log_write_sectors(BlockDriverState *bs, VHDXLogEntries *log,
+                                  uint32_t *sectors_written, void *buffer,
+                                  uint32_t num_sectors)
+{
+    int ret = 0;
+    uint64_t offset;
+    uint32_t write;
+    void *buffer_tmp;
+    BDRVVHDXState *s = bs->opaque;
+
+    ret = vhdx_user_visible_write(bs, s);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    write = log->write;
+
+    buffer_tmp = buffer;
+    while (num_sectors) {
+
+        offset = log->offset + write;
+        write = vhdx_log_inc_idx(write, log->length);
+        if (write == log->read) {
+            /* full */
+            break;
+        }
+        ret = bdrv_pwrite(bs->file, offset, buffer_tmp, VHDX_LOG_SECTOR_SIZE);
+        if (ret < 0) {
+            goto exit;
+        }
+        buffer_tmp += VHDX_LOG_SECTOR_SIZE;
+
+        log->write = write;
+        *sectors_written = *sectors_written + 1;
+        num_sectors--;
+    }
+
+exit:
+    return ret;
+}
+
+
 /* Validates a log entry header */
 static bool vhdx_log_hdr_is_valid(VHDXLogEntries *log, VHDXLogEntryHeader *hdr,
                                   BDRVVHDXState *s)
@@ -726,3 +775,236 @@ exit:
 }
 
 
+
+static void vhdx_log_raw_to_le_sector(VHDXLogDescriptor *desc,
+                                      VHDXLogDataSector *sector, void *data,
+                                      uint64_t seq)
+{
+    /* 8 + 4084 + 4 = 4096, 1 log sector */
+    memcpy(&desc->leading_bytes, data, 8);
+    data += 8;
+    cpu_to_le64s(&desc->leading_bytes);
+    memcpy(sector->data, data, 4084);
+    data += 4084;
+    memcpy(&desc->trailing_bytes, data, 4);
+    cpu_to_le32s(&desc->trailing_bytes);
+    data += 4;
+
+    sector->sequence_high  = (uint32_t) (seq >> 32);
+    sector->sequence_low   = (uint32_t) (seq & 0xffffffff);
+    sector->data_signature = VHDX_LOG_DATA_SIGNATURE;
+
+    vhdx_log_desc_le_export(desc);
+    vhdx_log_data_le_export(sector);
+}
+
+
+static int vhdx_log_write(BlockDriverState *bs, BDRVVHDXState *s,
+                          void *data, uint32_t length, uint64_t offset)
+{
+    int ret = 0;
+    void *buffer = NULL;
+    void *merged_sector = NULL;
+    void *data_tmp, *sector_write;
+    unsigned int i;
+    int sector_offset;
+    uint32_t desc_sectors, sectors, total_length;
+    uint32_t sectors_written = 0;
+    uint32_t aligned_length;
+    uint32_t leading_length = 0;
+    uint32_t trailing_length = 0;
+    uint32_t partial_sectors = 0;
+    uint32_t bytes_written = 0;
+    uint64_t file_offset;
+    VHDXHeader *header;
+    VHDXLogEntryHeader new_hdr;
+    VHDXLogDescriptor *new_desc = NULL;
+    VHDXLogDataSector *data_sector = NULL;
+    MSGUID new_guid = { 0 };
+
+    header = s->headers[s->curr_header];
+
+    /* need to have offset read data, and be on 4096 byte boundary */
+
+    if (length > header->log_length) {
+        /* no log present.  we could create a log here instead of failing */
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    if (guid_eq(header->log_guid, zero_guid)) {
+        vhdx_guid_generate(&new_guid);
+        vhdx_update_headers(bs, s, false, &new_guid);
+    } else {
+        /* currently, we require that the log be flushed after
+         * every write. */
+        ret = -ENOTSUP;
+        goto exit;
+    }
+
+    /* 0 is an invalid sequence number, but may also represent the first
+     * log write (or a wrapped seq) */
+    if (s->log.sequence == 0) {
+        s->log.sequence = 1;
+    }
+
+    sector_offset = offset % VHDX_LOG_SECTOR_SIZE;
+    file_offset = (offset / VHDX_LOG_SECTOR_SIZE) * VHDX_LOG_SECTOR_SIZE;
+
+    aligned_length = length;
+
+    /* add in the unaligned head and tail bytes */
+    if (sector_offset) {
+        leading_length = (VHDX_LOG_SECTOR_SIZE - sector_offset);
+        leading_length = leading_length > length ? length : leading_length;
+        aligned_length -= leading_length;
+        partial_sectors++;
+    }
+
+    sectors = aligned_length / VHDX_LOG_SECTOR_SIZE;
+    trailing_length = aligned_length - (sectors * VHDX_LOG_SECTOR_SIZE);
+    if (trailing_length) {
+        partial_sectors++;
+    }
+
+    sectors += partial_sectors;
+
+    /* sectors is now how many sectors the data itself takes, not
+     * including the header and descriptor metadata */
+
+    new_hdr = (VHDXLogEntryHeader) {
+                .signature           = VHDX_LOG_SIGNATURE,
+                .tail                = s->log.tail,
+                .sequence_number     = s->log.sequence,
+                .descriptor_count    = sectors,
+                .reserved            = 0,
+                .flushed_file_offset = bdrv_getlength(bs->file),
+                .last_file_offset    = bdrv_getlength(bs->file),
+              };
+
+    new_hdr.log_guid = header->log_guid;
+
+    desc_sectors = vhdx_compute_desc_sectors(new_hdr.descriptor_count);
+
+    total_length = (desc_sectors + sectors) * VHDX_LOG_SECTOR_SIZE;
+    new_hdr.entry_length = total_length;
+
+    vhdx_log_entry_hdr_le_export(&new_hdr);
+
+    buffer = qemu_blockalign(bs, total_length);
+    memcpy(buffer, &new_hdr, sizeof(new_hdr));
+
+    new_desc = (VHDXLogDescriptor *) (buffer + sizeof(new_hdr));
+    data_sector = buffer + (desc_sectors * VHDX_LOG_SECTOR_SIZE);
+    data_tmp = data;
+
+    /* All log sectors are 4KB, so for any partial sectors we must
+     * merge the data with preexisting data from the final file
+     * destination */
+    merged_sector = qemu_blockalign(bs, VHDX_LOG_SECTOR_SIZE);
+
+    for (i = 0; i < sectors; i++) {
+        new_desc->signature       = VHDX_LOG_DESC_SIGNATURE;
+        new_desc->sequence_number = s->log.sequence;
+        new_desc->file_offset     = file_offset;
+
+        if (i == 0 && leading_length) {
+            /* partial sector at the front of the buffer */
+            ret = bdrv_pread(bs->file, file_offset, merged_sector,
+                             VHDX_LOG_SECTOR_SIZE);
+            if (ret < 0) {
+                goto exit;
+            }
+            memcpy(merged_sector + sector_offset, data_tmp, leading_length);
+            bytes_written = leading_length;
+            sector_write = merged_sector;
+        } else if (i == sectors - 1 && trailing_length) {
+            /* partial sector at the end of the buffer */
+            ret = bdrv_pread(bs->file,
+                            file_offset,
+                            merged_sector + trailing_length,
+                            VHDX_LOG_SECTOR_SIZE - trailing_length);
+            if (ret < 0) {
+                goto exit;
+            }
+            memcpy(merged_sector, data_tmp, trailing_length);
+            bytes_written = trailing_length;
+            sector_write = merged_sector;
+        } else {
+            bytes_written = VHDX_LOG_SECTOR_SIZE;
+            sector_write = data_tmp;
+        }
+
+        /* populate the raw sector data into the proper structures,
+         * as well as update the descriptor, and convert to proper
+         * endianness */
+        vhdx_log_raw_to_le_sector(new_desc, data_sector, sector_write,
+                                  s->log.sequence);
+
+        data_tmp += bytes_written;
+        data_sector++;
+        new_desc++;
+        file_offset += VHDX_LOG_SECTOR_SIZE;
+    }
+
+    /* checksum covers entire entry, from the log header through the
+     * last data sector */
+    vhdx_update_checksum(buffer, total_length,
+                         offsetof(VHDXLogEntryHeader, checksum));
+    cpu_to_le32s((uint32_t *)(buffer + 4));
+
+    /* now write to the log */
+    vhdx_log_write_sectors(bs, &s->log, &sectors_written, buffer,
+                           desc_sectors + sectors);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    if (sectors_written != desc_sectors + sectors) {
+        /* instead of failing, we could flush the log here */
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    s->log.sequence++;
+    /* write new tail */
+    s->log.tail = s->log.write;
+
+exit:
+    qemu_vfree(buffer);
+    qemu_vfree(merged_sector);
+    return ret;
+}
+
+/* Perform a log write, and then immediately flush the entire log */
+int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
+                             void *data, uint32_t length, uint64_t offset)
+{
+    int ret = 0;
+    VHDXLogSequence logs = { .valid = true,
+                             .count = 1,
+                             .hdr = { 0 } };
+
+
+    /* Make sure data written (new and/or changed blocks) is stable
+     * on disk, before creating log entry */
+    bdrv_flush(bs);
+    ret = vhdx_log_write(bs, s, data, length, offset);
+    if (ret < 0) {
+        goto exit;
+    }
+    logs.log = s->log;
+
+    /* Make sure log is stable on disk */
+    bdrv_flush(bs);
+    ret = vhdx_log_flush(bs, s, &logs);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    s->log = logs.log;
+
+exit:
+    return ret;
+}
+
diff --git a/block/vhdx.h b/block/vhdx.h
index d906559..6abbf50 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -398,6 +398,9 @@ bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset);
 
 int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s, bool *flushed);
 
+int vhdx_log_write_and_flush(BlockDriverState *bs, BDRVVHDXState *s,
+                             void *data, uint32_t length, uint64_t offset);
+
 static inline void leguid_to_cpus(MSGUID *guid)
 {
     le32_to_cpus(&guid->data1);
commit 1a848fd4517820981b542e0d10e64c0426414229
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:46 2013 -0400

    block: vhdx - add region overlap detection for image files
    
    Regions in the image file cannot overlap - the log, region tables,
    and metdata must all be unique and non-overlapping.
    
    This adds region checking by means of a QLIST; there can be a variable
    number of regions and metadata (there may be metadata or region tables
    that we do not recognize / know about, but are not required).
    
    This adds the capability to register a region for later checking, and
    to check against registered regions for any overlap.
    
    Also, if neither the BAT or Metadata region tables are found, return
    error.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 8fbfbd6..574ac4c 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -204,6 +204,50 @@ void vhdx_guid_generate(MSGUID *guid)
     memcpy(guid, uuid, sizeof(MSGUID));
 }
 
+/* Check for region overlaps inside the VHDX image */
+static int vhdx_region_check(BDRVVHDXState *s, uint64_t start, uint64_t length)
+{
+    int ret = 0;
+    uint64_t end;
+    VHDXRegionEntry *r;
+
+    end = start + length;
+    QLIST_FOREACH(r, &s->regions, entries) {
+        if (!((start >= r->end) || (end <= r->start))) {
+            ret = -EINVAL;
+            goto exit;
+        }
+    }
+
+exit:
+    return ret;
+}
+
+/* Register a region for future checks */
+static void vhdx_region_register(BDRVVHDXState *s,
+                                 uint64_t start, uint64_t length)
+{
+    VHDXRegionEntry *r;
+
+    r = g_malloc0(sizeof(*r));
+
+    r->start = start;
+    r->end = start + length;
+
+    QLIST_INSERT_HEAD(&s->regions, r, entries);
+}
+
+/* Free all registered regions */
+static void vhdx_region_unregister_all(BDRVVHDXState *s)
+{
+    VHDXRegionEntry *r, *r_next;
+
+    QLIST_FOREACH_SAFE(r, &s->regions, entries, r_next) {
+        QLIST_REMOVE(r, entries);
+        g_free(r);
+    }
+}
+
 /*
  * Per the MS VHDX Specification, for every VHDX file:
  *      - The header section is fixed size - 1 MB
@@ -389,6 +433,9 @@ static int vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s)
         }
     }
 
+    vhdx_region_register(s, s->headers[s->curr_header]->log_offset,
+                            s->headers[s->curr_header]->log_length);
+
     ret = 0;
 
     goto exit;
@@ -452,6 +499,15 @@ static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
         le32_to_cpus(&rt_entry.length);
         le32_to_cpus(&rt_entry.data_bits);
 
+        /* check for region overlap between these entries, and any
+         * other memory regions in the file */
+        ret = vhdx_region_check(s, rt_entry.file_offset, rt_entry.length);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        vhdx_region_register(s, rt_entry.file_offset, rt_entry.length);
+
         /* see if we recognize the entry */
         if (guid_eq(rt_entry.guid, bat_guid)) {
             /* must be unique; if we have already found it this is invalid */
@@ -482,6 +538,12 @@ static int vhdx_open_region_tables(BlockDriverState *bs, BDRVVHDXState *s)
             goto fail;
         }
     }
+
+    if (!bat_rt_found || !metadata_rt_found) {
+        ret = -EINVAL;
+        goto fail;
+    }
+
     ret = 0;
 
 fail:
@@ -751,6 +813,7 @@ static void vhdx_close(BlockDriverState *bs)
     error_free(s->migration_blocker);
     qemu_vfree(s->log.hdr);
     s->log.hdr = NULL;
+    vhdx_region_unregister_all(s);
 }
 
 static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
@@ -768,6 +831,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     s->first_visible_write = true;
 
     qemu_co_mutex_init(&s->lock);
+    QLIST_INIT(&s->regions);
 
     /* validate the file signature */
     ret = bdrv_pread(bs->file, 0, &signature, sizeof(uint64_t));
@@ -842,8 +906,26 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 
+    uint64_t payblocks = s->chunk_ratio;
+    /* endian convert, and verify populated BAT field file offsets against
+     * region table and log entries */
     for (i = 0; i < s->bat_entries; i++) {
         le64_to_cpus(&s->bat[i]);
+        if (payblocks--) {
+            /* payload bat entries */
+            if ((s->bat[i] & VHDX_BAT_STATE_BIT_MASK) ==
+                    PAYLOAD_BLOCK_FULL_PRESENT) {
+                ret = vhdx_region_check(s, s->bat[i] & VHDX_BAT_FILE_OFF_MASK,
+                                        s->block_size);
+                if (ret < 0) {
+                    goto fail;
+                }
+            }
+        } else {
+            payblocks = s->chunk_ratio;
+            /* Once differencing files are supported, verify sector bitmap
+             * blocks here */
+        }
     }
 
     if (flags & BDRV_O_RDWR) {
diff --git a/block/vhdx.h b/block/vhdx.h
index 584ebec..d906559 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -230,6 +230,7 @@ typedef struct QEMU_PACKED VHDXLogDataSector {
    other bits are reserved */
 #define VHDX_BAT_STATE_BIT_MASK 0x07
 #define VHDX_BAT_FILE_OFF_BITS (64 - 44)
+#define VHDX_BAT_FILE_OFF_MASK  0xFFFFFFFFFFF00000 /* upper 44 bits */
 typedef uint64_t VHDXBatEntry;
 
 /* ---- METADATA REGION STRUCTURES ---- */
@@ -334,6 +335,12 @@ typedef struct VHDXLogEntries {
     uint32_t tail;
 } VHDXLogEntries;
 
+typedef struct VHDXRegionEntry {
+    uint64_t start;
+    uint64_t end;
+    QLIST_ENTRY(VHDXRegionEntry) entries;
+} VHDXRegionEntry;
+
 typedef struct BDRVVHDXState {
     CoMutex lock;
 
@@ -374,6 +381,8 @@ typedef struct BDRVVHDXState {
     VHDXParentLocatorEntry *parent_entries;
 
     Error *migration_blocker;
+
+    QLIST_HEAD(VHDXRegionHead, VHDXRegionEntry) regions;
 } BDRVVHDXState;
 
 void vhdx_guid_generate(MSGUID *guid);
commit 0a43a1b5d7c33208120eeb2d98ebb9ab15dc2c87
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:45 2013 -0400

    block: vhdx - log parsing, replay, and flush support
    
    This adds support for VHDX v0 logs, as specified in Microsoft's
    VHDX Specification Format v1.00:
    https://www.microsoft.com/en-us/download/details.aspx?id=34750
    
    The following support is added:
    
    * Log parsing, and validation - validate that an existing log
      is correct.
    
    * Log search - search through an existing log, to find any valid
      sequence of entries.
    
    * Log replay and flush - replay an existing log, and flush/clear
      the log when complete.
    
    The VHDX log is a circular buffer, with elements (sectors) of 4KB.
    
    A log entry is a variably-length number of sectors, that is
    comprised of a header and 'descriptors', that describe each sector.
    
    A log may contain multiple entries, know as a log sequence.  In a log
    sequence, each log entry immediately follows the previous entry, with an
    incrementing sequence number.  There can only ever be one active and
    valid sequence in the log.
    
    Each log entry must match the file log GUID in order to be valid (along
    with other criteria).  Once we have flushed all valid log entries, we
    marked the file log GUID to be zero, which indicates a buffer with no
    valid entries.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/Makefile.objs b/block/Makefile.objs
index 2fc496a..f43ecbc 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -2,7 +2,7 @@ block-obj-y += raw_bsd.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o v
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
 block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
-block-obj-$(CONFIG_VHDX) += vhdx.o vhdx-endian.o
+block-obj-$(CONFIG_VHDX) += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += parallels.o blkdebug.o blkverify.o
 block-obj-y += snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += raw-win32.o win32-aio.o
diff --git a/block/vhdx-log.c b/block/vhdx-log.c
new file mode 100644
index 0000000..0284729
--- /dev/null
+++ b/block/vhdx-log.c
@@ -0,0 +1,728 @@
+/*
+ * Block driver for Hyper-V VHDX Images
+ *
+ * Copyright (c) 2013 Red Hat, Inc.,
+ *
+ * Authors:
+ *  Jeff Cody <jcody at redhat.com>
+ *
+ *  This is based on the "VHDX Format Specification v1.00", published 8/25/2012
+ *  by Microsoft:
+ *      https://www.microsoft.com/en-us/download/details.aspx?id=34750
+ *
+ * This file covers the functionality of the metadata log writing, parsing, and
+ * replay.
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+#include "qemu-common.h"
+#include "block/block_int.h"
+#include "qemu/module.h"
+#include "block/vhdx.h"
+
+
+typedef struct VHDXLogSequence {
+    bool valid;
+    uint32_t count;
+    VHDXLogEntries log;
+    VHDXLogEntryHeader hdr;
+} VHDXLogSequence;
+
+typedef struct VHDXLogDescEntries {
+    VHDXLogEntryHeader hdr;
+    VHDXLogDescriptor desc[];
+} VHDXLogDescEntries;
+
+static const MSGUID zero_guid = { 0 };
+
+/* The log located on the disk is circular buffer containing
+ * sectors of 4096 bytes each.
+ *
+ * It is assumed for the read/write functions below that the
+ * circular buffer scheme uses a 'one sector open' to indicate
+ * the buffer is full.  Given the validation methods used for each
+ * sector, this method should be compatible with other methods that
+ * do not waste a sector.
+ */
+
+
+/* Allow peeking at the hdr entry at the beginning of the current
+ * read index, without advancing the read index */
+static int vhdx_log_peek_hdr(BlockDriverState *bs, VHDXLogEntries *log,
+                             VHDXLogEntryHeader *hdr)
+{
+    int ret = 0;
+    uint64_t offset;
+    uint32_t read;
+
+    assert(hdr != NULL);
+
+    /* peek is only supported on sector boundaries */
+    if (log->read % VHDX_LOG_SECTOR_SIZE) {
+        ret = -EFAULT;
+        goto exit;
+    }
+
+    read = log->read;
+    /* we are guaranteed that a) log sectors are 4096 bytes,
+     * and b) the log length is a multiple of 1MB. So, there
+     * is always a round number of sectors in the buffer */
+    if ((read + sizeof(VHDXLogEntryHeader)) > log->length) {
+        read = 0;
+    }
+
+    if (read == log->write) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    offset = log->offset + read;
+
+    ret = bdrv_pread(bs->file, offset, hdr, sizeof(VHDXLogEntryHeader));
+    if (ret < 0) {
+        goto exit;
+    }
+
+exit:
+    return ret;
+}
+
+/* Index increment for log, based on sector boundaries */
+static int vhdx_log_inc_idx(uint32_t idx, uint64_t length)
+{
+    idx += VHDX_LOG_SECTOR_SIZE;
+    /* we are guaranteed that a) log sectors are 4096 bytes,
+     * and b) the log length is a multiple of 1MB. So, there
+     * is always a round number of sectors in the buffer */
+    return idx >= length ? 0 : idx;
+}
+
+
+/* Reset the log to empty */
+static void vhdx_log_reset(BlockDriverState *bs, BDRVVHDXState *s)
+{
+    MSGUID guid = { 0 };
+    s->log.read = s->log.write = 0;
+    /* a log guid of 0 indicates an empty log to any parser of v0
+     * VHDX logs */
+    vhdx_update_headers(bs, s, false, &guid);
+}
+
+/* Reads num_sectors from the log (all log sectors are 4096 bytes),
+ * into buffer 'buffer'.  Upon return, *sectors_read will contain
+ * the number of sectors successfully read.
+ *
+ * It is assumed that 'buffer' is already allocated, and of sufficient
+ * size (i.e. >= 4096*num_sectors).
+ *
+ * If 'peek' is true, then the tail (read) pointer for the circular buffer is
+ * not modified.
+ *
+ * 0 is returned on success, -errno otherwise.  */
+static int vhdx_log_read_sectors(BlockDriverState *bs, VHDXLogEntries *log,
+                                 uint32_t *sectors_read, void *buffer,
+                                 uint32_t num_sectors, bool peek)
+{
+    int ret = 0;
+    uint64_t offset;
+    uint32_t read;
+
+    read = log->read;
+
+    *sectors_read = 0;
+    while (num_sectors) {
+        if (read == log->write) {
+            /* empty */
+            break;
+        }
+        offset = log->offset + read;
+
+        ret = bdrv_pread(bs->file, offset, buffer, VHDX_LOG_SECTOR_SIZE);
+        if (ret < 0) {
+            goto exit;
+        }
+        read = vhdx_log_inc_idx(read, log->length);
+
+        *sectors_read = *sectors_read + 1;
+        num_sectors--;
+    }
+
+exit:
+    if (!peek) {
+        log->read = read;
+    }
+    return ret;
+}
+
+/* Validates a log entry header */
+static bool vhdx_log_hdr_is_valid(VHDXLogEntries *log, VHDXLogEntryHeader *hdr,
+                                  BDRVVHDXState *s)
+{
+    int valid = false;
+
+    if (memcmp(&hdr->signature, "loge", 4)) {
+        goto exit;
+    }
+
+    /* if the individual entry length is larger than the whole log
+     * buffer, that is obviously invalid */
+    if (log->length < hdr->entry_length) {
+        goto exit;
+    }
+
+    /* length of entire entry must be in units of 4KB (log sector size) */
+    if (hdr->entry_length % (VHDX_LOG_SECTOR_SIZE)) {
+        goto exit;
+    }
+
+    /* per spec, sequence # must be > 0 */
+    if (hdr->sequence_number == 0) {
+        goto exit;
+    }
+
+    /* log entries are only valid if they match the file-wide log guid
+     * found in the active header */
+    if (!guid_eq(hdr->log_guid, s->headers[s->curr_header]->log_guid)) {
+        goto exit;
+    }
+
+    if (hdr->descriptor_count * sizeof(VHDXLogDescriptor) > hdr->entry_length) {
+        goto exit;
+    }
+
+    valid = true;
+
+exit:
+    return valid;
+}
+
+/*
+ * Given a log header, this will validate that the descriptors and the
+ * corresponding data sectors (if applicable)
+ *
+ * Validation consists of:
+ *      1. Making sure the sequence numbers matches the entry header
+ *      2. Verifying a valid signature ('zero' or 'desc' for descriptors)
+ *      3. File offset field is a multiple of 4KB
+ *      4. If a data descriptor, the corresponding data sector
+ *         has its signature ('data') and matching sequence number
+ *
+ * @desc: the data buffer containing the descriptor
+ * @hdr:  the log entry header
+ *
+ * Returns true if valid
+ */
+static bool vhdx_log_desc_is_valid(VHDXLogDescriptor *desc,
+                                   VHDXLogEntryHeader *hdr)
+{
+    bool ret = false;
+
+    if (desc->sequence_number != hdr->sequence_number) {
+        goto exit;
+    }
+    if (desc->file_offset % VHDX_LOG_SECTOR_SIZE) {
+        goto exit;
+    }
+
+    if (!memcmp(&desc->signature, "zero", 4)) {
+        if (desc->zero_length % VHDX_LOG_SECTOR_SIZE == 0) {
+            /* valid */
+            ret = true;
+        }
+    } else if (!memcmp(&desc->signature, "desc", 4)) {
+            /* valid */
+            ret = true;
+    }
+
+exit:
+    return ret;
+}
+
+
+/* Prior to sector data for a log entry, there is the header
+ * and the descriptors referenced in the header:
+ *
+ * [] = 4KB sector
+ *
+ * [ hdr, desc ][   desc   ][ ... ][ data ][ ... ]
+ *
+ * The first sector in a log entry has a 64 byte header, and
+ * up to 126 32-byte descriptors.  If more descriptors than
+ * 126 are required, then subsequent sectors can have up to 128
+ * descriptors.  Each sector is 4KB.  Data follows the descriptor
+ * sectors.
+ *
+ * This will return the number of sectors needed to encompass
+ * the passed number of descriptors in desc_cnt.
+ *
+ * This will never return 0, even if desc_cnt is 0.
+ */
+static int vhdx_compute_desc_sectors(uint32_t desc_cnt)
+{
+    uint32_t desc_sectors;
+
+    desc_cnt += 2; /* account for header in first sector */
+    desc_sectors = desc_cnt / 128;
+    if (desc_cnt % 128) {
+        desc_sectors++;
+    }
+
+    return desc_sectors;
+}
+
+
+/* Reads the log header, and subsequent descriptors (if any).  This
+ * will allocate all the space for buffer, which must be NULL when
+ * passed into this function. Each descriptor will also be validated,
+ * and error returned if any are invalid. */
+static int vhdx_log_read_desc(BlockDriverState *bs, BDRVVHDXState *s,
+                              VHDXLogEntries *log, VHDXLogDescEntries **buffer)
+{
+    int ret = 0;
+    uint32_t desc_sectors;
+    uint32_t sectors_read;
+    VHDXLogEntryHeader hdr;
+    VHDXLogDescEntries *desc_entries = NULL;
+    int i;
+
+    assert(*buffer == NULL);
+
+    ret = vhdx_log_peek_hdr(bs, log, &hdr);
+    if (ret < 0) {
+        goto exit;
+    }
+    vhdx_log_entry_hdr_le_import(&hdr);
+    if (vhdx_log_hdr_is_valid(log, &hdr, s) == false) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count);
+    desc_entries = qemu_blockalign(bs, desc_sectors * VHDX_LOG_SECTOR_SIZE);
+
+    ret = vhdx_log_read_sectors(bs, log, &sectors_read, desc_entries,
+                                desc_sectors, false);
+    if (ret < 0) {
+        goto free_and_exit;
+    }
+    if (sectors_read != desc_sectors) {
+        ret = -EINVAL;
+        goto free_and_exit;
+    }
+
+    /* put in proper endianness, and validate each desc */
+    for (i = 0; i < hdr.descriptor_count; i++) {
+        vhdx_log_desc_le_import(&desc_entries->desc[i]);
+        if (vhdx_log_desc_is_valid(&desc_entries->desc[i], &hdr) == false) {
+            ret = -EINVAL;
+            goto free_and_exit;
+        }
+    }
+
+    *buffer = desc_entries;
+    goto exit;
+
+free_and_exit:
+    qemu_vfree(desc_entries);
+exit:
+    return ret;
+}
+
+
+/* Flushes the descriptor described by desc to the VHDX image file.
+ * If the descriptor is a data descriptor, than 'data' must be non-NULL,
+ * and >= 4096 bytes (VHDX_LOG_SECTOR_SIZE), containing the data to be
+ * written.
+ *
+ * Verification is performed to make sure the sequence numbers of a data
+ * descriptor match the sequence number in the desc.
+ *
+ * For a zero descriptor, it may describe multiple sectors to fill with zeroes.
+ * In this case, it should be noted that zeroes are written to disk, and the
+ * image file is not extended as a sparse file.  */
+static int vhdx_log_flush_desc(BlockDriverState *bs, VHDXLogDescriptor *desc,
+                               VHDXLogDataSector *data)
+{
+    int ret = 0;
+    uint64_t seq, file_offset;
+    uint32_t offset = 0;
+    void *buffer = NULL;
+    uint64_t count = 1;
+    int i;
+
+    buffer = qemu_blockalign(bs, VHDX_LOG_SECTOR_SIZE);
+
+    if (!memcmp(&desc->signature, "desc", 4)) {
+        /* data sector */
+        if (data == NULL) {
+            ret = -EFAULT;
+            goto exit;
+        }
+
+        /* The sequence number of the data sector must match that
+         * in the descriptor */
+        seq = data->sequence_high;
+        seq <<= 32;
+        seq |= data->sequence_low & 0xffffffff;
+
+        if (seq != desc->sequence_number) {
+            ret = -EINVAL;
+            goto exit;
+        }
+
+        /* Each data sector is in total 4096 bytes, however the first
+         * 8 bytes, and last 4 bytes, are located in the descriptor */
+        memcpy(buffer, &desc->leading_bytes, 8);
+        offset += 8;
+
+        memcpy(buffer+offset, data->data, 4084);
+        offset += 4084;
+
+        memcpy(buffer+offset, &desc->trailing_bytes, 4);
+
+    } else if (!memcmp(&desc->signature, "zero", 4)) {
+        /* write 'count' sectors of sector */
+        memset(buffer, 0, VHDX_LOG_SECTOR_SIZE);
+        count = desc->zero_length / VHDX_LOG_SECTOR_SIZE;
+    }
+
+    file_offset = desc->file_offset;
+
+    /* count is only > 1 if we are writing zeroes */
+    for (i = 0; i < count; i++) {
+        ret = bdrv_pwrite_sync(bs->file, file_offset, buffer,
+                               VHDX_LOG_SECTOR_SIZE);
+        if (ret < 0) {
+            goto exit;
+        }
+        file_offset += VHDX_LOG_SECTOR_SIZE;
+    }
+
+exit:
+    qemu_vfree(buffer);
+    return ret;
+}
+
+/* Flush the entire log (as described by 'logs') to the VHDX image
+ * file, and then set the log to 'empty' status once complete.
+ *
+ * The log entries should be validate prior to flushing */
+static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
+                          VHDXLogSequence *logs)
+{
+    int ret = 0;
+    int i;
+    uint32_t cnt, sectors_read;
+    uint64_t new_file_size;
+    void *data = NULL;
+    VHDXLogDescEntries *desc_entries = NULL;
+    VHDXLogEntryHeader hdr_tmp = { 0 };
+
+    cnt = logs->count;
+
+    data = qemu_blockalign(bs, VHDX_LOG_SECTOR_SIZE);
+
+    ret = vhdx_user_visible_write(bs, s);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    /* each iteration represents one log sequence, which may span multiple
+     * sectors */
+    while (cnt--) {
+        ret = vhdx_log_peek_hdr(bs, &logs->log, &hdr_tmp);
+        if (ret < 0) {
+            goto exit;
+        }
+        /* if the log shows a FlushedFileOffset larger than our current file
+         * size, then that means the file has been truncated / corrupted, and
+         * we must refused to open it / use it */
+        if (hdr_tmp.flushed_file_offset > bdrv_getlength(bs->file)) {
+            ret = -EINVAL;
+            goto exit;
+        }
+
+        ret = vhdx_log_read_desc(bs, s, &logs->log, &desc_entries);
+        if (ret < 0) {
+            goto exit;
+        }
+
+        for (i = 0; i < desc_entries->hdr.descriptor_count; i++) {
+            if (!memcmp(&desc_entries->desc[i].signature, "desc", 4)) {
+                /* data sector, so read a sector to flush */
+                ret = vhdx_log_read_sectors(bs, &logs->log, &sectors_read,
+                                            data, 1, false);
+                if (ret < 0) {
+                    goto exit;
+                }
+                if (sectors_read != 1) {
+                    ret = -EINVAL;
+                    goto exit;
+                }
+            }
+
+            ret = vhdx_log_flush_desc(bs, &desc_entries->desc[i], data);
+            if (ret < 0) {
+                goto exit;
+            }
+        }
+        if (bdrv_getlength(bs->file) < desc_entries->hdr.last_file_offset) {
+            new_file_size = desc_entries->hdr.last_file_offset;
+            if (new_file_size % (1024*1024)) {
+                /* round up to nearest 1MB boundary */
+                new_file_size = ((new_file_size >> 20) + 1) << 20;
+                bdrv_truncate(bs->file, new_file_size);
+            }
+        }
+        qemu_vfree(desc_entries);
+        desc_entries = NULL;
+    }
+
+    bdrv_flush(bs);
+    /* once the log is fully flushed, indicate that we have an empty log
+     * now.  This also sets the log guid to 0, to indicate an empty log */
+    vhdx_log_reset(bs, s);
+
+exit:
+    qemu_vfree(data);
+    qemu_vfree(desc_entries);
+    return ret;
+}
+
+static int vhdx_validate_log_entry(BlockDriverState *bs, BDRVVHDXState *s,
+                                   VHDXLogEntries *log, uint64_t seq,
+                                   bool *valid, VHDXLogEntryHeader *entry)
+{
+    int ret = 0;
+    VHDXLogEntryHeader hdr;
+    void *buffer = NULL;
+    uint32_t i, desc_sectors, total_sectors, crc;
+    uint32_t sectors_read = 0;
+    VHDXLogDescEntries *desc_buffer = NULL;
+
+    *valid = false;
+
+    ret = vhdx_log_peek_hdr(bs, log, &hdr);
+    if (ret < 0) {
+        goto inc_and_exit;
+    }
+
+    vhdx_log_entry_hdr_le_import(&hdr);
+
+
+    if (vhdx_log_hdr_is_valid(log, &hdr, s) == false) {
+        goto inc_and_exit;
+    }
+
+    if (seq > 0) {
+        if (hdr.sequence_number != seq + 1) {
+            goto inc_and_exit;
+        }
+    }
+
+    desc_sectors = vhdx_compute_desc_sectors(hdr.descriptor_count);
+
+    /* Read desc sectors, and calculate log checksum */
+
+    total_sectors = hdr.entry_length / VHDX_LOG_SECTOR_SIZE;
+
+
+    /* read_desc() will incrememnt the read idx */
+    ret = vhdx_log_read_desc(bs, s, log, &desc_buffer);
+    if (ret < 0) {
+        goto free_and_exit;
+    }
+
+    crc = vhdx_checksum_calc(0xffffffff, (void *)desc_buffer,
+                            desc_sectors * VHDX_LOG_SECTOR_SIZE, 4);
+    crc ^= 0xffffffff;
+
+    buffer = qemu_blockalign(bs, VHDX_LOG_SECTOR_SIZE);
+    if (total_sectors > desc_sectors) {
+        for (i = 0; i < total_sectors - desc_sectors; i++) {
+            sectors_read = 0;
+            ret = vhdx_log_read_sectors(bs, log, &sectors_read, buffer,
+                                        1, false);
+            if (ret < 0 || sectors_read != 1) {
+                goto free_and_exit;
+            }
+            crc = vhdx_checksum_calc(crc, buffer, VHDX_LOG_SECTOR_SIZE, -1);
+            crc ^= 0xffffffff;
+        }
+    }
+    crc ^= 0xffffffff;
+    if (crc != desc_buffer->hdr.checksum) {
+        goto free_and_exit;
+    }
+
+    *valid = true;
+    *entry = hdr;
+    goto free_and_exit;
+
+inc_and_exit:
+    log->read = vhdx_log_inc_idx(log->read, log->length);
+
+free_and_exit:
+    qemu_vfree(buffer);
+    qemu_vfree(desc_buffer);
+    return ret;
+}
+
+/* Search through the log circular buffer, and find the valid, active
+ * log sequence, if any exists
+ * */
+static int vhdx_log_search(BlockDriverState *bs, BDRVVHDXState *s,
+                           VHDXLogSequence *logs)
+{
+    int ret = 0;
+    uint32_t tail;
+    bool seq_valid = false;
+    VHDXLogSequence candidate = { 0 };
+    VHDXLogEntryHeader hdr = { 0 };
+    VHDXLogEntries curr_log;
+
+    memcpy(&curr_log, &s->log, sizeof(VHDXLogEntries));
+    curr_log.write = curr_log.length;   /* assume log is full */
+    curr_log.read = 0;
+
+
+    /* now we will go through the whole log sector by sector, until
+     * we find a valid, active log sequence, or reach the end of the
+     * log buffer */
+    for (;;) {
+        uint64_t curr_seq = 0;
+        VHDXLogSequence current = { 0 };
+
+        tail = curr_log.read;
+
+        ret = vhdx_validate_log_entry(bs, s, &curr_log, curr_seq,
+                                      &seq_valid, &hdr);
+        if (ret < 0) {
+            goto exit;
+        }
+
+        if (seq_valid) {
+            current.valid     = true;
+            current.log       = curr_log;
+            current.log.read  = tail;
+            current.log.write = curr_log.read;
+            current.count     = 1;
+            current.hdr       = hdr;
+
+
+            for (;;) {
+                ret = vhdx_validate_log_entry(bs, s, &curr_log, curr_seq,
+                                              &seq_valid, &hdr);
+                if (ret < 0) {
+                    goto exit;
+                }
+                if (seq_valid == false) {
+                    break;
+                }
+                current.log.write = curr_log.read;
+                current.count++;
+
+                curr_seq = hdr.sequence_number;
+            }
+        }
+
+        if (current.valid) {
+            if (candidate.valid == false ||
+                current.hdr.sequence_number > candidate.hdr.sequence_number) {
+                candidate = current;
+            }
+        }
+
+        if (curr_log.read < tail) {
+            break;
+        }
+    }
+
+    *logs = candidate;
+
+    if (candidate.valid) {
+        /* this is the next sequence number, for writes */
+        s->log.sequence = candidate.hdr.sequence_number + 1;
+    }
+
+
+exit:
+    return ret;
+}
+
+/* Parse the replay log.  Per the VHDX spec, if the log is present
+ * it must be replayed prior to opening the file, even read-only.
+ *
+ * If read-only, we must replay the log in RAM (or refuse to open
+ * a dirty VHDX file read-only) */
+int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s, bool *flushed)
+{
+    int ret = 0;
+    VHDXHeader *hdr;
+    VHDXLogSequence logs = { 0 };
+
+    hdr = s->headers[s->curr_header];
+
+    *flushed = false;
+
+    /* s->log.hdr is freed in vhdx_close() */
+    if (s->log.hdr == NULL) {
+        s->log.hdr = qemu_blockalign(bs, sizeof(VHDXLogEntryHeader));
+    }
+
+    s->log.offset = hdr->log_offset;
+    s->log.length = hdr->log_length;
+
+    if (s->log.offset < VHDX_LOG_MIN_SIZE ||
+        s->log.offset % VHDX_LOG_MIN_SIZE) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    /* per spec, only log version of 0 is supported */
+    if (hdr->log_version != 0) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    /* If either the log guid, or log length is zero,
+     * then a replay log is not present */
+    if (guid_eq(hdr->log_guid, zero_guid)) {
+        goto exit;
+    }
+
+    if (hdr->log_length == 0) {
+        goto exit;
+    }
+
+    if (hdr->log_length % VHDX_LOG_MIN_SIZE) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+
+    /* The log is present, we need to find if and where there is an active
+     * sequence of valid entries present in the log.  */
+
+    ret = vhdx_log_search(bs, s, &logs);
+    if (ret < 0) {
+        goto exit;
+    }
+
+    if (logs.valid) {
+        /* now flush the log */
+        ret = vhdx_log_flush(bs, s, &logs);
+        if (ret < 0) {
+            goto exit;
+        }
+        *flushed = true;
+    }
+
+
+exit:
+    return ret;
+}
+
+
diff --git a/block/vhdx.c b/block/vhdx.c
index 3f06ce3..8fbfbd6 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -735,58 +735,22 @@ exit:
     return ret;
 }
 
-/* Parse the replay log.  Per the VHDX spec, if the log is present
- * it must be replayed prior to opening the file, even read-only.
- *
- * If read-only, we must replay the log in RAM (or refuse to open
- * a dirty VHDX file read-only */
-static int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s)
-{
-    int ret = 0;
-    int i;
-    VHDXHeader *hdr;
-
-    hdr = s->headers[s->curr_header];
-
-    /* either the log guid, or log length is zero,
-     * then a replay log is present */
-    for (i = 0; i < sizeof(hdr->log_guid.data4); i++) {
-        ret |= hdr->log_guid.data4[i];
-    }
-    if (hdr->log_guid.data1 == 0 &&
-        hdr->log_guid.data2 == 0 &&
-        hdr->log_guid.data3 == 0 &&
-        ret == 0) {
-        goto exit;
-    }
-
-    /* per spec, only log version of 0 is supported */
-    if (hdr->log_version != 0) {
-        ret = -EINVAL;
-        goto exit;
-    }
-
-    if (hdr->log_length == 0) {
-        goto exit;
-    }
-
-    /* We currently do not support images with logs to replay */
-    ret = -ENOTSUP;
-
-exit:
-    return ret;
-}
-
 
 static void vhdx_close(BlockDriverState *bs)
 {
     BDRVVHDXState *s = bs->opaque;
     qemu_vfree(s->headers[0]);
+    s->headers[0] = NULL;
     qemu_vfree(s->headers[1]);
+    s->headers[1] = NULL;
     qemu_vfree(s->bat);
+    s->bat = NULL;
     qemu_vfree(s->parent_entries);
+    s->parent_entries = NULL;
     migrate_del_blocker(s->migration_blocker);
     error_free(s->migration_blocker);
+    qemu_vfree(s->log.hdr);
+    s->log.hdr = NULL;
 }
 
 static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
@@ -797,6 +761,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     uint32_t i;
     uint64_t signature;
     uint32_t data_blocks_cnt, bitmap_blocks_cnt;
+    bool log_flushed = false;
 
 
     s->bat = NULL;
@@ -820,24 +785,25 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     vhdx_guid_generate(&s->session_guid);
 
     ret = vhdx_parse_header(bs, s);
-    if (ret) {
+    if (ret < 0) {
         goto fail;
     }
 
-    ret = vhdx_parse_log(bs, s);
-    if (ret) {
+    ret = vhdx_parse_log(bs, s, &log_flushed);
+    if (ret < 0) {
         goto fail;
     }
 
     ret = vhdx_open_region_tables(bs, s);
-    if (ret) {
+    if (ret < 0) {
         goto fail;
     }
 
     ret = vhdx_parse_metadata(bs, s);
-    if (ret) {
+    if (ret < 0) {
         goto fail;
     }
+
     s->block_size = s->params.block_size;
 
     /* the VHDX spec dictates that virtual_disk_size is always a multiple of
@@ -897,10 +863,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
 
     return 0;
 fail:
-    qemu_vfree(s->headers[0]);
-    qemu_vfree(s->headers[1]);
-    qemu_vfree(s->bat);
-    qemu_vfree(s->parent_entries);
+    vhdx_close(bs);
     return ret;
 }
 
diff --git a/block/vhdx.h b/block/vhdx.h
index 6c35737..584ebec 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -326,7 +326,11 @@ typedef struct VHDXMetadataEntries {
 typedef struct VHDXLogEntries {
     uint64_t offset;
     uint64_t length;
-    uint32_t head;
+    uint32_t write;
+    uint32_t read;
+    VHDXLogEntryHeader *hdr;
+    void *desc_buffer;
+    uint64_t sequence;
     uint32_t tail;
 } VHDXLogEntries;
 
@@ -383,6 +387,7 @@ uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
 
 bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset);
 
+int vhdx_parse_log(BlockDriverState *bs, BDRVVHDXState *s, bool *flushed);
 
 static inline void leguid_to_cpus(MSGUID *guid)
 {
commit c46415afc2c99ea052f52f9d68ed9a78799f2c10
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:44 2013 -0400

    block: vhdx code movement - move vhdx_close() above vhdx_open()
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 241703a..3f06ce3 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -778,6 +778,17 @@ exit:
 }
 
 
+static void vhdx_close(BlockDriverState *bs)
+{
+    BDRVVHDXState *s = bs->opaque;
+    qemu_vfree(s->headers[0]);
+    qemu_vfree(s->headers[1]);
+    qemu_vfree(s->bat);
+    qemu_vfree(s->parent_entries);
+    migrate_del_blocker(s->migration_blocker);
+    error_free(s->migration_blocker);
+}
+
 static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
                      Error **errp)
 {
@@ -1035,17 +1046,6 @@ static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
 }
 
 
-static void vhdx_close(BlockDriverState *bs)
-{
-    BDRVVHDXState *s = bs->opaque;
-    qemu_vfree(s->headers[0]);
-    qemu_vfree(s->headers[1]);
-    qemu_vfree(s->bat);
-    qemu_vfree(s->parent_entries);
-    migrate_del_blocker(s->migration_blocker);
-    error_free(s->migration_blocker);
-}
-
 static BlockDriver bdrv_vhdx = {
     .format_name            = "vhdx",
     .instance_size          = sizeof(BDRVVHDXState),
commit c3906c5e8281b37a526c706596af8575d6ac00d3
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:43 2013 -0400

    block: vhdx - update log guid in header, and first write tracker
    
    Allow tracking of first file write in the VHDX image, as well as
    the ability to update the GUID in the header.  This is in preparation
    for log support.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 68663c6..241703a 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -230,7 +230,7 @@ static int vhdx_probe(const uint8_t *buf, int buf_size, const char *filename)
  *  - non-current header is updated with largest sequence number
  */
 static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
-                              bool generate_data_write_guid)
+                              bool generate_data_write_guid, MSGUID *log_guid)
 {
     int ret = 0;
     int hdr_idx = 0;
@@ -262,6 +262,11 @@ static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
         vhdx_guid_generate(&inactive_header->data_write_guid);
     }
 
+    /* update the log guid if present */
+    if (log_guid) {
+        inactive_header->log_guid = *log_guid;
+    }
+
     /* the header checksum is not over just the packed size of VHDXHeader,
      * but rather over the entire 'reserved' range for the header, which is
      * 4KB (VHDX_HEADER_SIZE). */
@@ -294,16 +299,16 @@ exit:
  * The VHDX spec calls for header updates to be performed twice, so that both
  * the current and non-current header have valid info
  */
-static int vhdx_update_headers(BlockDriverState *bs, BDRVVHDXState *s,
-                               bool generate_data_write_guid)
+int vhdx_update_headers(BlockDriverState *bs, BDRVVHDXState *s,
+                        bool generate_data_write_guid, MSGUID *log_guid)
 {
     int ret;
 
-    ret = vhdx_update_header(bs, s, generate_data_write_guid);
+    ret = vhdx_update_header(bs, s, generate_data_write_guid, log_guid);
     if (ret < 0) {
         return ret;
     }
-    ret = vhdx_update_header(bs, s, generate_data_write_guid);
+    ret = vhdx_update_header(bs, s, generate_data_write_guid, log_guid);
     return ret;
 }
 
@@ -784,6 +789,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
 
 
     s->bat = NULL;
+    s->first_visible_write = true;
 
     qemu_co_mutex_init(&s->lock);
 
@@ -864,7 +870,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     if (flags & BDRV_O_RDWR) {
-        ret = vhdx_update_headers(bs, s, false);
+        ret = vhdx_update_headers(bs, s, false, NULL);
         if (ret < 0) {
             goto fail;
         }
@@ -1010,6 +1016,18 @@ exit:
 
 
 
+/* Per the spec, on the first write of guest-visible data to the file the
+ * data write guid must be updated in the header */
+int vhdx_user_visible_write(BlockDriverState *bs, BDRVVHDXState *s)
+{
+    int ret = 0;
+    if (s->first_visible_write) {
+        s->first_visible_write = false;
+        ret = vhdx_update_headers(bs, s, true, NULL);
+    }
+    return ret;
+}
+
 static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
                                       int nb_sectors, QEMUIOVector *qiov)
 {
diff --git a/block/vhdx.h b/block/vhdx.h
index 23028af..6c35737 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -361,6 +361,7 @@ typedef struct BDRVVHDXState {
     VHDXBatEntry *bat;
     uint64_t bat_offset;
 
+    bool first_visible_write;
     MSGUID session_guid;
 
     VHDXLogEntries log;
@@ -373,6 +374,9 @@ typedef struct BDRVVHDXState {
 
 void vhdx_guid_generate(MSGUID *guid);
 
+int vhdx_update_headers(BlockDriverState *bs, BDRVVHDXState *s, bool rw,
+                        MSGUID *log_guid);
+
 uint32_t vhdx_update_checksum(uint8_t *buf, size_t size, int crc_offset);
 uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
                             int crc_offset);
@@ -402,4 +406,6 @@ void vhdx_log_data_le_export(VHDXLogDataSector *d);
 void vhdx_log_entry_hdr_le_import(VHDXLogEntryHeader *hdr);
 void vhdx_log_entry_hdr_le_export(VHDXLogEntryHeader *hdr);
 
+int vhdx_user_visible_write(BlockDriverState *bs, BDRVVHDXState *s);
+
 #endif
commit 0f48e8f0978afe0bd44c63749e7df6411da6c437
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:42 2013 -0400

    block: vhdx - break endian translation functions out
    
    This moves the endian translation functions out from the vhdx.c source,
    into a separate source file. In addition to the previously defined
    endian functions, new endian translation functions for log support are
    added as well.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/Makefile.objs b/block/Makefile.objs
index e7214de..2fc496a 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -2,7 +2,7 @@ block-obj-y += raw_bsd.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o v
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
 block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
-block-obj-$(CONFIG_VHDX) += vhdx.o
+block-obj-$(CONFIG_VHDX) += vhdx.o vhdx-endian.o
 block-obj-y += parallels.o blkdebug.o blkverify.o
 block-obj-y += snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += raw-win32.o win32-aio.o
diff --git a/block/vhdx-endian.c b/block/vhdx-endian.c
new file mode 100644
index 0000000..3e93e63
--- /dev/null
+++ b/block/vhdx-endian.c
@@ -0,0 +1,141 @@
+/*
+ * Block driver for Hyper-V VHDX Images
+ *
+ * Copyright (c) 2013 Red Hat, Inc.,
+ *
+ * Authors:
+ *  Jeff Cody <jcody at redhat.com>
+ *
+ *  This is based on the "VHDX Format Specification v1.00", published 8/25/2012
+ *  by Microsoft:
+ *      https://www.microsoft.com/en-us/download/details.aspx?id=34750
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ *
+ */
+
+#include "qemu-common.h"
+#include "block/block_int.h"
+#include "block/vhdx.h"
+
+#include <uuid/uuid.h>
+
+
+/*
+ * All the VHDX formats on disk are little endian - the following
+ * are helper import/export functions to correctly convert
+ * endianness from disk read to native cpu format, and back again.
+ */
+
+
+/* VHDX File Header */
+
+
+void vhdx_header_le_import(VHDXHeader *h)
+{
+    assert(h != NULL);
+
+    le32_to_cpus(&h->signature);
+    le32_to_cpus(&h->checksum);
+    le64_to_cpus(&h->sequence_number);
+
+    leguid_to_cpus(&h->file_write_guid);
+    leguid_to_cpus(&h->data_write_guid);
+    leguid_to_cpus(&h->log_guid);
+
+    le16_to_cpus(&h->log_version);
+    le16_to_cpus(&h->version);
+    le32_to_cpus(&h->log_length);
+    le64_to_cpus(&h->log_offset);
+}
+
+void vhdx_header_le_export(VHDXHeader *orig_h, VHDXHeader *new_h)
+{
+    assert(orig_h != NULL);
+    assert(new_h != NULL);
+
+    new_h->signature       = cpu_to_le32(orig_h->signature);
+    new_h->checksum        = cpu_to_le32(orig_h->checksum);
+    new_h->sequence_number = cpu_to_le64(orig_h->sequence_number);
+
+    new_h->file_write_guid = orig_h->file_write_guid;
+    new_h->data_write_guid = orig_h->data_write_guid;
+    new_h->log_guid        = orig_h->log_guid;
+
+    cpu_to_leguids(&new_h->file_write_guid);
+    cpu_to_leguids(&new_h->data_write_guid);
+    cpu_to_leguids(&new_h->log_guid);
+
+    new_h->log_version     = cpu_to_le16(orig_h->log_version);
+    new_h->version         = cpu_to_le16(orig_h->version);
+    new_h->log_length      = cpu_to_le32(orig_h->log_length);
+    new_h->log_offset      = cpu_to_le64(orig_h->log_offset);
+}
+
+
+/* VHDX Log Headers */
+
+
+void vhdx_log_desc_le_import(VHDXLogDescriptor *d)
+{
+    assert(d != NULL);
+
+    le32_to_cpus(&d->signature);
+    le32_to_cpus(&d->trailing_bytes);
+    le64_to_cpus(&d->leading_bytes);
+    le64_to_cpus(&d->file_offset);
+    le64_to_cpus(&d->sequence_number);
+}
+
+void vhdx_log_desc_le_export(VHDXLogDescriptor *d)
+{
+    assert(d != NULL);
+
+    cpu_to_le32s(&d->signature);
+    cpu_to_le32s(&d->trailing_bytes);
+    cpu_to_le64s(&d->leading_bytes);
+    cpu_to_le64s(&d->file_offset);
+    cpu_to_le64s(&d->sequence_number);
+}
+
+void vhdx_log_data_le_export(VHDXLogDataSector *d)
+{
+    assert(d != NULL);
+
+    cpu_to_le32s(&d->data_signature);
+    cpu_to_le32s(&d->sequence_high);
+    cpu_to_le32s(&d->sequence_low);
+}
+
+void vhdx_log_entry_hdr_le_import(VHDXLogEntryHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    le32_to_cpus(&hdr->signature);
+    le32_to_cpus(&hdr->checksum);
+    le32_to_cpus(&hdr->entry_length);
+    le32_to_cpus(&hdr->tail);
+    le64_to_cpus(&hdr->sequence_number);
+    le32_to_cpus(&hdr->descriptor_count);
+    leguid_to_cpus(&hdr->log_guid);
+    le64_to_cpus(&hdr->flushed_file_offset);
+    le64_to_cpus(&hdr->last_file_offset);
+}
+
+void vhdx_log_entry_hdr_le_export(VHDXLogEntryHeader *hdr)
+{
+    assert(hdr != NULL);
+
+    cpu_to_le32s(&hdr->signature);
+    cpu_to_le32s(&hdr->checksum);
+    cpu_to_le32s(&hdr->entry_length);
+    cpu_to_le32s(&hdr->tail);
+    cpu_to_le64s(&hdr->sequence_number);
+    cpu_to_le32s(&hdr->descriptor_count);
+    cpu_to_leguids(&hdr->log_guid);
+    cpu_to_le64s(&hdr->flushed_file_offset);
+    cpu_to_le64s(&hdr->last_file_offset);
+}
+
+
diff --git a/block/vhdx.c b/block/vhdx.c
index 2c921cf..68663c6 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -223,49 +223,6 @@ static int vhdx_probe(const uint8_t *buf, int buf_size, const char *filename)
     return 0;
 }
 
-/* All VHDX structures on disk are little endian */
-static void vhdx_header_le_import(VHDXHeader *h)
-{
-    assert(h != NULL);
-
-    le32_to_cpus(&h->signature);
-    le32_to_cpus(&h->checksum);
-    le64_to_cpus(&h->sequence_number);
-
-    leguid_to_cpus(&h->file_write_guid);
-    leguid_to_cpus(&h->data_write_guid);
-    leguid_to_cpus(&h->log_guid);
-
-    le16_to_cpus(&h->log_version);
-    le16_to_cpus(&h->version);
-    le32_to_cpus(&h->log_length);
-    le64_to_cpus(&h->log_offset);
-}
-
-/* All VHDX structures on disk are little endian */
-static void vhdx_header_le_export(VHDXHeader *orig_h, VHDXHeader *new_h)
-{
-    assert(orig_h != NULL);
-    assert(new_h != NULL);
-
-    new_h->signature       = cpu_to_le32(orig_h->signature);
-    new_h->checksum        = cpu_to_le32(orig_h->checksum);
-    new_h->sequence_number = cpu_to_le64(orig_h->sequence_number);
-
-    new_h->file_write_guid = orig_h->file_write_guid;
-    new_h->data_write_guid = orig_h->data_write_guid;
-    new_h->log_guid        = orig_h->log_guid;
-
-    cpu_to_leguids(&new_h->file_write_guid);
-    cpu_to_leguids(&new_h->data_write_guid);
-    cpu_to_leguids(&new_h->log_guid);
-
-    new_h->log_version     = cpu_to_le16(orig_h->log_version);
-    new_h->version         = cpu_to_le16(orig_h->version);
-    new_h->log_length      = cpu_to_le32(orig_h->log_length);
-    new_h->log_offset      = cpu_to_le64(orig_h->log_offset);
-}
-
 /* Update the VHDX headers
  *
  * This follows the VHDX spec procedures for header updates.
diff --git a/block/vhdx.h b/block/vhdx.h
index 154c55a..23028af 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -394,4 +394,12 @@ static inline void cpu_to_leguids(MSGUID *guid)
     cpu_to_le16s(&guid->data3);
 }
 
+void vhdx_header_le_import(VHDXHeader *h);
+void vhdx_header_le_export(VHDXHeader *orig_h, VHDXHeader *new_h);
+void vhdx_log_desc_le_import(VHDXLogDescriptor *d);
+void vhdx_log_desc_le_export(VHDXLogDescriptor *d);
+void vhdx_log_data_le_export(VHDXLogDataSector *d);
+void vhdx_log_entry_hdr_le_import(VHDXLogEntryHeader *hdr);
+void vhdx_log_entry_hdr_le_export(VHDXLogEntryHeader *hdr);
+
 #endif
commit 625565d27e8d7c7f7238ccd118a2cd49c1c52963
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:41 2013 -0400

    block: vhdx - log support struct and defines
    
    This adds some magic number defines, and internal structure definitions
    for VHDX log replay support.  The struct VHDXLogEntries does not reflect
    an on-disk data structure, and thus does not need to be packed.
    
    Some minor code style fixes are applied as well.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.h b/block/vhdx.h
index 2f7461d..154c55a 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -30,12 +30,12 @@
  * 0.........64KB...........128KB........192KB..........256KB................1MB
  */
 
-#define VHDX_HEADER_BLOCK_SIZE      (64*1024)
+#define VHDX_HEADER_BLOCK_SIZE      (64 * 1024)
 
 #define VHDX_FILE_ID_OFFSET         0
-#define VHDX_HEADER1_OFFSET         (VHDX_HEADER_BLOCK_SIZE*1)
-#define VHDX_HEADER2_OFFSET         (VHDX_HEADER_BLOCK_SIZE*2)
-#define VHDX_REGION_TABLE_OFFSET    (VHDX_HEADER_BLOCK_SIZE*3)
+#define VHDX_HEADER1_OFFSET         (VHDX_HEADER_BLOCK_SIZE * 1)
+#define VHDX_HEADER2_OFFSET         (VHDX_HEADER_BLOCK_SIZE * 2)
+#define VHDX_REGION_TABLE_OFFSET    (VHDX_HEADER_BLOCK_SIZE * 3)
 
 
 /*
@@ -77,10 +77,10 @@ typedef struct QEMU_PACKED MSGUID {
 #define guid_eq(a, b) \
     (memcmp(&(a), &(b), sizeof(MSGUID)) == 0)
 
-#define VHDX_HEADER_SIZE (4*1024)   /* although the vhdx_header struct in disk
-                                       is only 582 bytes, for purposes of crc
-                                       the header is the first 4KB of the 64KB
-                                       block */
+#define VHDX_HEADER_SIZE (4 * 1024)   /* although the vhdx_header struct in disk
+                                         is only 582 bytes, for purposes of crc
+                                         the header is the first 4KB of the 64KB
+                                         block */
 
 /* The full header is 4KB, although the actual header data is much smaller.
  * But for the checksum calculation, it is over the entire 4KB structure,
@@ -92,7 +92,7 @@ typedef struct QEMU_PACKED VHDXHeader {
                                            VHDX file has 2 of these headers,
                                            and only the header with the highest
                                            sequence number is valid */
-    MSGUID      file_write_guid;       /* 128 bit unique identifier. Must be
+    MSGUID      file_write_guid;        /* 128 bit unique identifier. Must be
                                            updated to new, unique value before
                                            the first modification is made to
                                            file */
@@ -151,7 +151,10 @@ typedef struct QEMU_PACKED VHDXRegionTableEntry {
 
 
 /* ---- LOG ENTRY STRUCTURES ---- */
+#define VHDX_LOG_MIN_SIZE (1024 * 1024)
+#define VHDX_LOG_SECTOR_SIZE 4096
 #define VHDX_LOG_HDR_SIZE 64
+#define VHDX_LOG_SIGNATURE 0x65676f6c
 typedef struct QEMU_PACKED VHDXLogEntryHeader {
     uint32_t    signature;              /* "loge" in ASCII */
     uint32_t    checksum;               /* CRC-32C hash of the 64KB table */
@@ -174,7 +177,8 @@ typedef struct QEMU_PACKED VHDXLogEntryHeader {
 } VHDXLogEntryHeader;
 
 #define VHDX_LOG_DESC_SIZE 32
-
+#define VHDX_LOG_DESC_SIGNATURE 0x63736564
+#define VHDX_LOG_ZERO_SIGNATURE 0x6f72657a
 typedef struct QEMU_PACKED VHDXLogDescriptor {
     uint32_t    signature;              /* "zero" or "desc" in ASCII */
     union  {
@@ -194,6 +198,7 @@ typedef struct QEMU_PACKED VHDXLogDescriptor {
                                            vhdx_log_entry_header */
 } VHDXLogDescriptor;
 
+#define VHDX_LOG_DATA_SIGNATURE 0x61746164
 typedef struct QEMU_PACKED VHDXLogDataSector {
     uint32_t    data_signature;         /* "data" in ASCII */
     uint32_t    sequence_high;          /* 4 MSB of 8 byte sequence_number */
@@ -219,12 +224,12 @@ typedef struct QEMU_PACKED VHDXLogDataSector {
 #define SB_BLOCK_PRESENT        6
 
 /* per the spec */
-#define VHDX_MAX_SECTORS_PER_BLOCK  (1<<23)
+#define VHDX_MAX_SECTORS_PER_BLOCK  (1 << 23)
 
 /* upper 44 bits are the file offset in 1MB units lower 3 bits are the state
    other bits are reserved */
 #define VHDX_BAT_STATE_BIT_MASK 0x07
-#define VHDX_BAT_FILE_OFF_BITS (64-44)
+#define VHDX_BAT_FILE_OFF_BITS (64 - 44)
 typedef uint64_t VHDXBatEntry;
 
 /* ---- METADATA REGION STRUCTURES ---- */
@@ -252,8 +257,8 @@ typedef struct QEMU_PACKED VHDXMetadataTableEntry {
                                            metadata region */
                                         /* note: if length = 0, so is offset */
     uint32_t    length;                 /* length of metadata. <= 1MB. */
-    uint32_t    data_bits;      /* least-significant 3 bits are flags, the
-                                   rest are reserved (see above) */
+    uint32_t    data_bits;              /* least-significant 3 bits are flags,
+                                           the rest are reserved (see above) */
     uint32_t    reserved2;
 } VHDXMetadataTableEntry;
 
@@ -265,8 +270,8 @@ typedef struct QEMU_PACKED VHDXMetadataTableEntry {
 typedef struct QEMU_PACKED VHDXFileParameters {
     uint32_t    block_size;             /* size of each payload block, always
                                            power of 2, <= 256MB and >= 1MB. */
-    uint32_t data_bits;     /* least-significant 2 bits are flags, the rest
-                               are reserved (see above) */
+    uint32_t data_bits;                 /* least-significant 2 bits are flags,
+                                           the rest are reserved (see above) */
 } VHDXFileParameters;
 
 typedef struct QEMU_PACKED VHDXVirtualDiskSize {
@@ -318,6 +323,13 @@ typedef struct VHDXMetadataEntries {
     uint16_t present;
 } VHDXMetadataEntries;
 
+typedef struct VHDXLogEntries {
+    uint64_t offset;
+    uint64_t length;
+    uint32_t head;
+    uint32_t tail;
+} VHDXLogEntries;
+
 typedef struct BDRVVHDXState {
     CoMutex lock;
 
@@ -351,6 +363,8 @@ typedef struct BDRVVHDXState {
 
     MSGUID session_guid;
 
+    VHDXLogEntries log;
+
     VHDXParentLocatorHeader parent_header;
     VHDXParentLocatorEntry *parent_entries;
 
commit 28541d46280733b9afe7b106a3a6665275a45e5f
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:40 2013 -0400

    block: vhdx code movement - VHDXMetadataEntries and BDRVVHDXState to header.
    
    In preparation for VHDX log support, move these structures to the
    header.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 7b94c42..2c921cf 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -105,16 +105,6 @@ static const MSGUID parent_vhdx_guid = { .data1 = 0xb04aefb7,
      META_PAGE_83_PRESENT | META_LOGICAL_SECTOR_SIZE_PRESENT | \
      META_PHYS_SECTOR_SIZE_PRESENT)
 
-typedef struct VHDXMetadataEntries {
-    VHDXMetadataTableEntry file_parameters_entry;
-    VHDXMetadataTableEntry virtual_disk_size_entry;
-    VHDXMetadataTableEntry page83_data_entry;
-    VHDXMetadataTableEntry logical_sector_size_entry;
-    VHDXMetadataTableEntry phys_sector_size_entry;
-    VHDXMetadataTableEntry parent_locator_entry;
-    uint16_t present;
-} VHDXMetadataEntries;
-
 
 typedef struct VHDXSectorInfo {
     uint32_t bat_idx;       /* BAT entry index */
@@ -125,48 +115,6 @@ typedef struct VHDXSectorInfo {
     uint64_t block_offset;  /* block offset, in bytes */
 } VHDXSectorInfo;
 
-
-
-typedef struct BDRVVHDXState {
-    CoMutex lock;
-
-    int curr_header;
-    VHDXHeader *headers[2];
-
-    VHDXRegionTableHeader rt;
-    VHDXRegionTableEntry bat_rt;         /* region table for the BAT */
-    VHDXRegionTableEntry metadata_rt;    /* region table for the metadata */
-
-    VHDXMetadataTableHeader metadata_hdr;
-    VHDXMetadataEntries metadata_entries;
-
-    VHDXFileParameters params;
-    uint32_t block_size;
-    uint32_t block_size_bits;
-    uint32_t sectors_per_block;
-    uint32_t sectors_per_block_bits;
-
-    uint64_t virtual_disk_size;
-    uint32_t logical_sector_size;
-    uint32_t physical_sector_size;
-
-    uint64_t chunk_ratio;
-    uint32_t chunk_ratio_bits;
-    uint32_t logical_sector_size_bits;
-
-    uint32_t bat_entries;
-    VHDXBatEntry *bat;
-    uint64_t bat_offset;
-
-    MSGUID session_guid;
-
-
-    VHDXParentLocatorHeader parent_header;
-    VHDXParentLocatorEntry *parent_entries;
-
-    Error *migration_blocker;
-} BDRVVHDXState;
-
 /* Calculates new checksum.
  *
  * Zero is substituted during crc calculation for the original crc field
diff --git a/block/vhdx.h b/block/vhdx.h
index 403f766..2f7461d 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -308,6 +308,54 @@ typedef struct QEMU_PACKED VHDXParentLocatorEntry {
 
 /* ----- END VHDX SPECIFICATION STRUCTURES ---- */
 
+typedef struct VHDXMetadataEntries {
+    VHDXMetadataTableEntry file_parameters_entry;
+    VHDXMetadataTableEntry virtual_disk_size_entry;
+    VHDXMetadataTableEntry page83_data_entry;
+    VHDXMetadataTableEntry logical_sector_size_entry;
+    VHDXMetadataTableEntry phys_sector_size_entry;
+    VHDXMetadataTableEntry parent_locator_entry;
+    uint16_t present;
+} VHDXMetadataEntries;
+
+typedef struct BDRVVHDXState {
+    CoMutex lock;
+
+    int curr_header;
+    VHDXHeader *headers[2];
+
+    VHDXRegionTableHeader rt;
+    VHDXRegionTableEntry bat_rt;         /* region table for the BAT */
+    VHDXRegionTableEntry metadata_rt;    /* region table for the metadata */
+
+    VHDXMetadataTableHeader metadata_hdr;
+    VHDXMetadataEntries metadata_entries;
+
+    VHDXFileParameters params;
+    uint32_t block_size;
+    uint32_t block_size_bits;
+    uint32_t sectors_per_block;
+    uint32_t sectors_per_block_bits;
+
+    uint64_t virtual_disk_size;
+    uint32_t logical_sector_size;
+    uint32_t physical_sector_size;
+
+    uint64_t chunk_ratio;
+    uint32_t chunk_ratio_bits;
+    uint32_t logical_sector_size_bits;
+
+    uint32_t bat_entries;
+    VHDXBatEntry *bat;
+    uint64_t bat_offset;
+
+    MSGUID session_guid;
+
+    VHDXParentLocatorHeader parent_header;
+    VHDXParentLocatorEntry *parent_entries;
+
+    Error *migration_blocker;
+} BDRVVHDXState;
 
 void vhdx_guid_generate(MSGUID *guid);
 
commit 4f18b7824ab5eda9fe051f5b24e90e5f34d08a23
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:39 2013 -0400

    block: vhdx - add header update capability.
    
    This adds the ability to update the headers in a VHDX image, including
    generating a new MS-compatible GUID.
    
    As VHDX depends on uuid.h, VHDX is now a configurable build option.  If
    VHDX support is enabled, that will also enable uuid as well.  The
    default is to have VHDX enabled.
    
    To enable/disable VHDX:  --enable-vhdx, --disable-vhdx
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/Makefile.objs b/block/Makefile.objs
index 3bb85b5..e7214de 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -2,7 +2,7 @@ block-obj-y += raw_bsd.o cow.o qcow.o vdi.o vmdk.o cloop.o dmg.o bochs.o vpc.o v
 block-obj-y += qcow2.o qcow2-refcount.o qcow2-cluster.o qcow2-snapshot.o qcow2-cache.o
 block-obj-y += qed.o qed-gencb.o qed-l2-cache.o qed-table.o qed-cluster.o
 block-obj-y += qed-check.o
-block-obj-y += vhdx.o
+block-obj-$(CONFIG_VHDX) += vhdx.o
 block-obj-y += parallels.o blkdebug.o blkverify.o
 block-obj-y += snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += raw-win32.o win32-aio.o
diff --git a/block/vhdx.c b/block/vhdx.c
index b497c27..7b94c42 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -22,6 +22,7 @@
 #include "block/vhdx.h"
 #include "migration/migration.h"
 
+#include <uuid/uuid.h>
 
 /* Several metadata and region table data entries are identified by
  * guids in  a MS-specific GUID format. */
@@ -157,12 +158,41 @@ typedef struct BDRVVHDXState {
     VHDXBatEntry *bat;
     uint64_t bat_offset;
 
+    MSGUID session_guid;
+
+
     VHDXParentLocatorHeader parent_header;
     VHDXParentLocatorEntry *parent_entries;
 
     Error *migration_blocker;
 } BDRVVHDXState;
 
+/* Calculates new checksum.
+ *
+ * Zero is substituted during crc calculation for the original crc field
+ * crc_offset: byte offset in buf of the buffer crc
+ * buf: buffer pointer
+ * size: size of buffer (must be > crc_offset+4)
+ *
+ * Note: The resulting checksum is in the CPU endianness, not necessarily
+ *       in the file format endianness (LE).  Any header export to disk should
+ *       make sure that vhdx_header_le_export() is used to convert to the
+ *       correct endianness
+ */
+uint32_t vhdx_update_checksum(uint8_t *buf, size_t size, int crc_offset)
+{
+    uint32_t crc;
+
+    assert(buf != NULL);
+    assert(size > (crc_offset + sizeof(crc)));
+
+    memset(buf + crc_offset, 0, sizeof(crc));
+    crc =  crc32c(0xffffffff, buf, size);
+    memcpy(buf + crc_offset, &crc, sizeof(crc));
+
+    return crc;
+}
+
 uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
                             int crc_offset)
 {
@@ -214,6 +244,19 @@ bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset)
 
 
 /*
+ * This generates a UUID that is compliant with the MS GUIDs used
+ * in the VHDX spec (and elsewhere).
+ */
+void vhdx_guid_generate(MSGUID *guid)
+{
+    uuid_t uuid;
+    assert(guid != NULL);
+
+    uuid_generate(uuid);
+    memcpy(guid, uuid, sizeof(MSGUID));
+}
+
+/*
  * Per the MS VHDX Specification, for every VHDX file:
  *      - The header section is fixed size - 1 MB
  *      - The header section is always the first "object"
@@ -251,6 +294,113 @@ static void vhdx_header_le_import(VHDXHeader *h)
     le64_to_cpus(&h->log_offset);
 }
 
+/* All VHDX structures on disk are little endian */
+static void vhdx_header_le_export(VHDXHeader *orig_h, VHDXHeader *new_h)
+{
+    assert(orig_h != NULL);
+    assert(new_h != NULL);
+
+    new_h->signature       = cpu_to_le32(orig_h->signature);
+    new_h->checksum        = cpu_to_le32(orig_h->checksum);
+    new_h->sequence_number = cpu_to_le64(orig_h->sequence_number);
+
+    new_h->file_write_guid = orig_h->file_write_guid;
+    new_h->data_write_guid = orig_h->data_write_guid;
+    new_h->log_guid        = orig_h->log_guid;
+
+    cpu_to_leguids(&new_h->file_write_guid);
+    cpu_to_leguids(&new_h->data_write_guid);
+    cpu_to_leguids(&new_h->log_guid);
+
+    new_h->log_version     = cpu_to_le16(orig_h->log_version);
+    new_h->version         = cpu_to_le16(orig_h->version);
+    new_h->log_length      = cpu_to_le32(orig_h->log_length);
+    new_h->log_offset      = cpu_to_le64(orig_h->log_offset);
+}
+
+/* Update the VHDX headers
+ *
+ * This follows the VHDX spec procedures for header updates.
+ *
+ *  - non-current header is updated with largest sequence number
+ */
+static int vhdx_update_header(BlockDriverState *bs, BDRVVHDXState *s,
+                              bool generate_data_write_guid)
+{
+    int ret = 0;
+    int hdr_idx = 0;
+    uint64_t header_offset = VHDX_HEADER1_OFFSET;
+
+    VHDXHeader *active_header;
+    VHDXHeader *inactive_header;
+    VHDXHeader header_le;
+    uint8_t *buffer;
+
+    /* operate on the non-current header */
+    if (s->curr_header == 0) {
+        hdr_idx = 1;
+        header_offset = VHDX_HEADER2_OFFSET;
+    }
+
+    active_header   = s->headers[s->curr_header];
+    inactive_header = s->headers[hdr_idx];
+
+    inactive_header->sequence_number = active_header->sequence_number + 1;
+
+    /* a new file guid must be generated before any file write, including
+     * headers */
+    inactive_header->file_write_guid = s->session_guid;
+
+    /* a new data guid only needs to be generated before any guest-visible
+     * writes (i.e. something observable via virtual disk read) */
+    if (generate_data_write_guid) {
+        vhdx_guid_generate(&inactive_header->data_write_guid);
+    }
+
+    /* the header checksum is not over just the packed size of VHDXHeader,
+     * but rather over the entire 'reserved' range for the header, which is
+     * 4KB (VHDX_HEADER_SIZE). */
+
+    buffer = qemu_blockalign(bs, VHDX_HEADER_SIZE);
+    /* we can't assume the extra reserved bytes are 0 */
+    ret = bdrv_pread(bs->file, header_offset, buffer, VHDX_HEADER_SIZE);
+    if (ret < 0) {
+        goto exit;
+    }
+    /* overwrite the actual VHDXHeader portion */
+    memcpy(buffer, inactive_header, sizeof(VHDXHeader));
+    inactive_header->checksum =
+                        vhdx_update_checksum(buffer, VHDX_HEADER_SIZE,
+                                             offsetof(VHDXHeader, checksum));
+    vhdx_header_le_export(inactive_header, &header_le);
+    ret = bdrv_pwrite_sync(bs->file, header_offset, &header_le,
+                           sizeof(VHDXHeader));
+    if (ret < 0) {
+        goto exit;
+    }
+    s->curr_header = hdr_idx;
+
+exit:
+    qemu_vfree(buffer);
+    return ret;
+}
+
+/*
+ * The VHDX spec calls for header updates to be performed twice, so that both
+ * the current and non-current header have valid info
+ */
+static int vhdx_update_headers(BlockDriverState *bs, BDRVVHDXState *s,
+                               bool generate_data_write_guid)
+{
+    int ret;
+
+    ret = vhdx_update_header(bs, s, generate_data_write_guid);
+    if (ret < 0) {
+        return ret;
+    }
+    ret = vhdx_update_header(bs, s, generate_data_write_guid);
+    return ret;
+}
 
 /* opens the specified header block from the VHDX file header section */
 static int vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s)
@@ -742,6 +892,11 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 
+    /* This is used for any header updates, for the file_write_guid.
+     * The spec dictates that a new value should be used for the first
+     * header update */
+    vhdx_guid_generate(&s->session_guid);
+
     ret = vhdx_parse_header(bs, s);
     if (ret) {
         goto fail;
@@ -804,8 +959,10 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     if (flags & BDRV_O_RDWR) {
-        ret = -ENOTSUP;
-        goto fail;
+        ret = vhdx_update_headers(bs, s, false);
+        if (ret < 0) {
+            goto fail;
+        }
     }
 
     /* TODO: differencing files, write */
diff --git a/block/vhdx.h b/block/vhdx.h
index 9eb6b97..403f766 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -67,7 +67,7 @@ typedef struct VHDXFileIdentifier {
  * Microsoft is not just 16 bytes though - it is a structure that is defined,
  * so we need to follow it here so that endianness does not trip us up */
 
-typedef struct MSGUID {
+typedef struct QEMU_PACKED MSGUID {
     uint32_t  data1;
     uint16_t  data2;
     uint16_t  data3;
@@ -309,17 +309,27 @@ typedef struct QEMU_PACKED VHDXParentLocatorEntry {
 /* ----- END VHDX SPECIFICATION STRUCTURES ---- */
 
 
+void vhdx_guid_generate(MSGUID *guid);
+
+uint32_t vhdx_update_checksum(uint8_t *buf, size_t size, int crc_offset);
 uint32_t vhdx_checksum_calc(uint32_t crc, uint8_t *buf, size_t size,
                             int crc_offset);
 
 bool vhdx_checksum_is_valid(uint8_t *buf, size_t size, int crc_offset);
 
 
-static void leguid_to_cpus(MSGUID *guid)
+static inline void leguid_to_cpus(MSGUID *guid)
 {
     le32_to_cpus(&guid->data1);
     le16_to_cpus(&guid->data2);
     le16_to_cpus(&guid->data3);
 }
 
+static inline void cpu_to_leguids(MSGUID *guid)
+{
+    cpu_to_le32s(&guid->data1);
+    cpu_to_le16s(&guid->data2);
+    cpu_to_le16s(&guid->data3);
+}
+
 #endif
diff --git a/configure b/configure
index 9addff1..8e7f356 100755
--- a/configure
+++ b/configure
@@ -247,6 +247,7 @@ gtk=""
 gtkabi="2.0"
 tpm="no"
 libssh2=""
+vhdx=""
 
 # parse CC options first
 for opt do
@@ -972,6 +973,10 @@ for opt do
   ;;
   --enable-libssh2) libssh2="yes"
   ;;
+  --enable-vhdx) vhdx="yes"
+  ;;
+  --disable-vhdx) vhdx="no"
+  ;;
   *) echo "ERROR: unknown option $opt"; show_help="yes"
   ;;
   esac
@@ -1204,6 +1209,8 @@ echo "  --gcov=GCOV              use specified gcov [$gcov_tool]"
 echo "  --enable-tpm             enable TPM support"
 echo "  --disable-libssh2        disable ssh block device support"
 echo "  --enable-libssh2         enable ssh block device support"
+echo "  --disable-vhdx           disables support for the Microsoft VHDX image format"
+echo "  --enable-vhdx            enable support for the Microsoft VHDX image format"
 echo ""
 echo "NOTE: The object files are built at the place where configure is launched"
 exit 1
@@ -2004,6 +2011,18 @@ EOF
   fi
 fi
 
+if test "$vhdx" = "yes" ; then
+    if test "$uuid" = "no" ; then
+        error_exit "uuid required for VHDX support"
+    fi
+elif test "$vhdx" != "no" ; then
+    if test "$uuid" = "yes" ; then
+        vhdx=yes
+    else
+        vhdx=no
+    fi
+fi
+
 ##########################################
 # xfsctl() probe, used for raw-posix
 if test "$xfs" != "no" ; then
@@ -3747,6 +3766,7 @@ echo "TPM support       $tpm"
 echo "libssh2 support   $libssh2"
 echo "TPM passthrough   $tpm_passthrough"
 echo "QOM debugging     $qom_cast_debug"
+echo "vhdx              $vhdx"
 
 if test "$sdl_too_old" = "yes"; then
 echo "-> Your SDL version is too old - please upgrade to have SDL support"
@@ -4141,6 +4161,10 @@ if test "$virtio_blk_data_plane" = "yes" ; then
   echo 'CONFIG_VIRTIO_BLK_DATA_PLANE=$(CONFIG_VIRTIO)' >> $config_host_mak
 fi
 
+if test "$vhdx" = "yes" ; then
+  echo "CONFIG_VHDX=y" >> $config_host_mak
+fi
+
 # USB host support
 if test "$libusb" = "yes"; then
   echo "HOST_USB=libusb legacy" >> $config_host_mak
commit 6e9d290bf62406098ca3d7bf3796463681ed3c39
Author: Jeff Cody <jcody at redhat.com>
Date:   Wed Oct 30 10:44:38 2013 -0400

    block: vhdx - minor comments and typo correction.
    
    Just a couple of minor comments to help note where allocated
    buffers are freed, and a typo fix.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vhdx.c b/block/vhdx.c
index 6cb0412..b497c27 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -6,9 +6,9 @@
  * Authors:
  *  Jeff Cody <jcody at redhat.com>
  *
- *  This is based on the "VHDX Format Specification v0.95", published 4/12/2012
+ *  This is based on the "VHDX Format Specification v1.00", published 8/25/2012
  *  by Microsoft:
- *      https://www.microsoft.com/en-us/download/details.aspx?id=29681
+ *      https://www.microsoft.com/en-us/download/details.aspx?id=34750
  *
  * This work is licensed under the terms of the GNU LGPL, version 2 or later.
  * See the COPYING.LIB file in the top-level directory.
@@ -264,6 +264,7 @@ static int vhdx_parse_header(BlockDriverState *bs, BDRVVHDXState *s)
     uint64_t h2_seq = 0;
     uint8_t *buffer;
 
+    /* header1 & header2 are freed in vhdx_close() */
     header1 = qemu_blockalign(bs, sizeof(VHDXHeader));
     header2 = qemu_blockalign(bs, sizeof(VHDXHeader));
 
@@ -790,6 +791,7 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 
+    /* s->bat is freed in vhdx_close() */
     s->bat = qemu_blockalign(bs, s->bat_rt.length);
 
     ret = bdrv_pread(bs->file, s->bat_offset, s->bat, s->bat_rt.length);
diff --git a/block/vhdx.h b/block/vhdx.h
index fb687ed..9eb6b97 100644
--- a/block/vhdx.h
+++ b/block/vhdx.h
@@ -6,9 +6,9 @@
  * Authors:
  *  Jeff Cody <jcody at redhat.com>
  *
- *  This is based on the "VHDX Format Specification v0.95", published 4/12/2012
+ *  This is based on the "VHDX Format Specification v1.00", published 8/25/2012
  *  by Microsoft:
- *      https://www.microsoft.com/en-us/download/details.aspx?id=29681
+ *      https://www.microsoft.com/en-us/download/details.aspx?id=34750
  *
  * This work is licensed under the terms of the GNU LGPL, version 2 or later.
  * See the COPYING.LIB file in the top-level directory.
@@ -116,7 +116,7 @@ typedef struct QEMU_PACKED VHDXHeader {
                                            valid. */
     uint16_t    log_version;            /* version of the log format. Mustn't be
                                            zero, unless log_guid is also zero */
-    uint16_t    version;                /* version of th evhdx file.  Currently,
+    uint16_t    version;                /* version of the vhdx file.  Currently,
                                            only supported version is "1" */
     uint32_t    log_length;             /* length of the log.  Must be multiple
                                            of 1MB */
commit 0173e7bbf3c892abd4e35507ddeb2f23c1a44829
Author: Peter Lieven <pl at kamp.de>
Date:   Mon Oct 21 16:00:18 2013 +0200

    block/vpc: fix virtual size for images created with disk2vhd
    
    Signed-off-by: Peter Lieven <pl at kamp.de>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/vpc.c b/block/vpc.c
index 627d11c..577cc45 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -211,6 +211,15 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     bs->total_sectors = (int64_t)
         be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl;
 
+    /* images created with disk2vhd report a far higher virtual size
+     * than expected with the cyls * heads * sectors_per_cyl formula.
+     * use the footer->size instead if the image was created with
+     * disk2vhd.
+     */
+    if (!strncmp(footer->creator_app, "d2v", 4)) {
+        bs->total_sectors = be64_to_cpu(footer->size) / BDRV_SECTOR_SIZE;
+    }
+
     /* Allow a maximum disk size of approximately 2 TB */
     if (bs->total_sectors >= 65535LL * 255 * 255) {
         ret = -EFBIG;
commit 17826bc159893300a05551d8a830275c5ecf0092
Author: Max Reitz <mreitz at redhat.com>
Date:   Tue Nov 5 20:03:33 2013 +0100

    block: Save errno before error_setg_errno
    
    error_setg_errno() may overwrite errno; therefore, its value should be
    read before calling that function and not afterwards.
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block.c b/block.c
index 58efb5b..0e96a22 100644
--- a/block.c
+++ b/block.c
@@ -1084,8 +1084,8 @@ int bdrv_open(BlockDriverState *bs, const char *filename, QDict *options,
             snprintf(backing_filename, sizeof(backing_filename),
                      "%s", filename);
         } else if (!realpath(filename, backing_filename)) {
-            error_setg_errno(errp, errno, "Could not resolve path '%s'", filename);
             ret = -errno;
+            error_setg_errno(errp, errno, "Could not resolve path '%s'", filename);
             goto fail;
         }
 
commit 43cd209803d6cffb1e1a028c9ff2fd0ff4fce954
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Oct 30 14:54:35 2013 +0100

    qdev-monitor-test: add device_add leak test cases
    
    Ensure that the device_add error code path deletes device objects.
    Failure to do so not only leaks the objects but can also keep other
    objects (like drive or netdev) alive due to qdev properties holding
    references.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/tests/Makefile b/tests/Makefile
index 973f497..379cdd9 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -69,6 +69,7 @@ check-qtest-i386-y += tests/i440fx-test$(EXESUF)
 check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
 check-qtest-i386-y += tests/qom-test$(EXESUF)
 check-qtest-i386-y += tests/blockdev-test$(EXESUF)
+check-qtest-i386-y += tests/qdev-monitor-test$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 gcov-files-i386-y += i386-softmmu/hw/mc146818rtc.c
 gcov-files-x86_64-y = $(subst i386-softmmu/,x86_64-softmmu/,$(gcov-files-i386-y))
@@ -202,6 +203,7 @@ tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
 tests/fw_cfg-test$(EXESUF): tests/fw_cfg-test.o $(libqos-pc-obj-y)
 tests/qom-test$(EXESUF): tests/qom-test.o
 tests/blockdev-test$(EXESUF): tests/blockdev-test.o $(libqos-pc-obj-y)
+tests/qdev-monitor-test$(EXESUF): tests/qdev-monitor-test.o $(libqos-pc-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
 
 # QTest rules
diff --git a/tests/qdev-monitor-test.c b/tests/qdev-monitor-test.c
new file mode 100644
index 0000000..33a8ea4
--- /dev/null
+++ b/tests/qdev-monitor-test.c
@@ -0,0 +1,81 @@
+/*
+ * qdev-monitor.c test cases
+ *
+ * Copyright (C) 2013 Red Hat Inc.
+ *
+ * Authors:
+ *  Stefan Hajnoczi <stefanha at redhat.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#include <string.h>
+#include <glib.h>
+#include "libqtest.h"
+#include "qapi/qmp/qjson.h"
+
+static void test_device_add(void)
+{
+    QDict *response;
+    QDict *error;
+
+    qtest_start("-drive if=none,id=drive0");
+
+    /* Make device_add fail.  If this leaks the virtio-blk-pci device then a
+     * reference to drive0 will also be held (via qdev properties).
+     */
+    response = qmp("{\"execute\": \"device_add\","
+                   " \"arguments\": {"
+                   "   \"driver\": \"virtio-blk-pci\","
+                   "   \"drive\": \"drive0\""
+                   "}}");
+    g_assert(response);
+    error = qdict_get_qdict(response, "error");
+    g_assert(!strcmp(qdict_get_try_str(error, "class") ?: "",
+                     "GenericError"));
+    g_assert(!strcmp(qdict_get_try_str(error, "desc") ?: "",
+                     "Device initialization failed."));
+    QDECREF(response);
+
+    /* Delete the drive */
+    response = qmp("{\"execute\": \"human-monitor-command\","
+                   " \"arguments\": {"
+                   "   \"command-line\": \"drive_del drive0\""
+                   "}}");
+    g_assert(response);
+    g_assert(!strcmp(qdict_get_try_str(response, "return") ?: "(null)", ""));
+    QDECREF(response);
+
+    /* Try to re-add the drive.  This fails with duplicate IDs if a leaked
+     * virtio-blk-pci exists that holds a reference to the old drive0.
+     */
+    response = qmp("{\"execute\": \"human-monitor-command\","
+                   " \"arguments\": {"
+                   "   \"command-line\": \"drive_add pci-addr=auto if=none,id=drive0\""
+                   "}}");
+    g_assert(response);
+    g_assert(!strcmp(qdict_get_try_str(response, "return") ?: "",
+                     "OK\r\n"));
+    QDECREF(response);
+
+    qtest_end();
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+
+    /* Check architecture */
+    if (strcmp(arch, "i386") && strcmp(arch, "x86_64")) {
+        g_test_message("Skipping test for non-x86\n");
+        return 0;
+    }
+
+    /* Run the tests */
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/qmp/device_add", test_device_add);
+
+    return g_test_run();
+}
commit 7ceeedd016facf8d58e14a0d1417fa7225d71072
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Oct 30 14:54:34 2013 +0100

    blockdev-test: add test case for drive_add duplicate IDs
    
    The following should work:
    
      (qemu) drive_add if=none,id=drive0
      (qemu) drive_del drive0
      (qemu) drive_add if=none,id=drive0
    
    Previous versions of QEMU produced a duplicate ID error because
    drive_add leaked the options.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/tests/Makefile b/tests/Makefile
index f414f2c..973f497 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -68,6 +68,7 @@ check-qtest-i386-y += tests/rtc-test$(EXESUF)
 check-qtest-i386-y += tests/i440fx-test$(EXESUF)
 check-qtest-i386-y += tests/fw_cfg-test$(EXESUF)
 check-qtest-i386-y += tests/qom-test$(EXESUF)
+check-qtest-i386-y += tests/blockdev-test$(EXESUF)
 check-qtest-x86_64-y = $(check-qtest-i386-y)
 gcov-files-i386-y += i386-softmmu/hw/mc146818rtc.c
 gcov-files-x86_64-y = $(subst i386-softmmu/,x86_64-softmmu/,$(gcov-files-i386-y))
@@ -200,6 +201,7 @@ tests/tmp105-test$(EXESUF): tests/tmp105-test.o $(libqos-omap-obj-y)
 tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
 tests/fw_cfg-test$(EXESUF): tests/fw_cfg-test.o $(libqos-pc-obj-y)
 tests/qom-test$(EXESUF): tests/qom-test.o
+tests/blockdev-test$(EXESUF): tests/blockdev-test.o $(libqos-pc-obj-y)
 tests/qemu-iotests/socket_scm_helper$(EXESUF): tests/qemu-iotests/socket_scm_helper.o
 
 # QTest rules
diff --git a/tests/blockdev-test.c b/tests/blockdev-test.c
new file mode 100644
index 0000000..c940e00
--- /dev/null
+++ b/tests/blockdev-test.c
@@ -0,0 +1,59 @@
+/*
+ * blockdev.c test cases
+ *
+ * Copyright (C) 2013 Red Hat Inc.
+ *
+ * Authors:
+ *  Stefan Hajnoczi <stefanha at redhat.com>
+ *
+ * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ * See the COPYING.LIB file in the top-level directory.
+ */
+
+#include <glib.h>
+#include <string.h>
+#include "libqtest.h"
+
+static void test_drive_add_empty(void)
+{
+    QDict *response;
+    const char *response_return;
+
+    /* Start with an empty drive */
+    qtest_start("-drive if=none,id=drive0");
+
+    /* Delete the drive */
+    response = qmp("{\"execute\": \"human-monitor-command\","
+                   " \"arguments\": {"
+                   "   \"command-line\": \"drive_del drive0\""
+                   "}}");
+    g_assert(response);
+    response_return = qdict_get_try_str(response, "return");
+    g_assert(response_return);
+    g_assert(strcmp(response_return, "") == 0);
+    QDECREF(response);
+
+    /* Ensure re-adding the drive works - there should be no duplicate ID error
+     * because the old drive must be gone.
+     */
+    response = qmp("{\"execute\": \"human-monitor-command\","
+                   " \"arguments\": {"
+                   "   \"command-line\": \"drive_add 0 if=none,id=drive0\""
+                   "}}");
+    g_assert(response);
+    response_return = qdict_get_try_str(response, "return");
+    g_assert(response_return);
+    g_assert(strcmp(response_return, "OK\r\n") == 0);
+    QDECREF(response);
+
+    qtest_end();
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/qmp/drive_add_empty", test_drive_add_empty);
+
+    return g_test_run();
+}
commit 0c460dac03e7919079525d8e24ef2c4c607c219d
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Oct 30 14:54:33 2013 +0100

    libqtest: add qmp(fmt, ...) -> QDict* function
    
    Add a qtest qmp() function that returns the response object.  This
    allows test cases to verify the result or to check for error responses.
    It also allows waiting for QMP events.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/tests/libqtest.c b/tests/libqtest.c
index dc4c983..83424c3 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -30,6 +30,8 @@
 
 #include "qemu/compiler.h"
 #include "qemu/osdep.h"
+#include "qapi/qmp/json-streamer.h"
+#include "qapi/qmp/json-parser.h"
 
 #define MAX_IRQ 256
 
@@ -291,16 +293,38 @@ redo:
     return words;
 }
 
-void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap)
+typedef struct {
+    JSONMessageParser parser;
+    QDict *response;
+} QMPResponseParser;
+
+static void qmp_response(JSONMessageParser *parser, QList *tokens)
 {
-    bool has_reply = false;
-    int nesting = 0;
+    QMPResponseParser *qmp = container_of(parser, QMPResponseParser, parser);
+    QObject *obj;
+
+    obj = json_parser_parse(tokens, NULL);
+    if (!obj) {
+        fprintf(stderr, "QMP JSON response parsing failed\n");
+        exit(1);
+    }
+
+    g_assert(qobject_type(obj) == QTYPE_QDICT);
+    g_assert(!qmp->response);
+    qmp->response = (QDict *)obj;
+}
+
+QDict *qtest_qmpv(QTestState *s, const char *fmt, va_list ap)
+{
+    QMPResponseParser qmp;
 
     /* Send QMP request */
     socket_sendf(s->qmp_fd, fmt, ap);
 
     /* Receive reply */
-    while (!has_reply || nesting > 0) {
+    qmp.response = NULL;
+    json_message_parser_init(&qmp.parser, qmp_response);
+    while (!qmp.response) {
         ssize_t len;
         char c;
 
@@ -314,25 +338,39 @@ void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap)
             exit(1);
         }
 
-        switch (c) {
-        case '{':
-            nesting++;
-            has_reply = true;
-            break;
-        case '}':
-            nesting--;
-            break;
-        }
+        json_message_parser_feed(&qmp.parser, &c, 1);
     }
+    json_message_parser_destroy(&qmp.parser);
+
+    return qmp.response;
+}
+
+QDict *qtest_qmp(QTestState *s, const char *fmt, ...)
+{
+    va_list ap;
+    QDict *response;
+
+    va_start(ap, fmt);
+    response = qtest_qmpv(s, fmt, ap);
+    va_end(ap);
+    return response;
+}
+
+void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap)
+{
+    QDict *response = qtest_qmpv(s, fmt, ap);
+    QDECREF(response);
 }
 
 void qtest_qmp_discard_response(QTestState *s, const char *fmt, ...)
 {
     va_list ap;
+    QDict *response;
 
     va_start(ap, fmt);
-    qtest_qmpv_discard_response(s, fmt, ap);
+    response = qtest_qmpv(s, fmt, ap);
     va_end(ap);
+    QDECREF(response);
 }
 
 const char *qtest_get_arch(void)
diff --git a/tests/libqtest.h b/tests/libqtest.h
index 4f1b060..9deebdc 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -22,6 +22,7 @@
 #include <stdbool.h>
 #include <stdarg.h>
 #include <sys/types.h>
+#include "qapi/qmp/qdict.h"
 
 typedef struct QTestState QTestState;
 
@@ -53,6 +54,15 @@ void qtest_quit(QTestState *s);
 void qtest_qmp_discard_response(QTestState *s, const char *fmt, ...);
 
 /**
+ * qtest_qmp:
+ * @s: #QTestState instance to operate on.
+ * @fmt...: QMP message to send to qemu
+ *
+ * Sends a QMP message to QEMU and returns the response.
+ */
+QDict *qtest_qmp(QTestState *s, const char *fmt, ...);
+
+/**
  * qtest_qmpv_discard_response:
  * @s: #QTestState instance to operate on.
  * @fmt: QMP message to send to QEMU
@@ -63,6 +73,16 @@ void qtest_qmp_discard_response(QTestState *s, const char *fmt, ...);
 void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap);
 
 /**
+ * qtest_qmpv:
+ * @s: #QTestState instance to operate on.
+ * @fmt: QMP message to send to QEMU
+ * @ap: QMP message arguments
+ *
+ * Sends a QMP message to QEMU and returns the response.
+ */
+QDict *qtest_qmpv(QTestState *s, const char *fmt, va_list ap);
+
+/**
  * qtest_get_irq:
  * @s: #QTestState instance to operate on.
  * @num: Interrupt to observe.
@@ -331,6 +351,23 @@ static inline void qtest_end(void)
 }
 
 /**
+ * qmp:
+ * @fmt...: QMP message to send to qemu
+ *
+ * Sends a QMP message to QEMU and returns the response.
+ */
+static inline QDict *qmp(const char *fmt, ...)
+{
+    va_list ap;
+    QDict *response;
+
+    va_start(ap, fmt);
+    response = qtest_qmpv(global_qtest, fmt, ap);
+    va_end(ap);
+    return response;
+}
+
+/**
  * qmp_discard_response:
  * @fmt...: QMP message to send to qemu
  *
commit 0d1aa05e9eba2437fdcdfbaa846c850c986bf7c6
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Oct 30 14:54:32 2013 +0100

    libqtest: rename qmp() to qmp_discard_response()
    
    Existing qmp() callers do not expect a response object.  In order to
    implement real QMP test cases it will be necessary to inspect the
    response object.
    
    Rename qmp() to qmp_discard_response().  Later patches will introduce a
    qmp() function that returns the response object and tests that use it.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Reviewed-by: Andreas Färber <afaerber at suse.de>

diff --git a/tests/boot-order-test.c b/tests/boot-order-test.c
index 4b233d0..da158c3 100644
--- a/tests/boot-order-test.c
+++ b/tests/boot-order-test.c
@@ -41,12 +41,12 @@ static void test_a_boot_order(const char *machine,
     qtest_start(args);
     actual = read_boot_order();
     g_assert_cmphex(actual, ==, expected_boot);
-    qmp("{ 'execute': 'system_reset' }");
+    qmp_discard_response("{ 'execute': 'system_reset' }");
     /*
      * system_reset only requests reset.  We get a RESET event after
      * the actual reset completes.  Need to wait for that.
      */
-    qmp("");                    /* HACK: wait for event */
+    qmp_discard_response("");   /* HACK: wait for event */
     actual = read_boot_order();
     g_assert_cmphex(actual, ==, expected_reboot);
     qtest_quit(global_qtest);
diff --git a/tests/fdc-test.c b/tests/fdc-test.c
index fd198dc..38b5b17 100644
--- a/tests/fdc-test.c
+++ b/tests/fdc-test.c
@@ -290,10 +290,12 @@ static void test_media_insert(void)
 
     /* Insert media in drive. DSKCHK should not be reset until a step pulse
      * is sent. */
-    qmp("{'execute':'change', 'arguments':{ 'device':'floppy0', "
-        "'target': '%s' }}", test_image);
-    qmp(""); /* ignore event (FIXME open -> open transition?!) */
-    qmp(""); /* ignore event */
+    qmp_discard_response("{'execute':'change', 'arguments':{"
+                         " 'device':'floppy0', 'target': '%s' }}",
+                         test_image);
+    qmp_discard_response(""); /* ignore event
+                                 (FIXME open -> open transition?!) */
+    qmp_discard_response(""); /* ignore event */
 
     dir = inb(FLOPPY_BASE + reg_dir);
     assert_bit_set(dir, DSKCHG);
@@ -322,8 +324,9 @@ static void test_media_change(void)
 
     /* Eject the floppy and check that DSKCHG is set. Reading it out doesn't
      * reset the bit. */
-    qmp("{'execute':'eject', 'arguments':{ 'device':'floppy0' }}");
-    qmp(""); /* ignore event */
+    qmp_discard_response("{'execute':'eject', 'arguments':{"
+                         " 'device':'floppy0' }}");
+    qmp_discard_response(""); /* ignore event */
 
     dir = inb(FLOPPY_BASE + reg_dir);
     assert_bit_set(dir, DSKCHG);
diff --git a/tests/ide-test.c b/tests/ide-test.c
index bc824a8..d5cec5a 100644
--- a/tests/ide-test.c
+++ b/tests/ide-test.c
@@ -460,8 +460,9 @@ static void test_flush(void)
         tmp_path);
 
     /* Delay the completion of the flush request until we explicitly do it */
-    qmp("{'execute':'human-monitor-command', 'arguments': { "
-        "'command-line': 'qemu-io ide0-hd0 \"break flush_to_os A\"'} }");
+    qmp_discard_response("{'execute':'human-monitor-command', 'arguments': {"
+                         " 'command-line':"
+                         " 'qemu-io ide0-hd0 \"break flush_to_os A\"'} }");
 
     /* FLUSH CACHE command on device 0*/
     outb(IDE_BASE + reg_device, 0);
@@ -473,8 +474,9 @@ static void test_flush(void)
     assert_bit_clear(data, DF | ERR | DRQ);
 
     /* Complete the command */
-    qmp("{'execute':'human-monitor-command', 'arguments': { "
-        "'command-line': 'qemu-io ide0-hd0 \"resume A\"'} }");
+    qmp_discard_response("{'execute':'human-monitor-command', 'arguments': {"
+                         " 'command-line':"
+                         " 'qemu-io ide0-hd0 \"resume A\"'} }");
 
     /* Check registers */
     data = inb(IDE_BASE + reg_device);
diff --git a/tests/libqtest.c b/tests/libqtest.c
index bb82069..dc4c983 100644
--- a/tests/libqtest.c
+++ b/tests/libqtest.c
@@ -151,8 +151,8 @@ QTestState *qtest_init(const char *extra_args)
     }
 
     /* Read the QMP greeting and then do the handshake */
-    qtest_qmp(s, "");
-    qtest_qmp(s, "{ 'execute': 'qmp_capabilities' }");
+    qtest_qmp_discard_response(s, "");
+    qtest_qmp_discard_response(s, "{ 'execute': 'qmp_capabilities' }");
 
     if (getenv("QTEST_STOP")) {
         kill(qtest_qemu_pid(s), SIGSTOP);
@@ -291,7 +291,7 @@ redo:
     return words;
 }
 
-void qtest_qmpv(QTestState *s, const char *fmt, va_list ap)
+void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap)
 {
     bool has_reply = false;
     int nesting = 0;
@@ -326,12 +326,12 @@ void qtest_qmpv(QTestState *s, const char *fmt, va_list ap)
     }
 }
 
-void qtest_qmp(QTestState *s, const char *fmt, ...)
+void qtest_qmp_discard_response(QTestState *s, const char *fmt, ...)
 {
     va_list ap;
 
     va_start(ap, fmt);
-    qtest_qmpv(s, fmt, ap);
+    qtest_qmpv_discard_response(s, fmt, ap);
     va_end(ap);
 }
 
diff --git a/tests/libqtest.h b/tests/libqtest.h
index a6e99bd..4f1b060 100644
--- a/tests/libqtest.h
+++ b/tests/libqtest.h
@@ -44,23 +44,23 @@ QTestState *qtest_init(const char *extra_args);
 void qtest_quit(QTestState *s);
 
 /**
- * qtest_qmp:
+ * qtest_qmp_discard_response:
  * @s: #QTestState instance to operate on.
  * @fmt...: QMP message to send to qemu
  *
- * Sends a QMP message to QEMU
+ * Sends a QMP message to QEMU and consumes the response.
  */
-void qtest_qmp(QTestState *s, const char *fmt, ...);
+void qtest_qmp_discard_response(QTestState *s, const char *fmt, ...);
 
 /**
- * qtest_qmpv:
+ * qtest_qmpv_discard_response:
  * @s: #QTestState instance to operate on.
  * @fmt: QMP message to send to QEMU
  * @ap: QMP message arguments
  *
- * Sends a QMP message to QEMU.
+ * Sends a QMP message to QEMU and consumes the response.
  */
-void qtest_qmpv(QTestState *s, const char *fmt, va_list ap);
+void qtest_qmpv_discard_response(QTestState *s, const char *fmt, va_list ap);
 
 /**
  * qtest_get_irq:
@@ -331,17 +331,17 @@ static inline void qtest_end(void)
 }
 
 /**
- * qmp:
+ * qmp_discard_response:
  * @fmt...: QMP message to send to qemu
  *
- * Sends a QMP message to QEMU
+ * Sends a QMP message to QEMU and consumes the response.
  */
-static inline void qmp(const char *fmt, ...)
+static inline void qmp_discard_response(const char *fmt, ...)
 {
     va_list ap;
 
     va_start(ap, fmt);
-    qtest_qmpv(global_qtest, fmt, ap);
+    qtest_qmpv_discard_response(global_qtest, fmt, ap);
     va_end(ap);
 }
 
commit ec9c10d29c6bb5613a680af62f5825d3bb2d31d4
Author: Stefan Hajnoczi <stefanha at redhat.com>
Date:   Wed Oct 30 14:54:30 2013 +0100

    blockdev: fix drive_init() opts and bs_opts leaks
    
    These memory leaks also make drive_add if=none,id=drive0 without a file=
    option leak the options list.  This keeps ID "drive0" around forever.
    
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>

diff --git a/blockdev.c b/blockdev.c
index b260477..86e6bff 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -341,7 +341,7 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
     qemu_opts_absorb_qdict(opts, bs_opts, &error);
     if (error_is_set(&error)) {
         error_propagate(errp, error);
-        return NULL;
+        goto early_err;
     }
 
     if (id) {
@@ -361,7 +361,7 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
     if ((buf = qemu_opt_get(opts, "discard")) != NULL) {
         if (bdrv_parse_discard_flags(buf, &bdrv_flags) != 0) {
             error_setg(errp, "invalid discard option");
-            return NULL;
+            goto early_err;
         }
     }
 
@@ -383,7 +383,7 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
             /* this is the default */
         } else {
            error_setg(errp, "invalid aio option");
-           return NULL;
+           goto early_err;
         }
     }
 #endif
@@ -393,13 +393,13 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
             error_printf("Supported formats:");
             bdrv_iterate_format(bdrv_format_print, NULL);
             error_printf("\n");
-            return NULL;
+            goto early_err;
         }
 
         drv = bdrv_find_format(buf);
         if (!drv) {
             error_setg(errp, "'%s' invalid format", buf);
-            return NULL;
+            goto early_err;
         }
     }
 
@@ -435,20 +435,20 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
 
     if (!check_throttle_config(&cfg, &error)) {
         error_propagate(errp, error);
-        return NULL;
+        goto early_err;
     }
 
     on_write_error = BLOCKDEV_ON_ERROR_ENOSPC;
     if ((buf = qemu_opt_get(opts, "werror")) != NULL) {
         if (type != IF_IDE && type != IF_SCSI && type != IF_VIRTIO && type != IF_NONE) {
             error_setg(errp, "werror is not supported by this bus type");
-            return NULL;
+            goto early_err;
         }
 
         on_write_error = parse_block_error_action(buf, 0, &error);
         if (error_is_set(&error)) {
             error_propagate(errp, error);
-            return NULL;
+            goto early_err;
         }
     }
 
@@ -456,13 +456,13 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
     if ((buf = qemu_opt_get(opts, "rerror")) != NULL) {
         if (type != IF_IDE && type != IF_VIRTIO && type != IF_SCSI && type != IF_NONE) {
             error_report("rerror is not supported by this bus type");
-            return NULL;
+            goto early_err;
         }
 
         on_read_error = parse_block_error_action(buf, 1, &error);
         if (error_is_set(&error)) {
             error_propagate(errp, error);
-            return NULL;
+            goto early_err;
         }
     }
 
@@ -491,6 +491,8 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
         if (has_driver_specific_opts) {
             file = NULL;
         } else {
+            QDECREF(bs_opts);
+            qemu_opts_del(opts);
             return dinfo;
         }
     }
@@ -529,12 +531,13 @@ static DriveInfo *blockdev_init(QDict *bs_opts,
     return dinfo;
 
 err:
-    qemu_opts_del(opts);
-    QDECREF(bs_opts);
     bdrv_unref(dinfo->bdrv);
     g_free(dinfo->id);
     QTAILQ_REMOVE(&drives, dinfo, next);
     g_free(dinfo);
+early_err:
+    QDECREF(bs_opts);
+    qemu_opts_del(opts);
     return NULL;
 }
 
commit db5dc557288fb1b7a17ffabe3b92f299fc2dc187
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:42 2013 -0400

    block: qemu-iotests, add quotes to $TEST_IMG usage in 061
    
    When creating images with backing files in the test, the backing
    file argument was not quoted properly.  This caused the test to fail
    when run from a pathname with a space.  Pass the backing argument in
    with the -b option to _make_test_img, so it can be properly quoted.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
index fa9319d..e42f9bd 100755
--- a/tests/qemu-iotests/061
+++ b/tests/qemu-iotests/061
@@ -163,7 +163,7 @@ echo "=== Testing zero expansion on backed image ==="
 echo
 IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-IMGOPTS="compat=1.1,backing_file=$TEST_IMG.base" _make_test_img 64M
+IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M
 $QEMU_IO -c "read -P 0x2a 0 128k" -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
 _check_test_img
@@ -174,7 +174,7 @@ echo "=== Testing zero expansion on backed inactive clusters ==="
 echo
 IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-IMGOPTS="compat=1.1,backing_file=$TEST_IMG.base" _make_test_img 64M
+IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M
 $QEMU_IO -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG snapshot -c foo "$TEST_IMG"
 $QEMU_IO -c "write -P 0x42 0 128k" "$TEST_IMG" | _filter_qemu_io
@@ -190,7 +190,7 @@ echo "=== Testing zero expansion on backed image with shared L2 table ==="
 echo
 IMGOPTS="compat=1.1" TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-IMGOPTS="compat=1.1,backing_file=$TEST_IMG.base" _make_test_img 64M
+IMGOPTS="compat=1.1" _make_test_img -b "$TEST_IMG.base" 64M
 $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG snapshot -c foo "$TEST_IMG"
 $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
commit 1ab391938d29ebc3956d07b622c987c350434eaf
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:41 2013 -0400

    block: qemu-iotests, add quotes to $TEST_IMG usage for 051
    
    There were still a couple of instances of unquoted usage of
    $TEST_IMG and $TEST_IMG.orig.  Quoted these so they will not fail
    on pathnames with spaces in them.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 356c375..0a4971d 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -64,9 +64,9 @@ function run_qemu()
 size=128M
 
 _make_test_img $size
-cp $TEST_IMG $TEST_IMG.orig
-mv $TEST_IMG $TEST_IMG.base
-_make_test_img -b $TEST_IMG.base $size
+cp "$TEST_IMG" "$TEST_IMG.orig"
+mv "$TEST_IMG" "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" $size
 
 echo
 echo === Unknown option ===
@@ -81,7 +81,7 @@ echo
 echo === Overriding backing file ===
 echo
 
-echo "info block" | run_qemu -drive file=$TEST_IMG,driver=qcow2,backing.file.filename=$TEST_IMG.orig -nodefaults
+echo "info block" | run_qemu -drive file="$TEST_IMG",driver=qcow2,backing.file.filename="$TEST_IMG.orig" -nodefaults
 
 echo
 echo === Enable and disable lazy refcounting on the command line, plus some invalid values ===
commit f897e3939cbbcec26e99415a499654ae7ae09b64
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:40 2013 -0400

    block: qemu-iotests, removes duplicate double quotes in 039
    
    Test 039 had $TEST_IMG with duplicate double quotes - remove duplicate.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039
index f85b4ce..8bade92 100755
--- a/tests/qemu-iotests/039
+++ b/tests/qemu-iotests/039
@@ -54,7 +54,7 @@ echo "== Checking that image is clean on shutdown =="
 IMGOPTS="compat=1.1,lazy_refcounts=on"
 _make_test_img $size
 
-$QEMU_IO -c "write -P 0x5a 0 512" ""$TEST_IMG"" | _filter_qemu_io
+$QEMU_IO -c "write -P 0x5a 0 512" "$TEST_IMG" | _filter_qemu_io
 
 # The dirty bit must not be set
 ./qcow2.py "$TEST_IMG" dump-header | grep incompatible_features
commit 3cbe3e8d25529ecb4e1838d1c6856e199b3a66d4
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:39 2013 -0400

    block: qemu-iotests, add quotes to $TEST_IMG usage in 019
    
    There were still instances of $TEST_IMG not being properly quoted.
    This was in the usage of a string built up for a 'for' loop; modify
    the loop so we can quote $TEST_IMG properly.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/019 b/tests/qemu-iotests/019
index cd3582c..5bb18d0 100755
--- a/tests/qemu-iotests/019
+++ b/tests/qemu-iotests/019
@@ -90,12 +90,12 @@ mv "$TEST_IMG" "$TEST_IMG.orig"
 # Test the conversion twice: One test with the old-style -B option and another
 # one with -o backing_file
 
-for backing_option in "-B $TEST_IMG.base" "-o backing_file=$TEST_IMG.base"; do
+for backing_option in "-B " "-o backing_file="; do
 
     echo
-    echo Testing conversion with $backing_option | _filter_testdir | _filter_imgfmt
+    echo Testing conversion with $backing_option$TEST_IMG.base | _filter_testdir | _filter_imgfmt
     echo
-    $QEMU_IMG convert -O $IMGFMT $backing_option "$TEST_IMG.orig" "$TEST_IMG"
+    $QEMU_IMG convert -O $IMGFMT $backing_option"$TEST_IMG.base" "$TEST_IMG.orig" "$TEST_IMG"
 
     echo "Checking if backing clusters are allocated when they shouldn't"
     echo
commit 02cde1688131090d3abb2f210e30a44d96804167
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:38 2013 -0400

    block: qemu-iotests, add quotes to $TEST_IMG.base usage in 017
    
    $TEST_IMG.base is used unquoted. Add quotes so that pathnames with
    spaces are supported.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/017 b/tests/qemu-iotests/017
index 45f2c0b..aba3faf 100755
--- a/tests/qemu-iotests/017
+++ b/tests/qemu-iotests/017
@@ -66,7 +66,7 @@ echo "Creating test image with backing file"
 echo
 
 TEST_IMG=$TEST_IMG_SAVE
-_make_test_img -b $TEST_IMG.base 6G
+_make_test_img -b "$TEST_IMG.base" 6G
 
 echo "Filling test image"
 echo
commit 0018c03f5d37f3a7df23eef0e9f1e6e6189ed634
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:37 2013 -0400

    block: qemu-iotests, fix _make_test_img() to work with spaced pathnames
    
    _make_test_img() currently works with spaced pathnames only when not
    specifying a backing file.  This fixes it so that the backing file
    argument is properly quoted.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index 4e82604..d24de2c 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -111,6 +111,8 @@ _make_test_img()
     local image_size=$*
     local optstr=""
     local img_name=""
+    local use_backing=0
+    local backing_file=""
 
     if [ -n "$TEST_IMG_FILE" ]; then
         img_name=$TEST_IMG_FILE
@@ -123,7 +125,8 @@ _make_test_img()
     fi
 
     if [ "$1" = "-b" ]; then
-        extra_img_options="$1 $2"
+        use_backing=1
+        backing_file=$2
         image_size=$3
     fi
     if [ \( "$IMGFMT" = "qcow2" -o "$IMGFMT" = "qed" \) -a -n "$CLUSTER_SIZE" ]; then
@@ -135,7 +138,13 @@ _make_test_img()
     fi
 
     # XXX(hch): have global image options?
-    $QEMU_IMG create -f $IMGFMT $extra_img_options $img_name $image_size 2>&1 | \
+    (
+     if [ $use_backing = 1 ]; then
+        $QEMU_IMG create -f $IMGFMT $extra_img_options -b "$backing_file" "$img_name" $image_size 2>&1
+     else
+        $QEMU_IMG create -f $IMGFMT $extra_img_options "$img_name" $image_size 2>&1
+     fi
+    ) | \
         sed -e "s#$IMGPROTO:$TEST_DIR#TEST_DIR#g" \
             -e "s#$TEST_DIR#TEST_DIR#g" \
             -e "s#$IMGFMT#IMGFMT#g" \
commit 0084043888f6773d905c1b5d644b89c79d1c7714
Author: Jeff Cody <jcody at redhat.com>
Date:   Thu Oct 31 11:57:36 2013 -0400

    block: qemu-iotests, add quotes to $TEST_IMG usage io pattern tests
    
    The usage of $TEST_IMG was not properly quoted everywhere in
    common.pattern.
    
    Signed-off-by: Jeff Cody <jcody at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/common.pattern b/tests/qemu-iotests/common.pattern
index 00e0f60..ddfbca1 100644
--- a/tests/qemu-iotests/common.pattern
+++ b/tests/qemu-iotests/common.pattern
@@ -28,7 +28,7 @@ function do_is_allocated() {
 }
 
 function is_allocated() {
-    do_is_allocated "$@" | $QEMU_IO $TEST_IMG | _filter_qemu_io
+    do_is_allocated "$@" | $QEMU_IO "$TEST_IMG" | _filter_qemu_io
 }
 
 function do_io() {
@@ -46,18 +46,18 @@ function do_io() {
 }
 
 function io_pattern() {
-    do_io "$@" | $QEMU_IO $TEST_IMG | _filter_qemu_io
+    do_io "$@" | $QEMU_IO "$TEST_IMG" | _filter_qemu_io
 }
 
 function io() {
     local start=$2
     local pattern=$(( (start >> 9) % 256 ))
 
-    do_io "$@" $pattern | $QEMU_IO $TEST_IMG | _filter_qemu_io
+    do_io "$@" $pattern | $QEMU_IO "$TEST_IMG" | _filter_qemu_io
 }
 
 function io_zero() {
-    do_io "$@" 0 | $QEMU_IO $TEST_IMG | _filter_qemu_io
+    do_io "$@" 0 | $QEMU_IO "$TEST_IMG" | _filter_qemu_io
 }
 
 function io_test() {
@@ -117,8 +117,8 @@ function io_test2() {
     echo === Clusters to be compressed [3]
     io_pattern writev $((offset + 8 * $cluster_size)) $cluster_size $((9 * $cluster_size)) $num 165
 
-    mv $TEST_IMG $TEST_IMG.orig
-    $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -c $TEST_IMG.orig $TEST_IMG
+    mv "$TEST_IMG" "$TEST_IMG.orig"
+    $QEMU_IMG convert -f $IMGFMT -O $IMGFMT -c "$TEST_IMG.orig" "$TEST_IMG"
 
     # Write the used clusters
     echo === Used clusters [1]
commit 511018e4b49a5f0f1c7b051bb79fe8eccbb590fe
Author: Andreas Tobler <andreast at FreeBSD.org>
Date:   Thu Oct 31 22:41:46 2013 +0100

    block/raw-posix: fix FreeBSD compilation
    
    The below patch is needed to compile qemu trunk on FreeBSD with gcc48,
    clang will fail.... ;). Host x84_64-freebsd.
    
    Signed-off-by: Andreas Tobler <andreast at FreeBSD.org>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/block/raw-posix.c b/block/raw-posix.c
index f6d48bb..ace5d96 100644
--- a/block/raw-posix.c
+++ b/block/raw-posix.c
@@ -1842,7 +1842,8 @@ static BlockDriver bdrv_host_cdrom = {
 #endif /* __linux__ */
 
 #if defined (__FreeBSD__) || defined(__FreeBSD_kernel__)
-static int cdrom_open(BlockDriverState *bs, QDict *options, int flags)
+static int cdrom_open(BlockDriverState *bs, QDict *options, int flags,
+                      Error **errp)
 {
     BDRVRawState *s = bs->opaque;
     Error *local_err = NULL;
commit 64815e2a966f0a3f18818b9d542f1ef02dc992a2
Author: Max Reitz <mreitz at redhat.com>
Date:   Sat Nov 2 14:52:11 2013 +0100

    qemu-iotests: Filter out actual image size in 067
    
    The actual size of the image file may differ depending on the Linux
    kernel currently running on the host. Filtering out this value makes
    this test pass in such cases.
    
    Signed-off-by: Max Reitz <mreitz at redhat.com>
    Reviewed-by: Benoit Canet <benoit at irqsave.net>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/tests/qemu-iotests/067 b/tests/qemu-iotests/067
index 79dc38b..d025192 100755
--- a/tests/qemu-iotests/067
+++ b/tests/qemu-iotests/067
@@ -45,7 +45,7 @@ function do_run_qemu()
 
 function run_qemu()
 {
-    do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qmp
+    do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qmp | sed -e 's/\("actual-size":\s*\)[0-9]\+/\1SIZE/g'
 }
 
 size=128M
diff --git a/tests/qemu-iotests/067.out b/tests/qemu-iotests/067.out
index 4bb9ff9..8d271cc 100644
--- a/tests/qemu-iotests/067.out
+++ b/tests/qemu-iotests/067.out
@@ -6,7 +6,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,if=none,id=disk -device virtio-blk-pci,drive=disk,id=virtio0
 QMP_VERSION
 {"return": {}}
-{"return": [{"io-status": "ok", "device": "disk", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 139264, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "type": "unknown"}, {"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}]}
+{"return": [{"io-status": "ok", "device": "disk", "locked": false, "removable": false, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": SIZE, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "type": "unknown"}, {"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}]}
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/virtio0/virtio-backend"}}
@@ -24,7 +24,7 @@ QMP_VERSION
 Testing: -drive file=TEST_DIR/t.qcow2,format=qcow2,if=none,id=disk
 QMP_VERSION
 {"return": {}}
-{"return": [{"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 139264, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}, {"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}]}
+{"return": [{"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": SIZE, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}, {"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}]}
 {"return": {}}
 {"return": {}}
 {"return": {}}
@@ -44,7 +44,7 @@ Testing:
 QMP_VERSION
 {"return": {}}
 {"return": "OK\r\n"}
-{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 139264, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
+{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": SIZE, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
 {"return": {}}
 {"return": {}}
 {"return": {}}
@@ -64,14 +64,14 @@ Testing:
 QMP_VERSION
 {"return": {}}
 {"return": {}}
-{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 139264, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
+{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": SIZE, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
 {"return": {}}
 {"return": {}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_DELETED", "data": {"path": "/machine/peripheral/virtio0/virtio-backend"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_DELETED", "data": {"device": "virtio0", "path": "/machine/peripheral/virtio0"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "RESET"}
-{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"io-status": "ok", "device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": 139264, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
+{"return": [{"io-status": "ok", "device": "ide1-cd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "floppy0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"device": "sd0", "locked": false, "removable": true, "tray_open": false, "type": "unknown"}, {"io-status": "ok", "device": "disk", "locked": false, "removable": true, "inserted": {"iops_rd": 0, "image": {"virtual-size": 134217728, "filename": "TEST_DIR/t.qcow2", "cluster-size": 65536, "format": "qcow2", "actual-size": SIZE, "format-specific": {"type": "qcow2", "data": {"compat": "1.1", "lazy-refcounts": false}}, "dirty-flag": false}, "iops_wr": 0, "ro": false, "backing_file_depth": 0, "drv": "qcow2", "iops": 0, "bps_wr": 0, "encrypted": false, "bps": 0, "bps_rd": 0, "file": "TEST_DIR/t.qcow2", "encryption_key_missing": false}, "tray_open": false, "type": "unknown"}]}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN"}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "DEVICE_TRAY_MOVED", "data": {"device": "ide1-cd0", "tray-open": true}}
commit a9a443c874cf92b583852cf8ea5b75df8580df32
Author: Fam Zheng <famz at redhat.com>
Date:   Fri Nov 1 17:35:29 2013 +0800

    qapi: Fix comment for create-type to match code.
    
    Signed-off-by: Fam Zheng <famz at redhat.com>
    Reviewed-by: Eric Blake <eblake at redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/qapi-schema.json b/qapi-schema.json
index 81a375b..76c98a7 100644
--- a/qapi-schema.json
+++ b/qapi-schema.json
@@ -227,7 +227,7 @@
 ##
 # @ImageInfoSpecificVmdk:
 #
-# @create_type: The create type of VMDK image
+# @create-type: The create type of VMDK image
 #
 # @cid: Content id of image
 #
commit 73204cffe55ce65b3a344afc3da637d67beb8c32
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Nov 7 12:24:41 2013 +0100

    ossaudio: check for oss support in oss_audio_init
    
    Check whenever the device path (/dev/dsp by default) exists and qemu is
    allowed to access it.  Return NULL if it isn't, so ossaudio will not
    be used on systems wihtout oss support (increasinly common on modern
    linux systems).
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 007c641..5a73716 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -849,6 +849,10 @@ static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
 
 static void *oss_audio_init (void)
 {
+    if (access(conf.devpath_in, R_OK | W_OK) < 0 ||
+        access(conf.devpath_out, R_OK | W_OK) < 0) {
+        return NULL;
+    }
     return &conf;
 }
 
commit 926de75432d57cade393750da8102f3ba1eeb4a0
Author: Gerd Hoffmann <kraxel at redhat.com>
Date:   Thu Nov 7 12:25:02 2013 +0100

    Revert "ossaudio: do not enable by default"
    
    This reverts commit c905c5012ac0c6fde3b8094d2206a3139deddba2.
    
    There is a better fix for the issue at hand.
    
    Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 3e04a58..007c641 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -932,7 +932,7 @@ struct audio_driver oss_audio_driver = {
     .init           = oss_audio_init,
     .fini           = oss_audio_fini,
     .pcm_ops        = &oss_pcm_ops,
-    .can_be_default = 0,
+    .can_be_default = 1,
     .max_voices_out = INT_MAX,
     .max_voices_in  = INT_MAX,
     .voice_size_out = sizeof (OSSVoiceOut),
commit ef4cbe14342c1f63b3c754e306218f004f4e26c4
Author: Stefan Weil <sw at weilnetz.de>
Date:   Wed Nov 6 22:35:27 2013 +0100

    kvm: Fix uninitialized cpuid_data
    
    This error was reported by valgrind when running qemu-system-x86_64
    with kvm:
    
    ==975== Conditional jump or move depends on uninitialised value(s)
    ==975==    at 0x521C38: cpuid_find_entry (kvm.c:176)
    ==975==    by 0x5235BA: kvm_arch_init_vcpu (kvm.c:686)
    ==975==    by 0x4D5175: kvm_init_vcpu (kvm-all.c:267)
    ==975==    by 0x45035B: qemu_kvm_cpu_thread_fn (cpus.c:858)
    ==975==    by 0xD361E0D: start_thread (pthread_create.c:311)
    ==975==    by 0xD65E9EC: clone (clone.S:113)
    ==975==  Uninitialised value was created by a stack allocation
    ==975==    at 0x5226E4: kvm_arch_init_vcpu (kvm.c:446)
    
    Instead of adding more memset calls for parts of cpuid_data, the existing
    calls were removed and cpuid_data is now initialized completely in one
    call.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 27071e3..1188482 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -456,11 +456,12 @@ int kvm_arch_init_vcpu(CPUState *cs)
     uint32_t signature[3];
     int r;
 
+    memset(&cpuid_data, 0, sizeof(cpuid_data));
+
     cpuid_i = 0;
 
     /* Paravirtualization CPUIDs */
     c = &cpuid_data.entries[cpuid_i++];
-    memset(c, 0, sizeof(*c));
     c->function = KVM_CPUID_SIGNATURE;
     if (!hyperv_enabled(cpu)) {
         memcpy(signature, "KVMKVMKVM\0\0\0", 12);
@@ -474,7 +475,6 @@ int kvm_arch_init_vcpu(CPUState *cs)
     c->edx = signature[2];
 
     c = &cpuid_data.entries[cpuid_i++];
-    memset(c, 0, sizeof(*c));
     c->function = KVM_CPUID_FEATURES;
     c->eax = env->features[FEAT_KVM];
 
@@ -483,13 +483,11 @@ int kvm_arch_init_vcpu(CPUState *cs)
         c->eax = signature[0];
 
         c = &cpuid_data.entries[cpuid_i++];
-        memset(c, 0, sizeof(*c));
         c->function = HYPERV_CPUID_VERSION;
         c->eax = 0x00001bbc;
         c->ebx = 0x00060001;
 
         c = &cpuid_data.entries[cpuid_i++];
-        memset(c, 0, sizeof(*c));
         c->function = HYPERV_CPUID_FEATURES;
         if (cpu->hyperv_relaxed_timing) {
             c->eax |= HV_X64_MSR_HYPERCALL_AVAILABLE;
@@ -500,7 +498,6 @@ int kvm_arch_init_vcpu(CPUState *cs)
         }
 
         c = &cpuid_data.entries[cpuid_i++];
-        memset(c, 0, sizeof(*c));
         c->function = HYPERV_CPUID_ENLIGHTMENT_INFO;
         if (cpu->hyperv_relaxed_timing) {
             c->eax |= HV_X64_RELAXED_TIMING_RECOMMENDED;
@@ -511,13 +508,11 @@ int kvm_arch_init_vcpu(CPUState *cs)
         c->ebx = cpu->hyperv_spinlock_attempts;
 
         c = &cpuid_data.entries[cpuid_i++];
-        memset(c, 0, sizeof(*c));
         c->function = HYPERV_CPUID_IMPLEMENT_LIMITS;
         c->eax = 0x40;
         c->ebx = 0x40;
 
         c = &cpuid_data.entries[cpuid_i++];
-        memset(c, 0, sizeof(*c));
         c->function = KVM_CPUID_SIGNATURE_NEXT;
         memcpy(signature, "KVMKVMKVM\0\0\0", 12);
         c->eax = 0;
commit 3a902babf1d7b5ef1ffa8bc95be271fe1270c2f6
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Mon Nov 4 14:42:55 2013 +0100

    pci-assign: Remove dead code for direct I/O region access from userspace
    
    This feature was already deprecated back then in qemu-kvm, ie. before
    pci-assign went upstream. assigned_dev_ioport_rw will never be invoked
    with resource_fd < 0.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Acked-by: Alex Williamson <alex.williamson at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/hw/i386/kvm/pci-assign.c b/hw/i386/kvm/pci-assign.c
index 011764f..4e65110 100644
--- a/hw/i386/kvm/pci-assign.c
+++ b/hw/i386/kvm/pci-assign.c
@@ -154,55 +154,19 @@ static uint64_t assigned_dev_ioport_rw(AssignedDevRegion *dev_region,
     uint64_t val = 0;
     int fd = dev_region->region->resource_fd;
 
-    if (fd >= 0) {
-        if (data) {
-            DEBUG("pwrite data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
-                  ", addr="TARGET_FMT_plx"\n", *data, size, addr, addr);
-            if (pwrite(fd, data, size, addr) != size) {
-                error_report("%s - pwrite failed %s",
-                             __func__, strerror(errno));
-            }
-        } else {
-            if (pread(fd, &val, size, addr) != size) {
-                error_report("%s - pread failed %s",
-                             __func__, strerror(errno));
-                val = (1UL << (size * 8)) - 1;
-            }
-            DEBUG("pread val=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
-                  ", addr=" TARGET_FMT_plx "\n", val, size, addr, addr);
+    if (data) {
+        DEBUG("pwrite data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
+              ", addr="TARGET_FMT_plx"\n", *data, size, addr, addr);
+        if (pwrite(fd, data, size, addr) != size) {
+            error_report("%s - pwrite failed %s", __func__, strerror(errno));
         }
     } else {
-        uint32_t port = addr + dev_region->u.r_baseport;
-
-        if (data) {
-            DEBUG("out data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
-                  ", host=%x\n", *data, size, addr, port);
-            switch (size) {
-            case 1:
-                outb(*data, port);
-                break;
-            case 2:
-                outw(*data, port);
-                break;
-            case 4:
-                outl(*data, port);
-                break;
-            }
-        } else {
-            switch (size) {
-            case 1:
-                val = inb(port);
-                break;
-            case 2:
-                val = inw(port);
-                break;
-            case 4:
-                val = inl(port);
-                break;
-            }
-            DEBUG("in data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
-                  ", host=%x\n", val, size, addr, port);
+        if (pread(fd, &val, size, addr) != size) {
+            error_report("%s - pread failed %s", __func__, strerror(errno));
+            val = (1UL << (size * 8)) - 1;
         }
+        DEBUG("pread val=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
+              ", addr=" TARGET_FMT_plx "\n", val, size, addr, addr);
     }
     return val;
 }
commit 20d155bc902f41c5b354937e730ad85b43614ae9
Author: Stefan Weil <sw at weilnetz.de>
Date:   Wed Oct 30 22:52:24 2013 +0100

    linux-user: Fix stat64 syscall for SPARC64
    
    Some targets use a stat64 structure for the stat64 syscall while others
    use a stat structure. SPARC64 used the wrong kind.
    
    Instead of extending the conditional compilation in syscall.c, now a
    macro TARGET_HAS_STRUCT_STAT64 is defined whenever a target has a
    target_stat64.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Erik de Castro Lopo <erikd at mega-nerd.com>

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 4a14a43..eaaf00d 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4870,10 +4870,10 @@ static inline abi_long host_to_target_stat64(void *cpu_env,
     } else
 #endif
     {
-#if TARGET_ABI_BITS == 64 && !defined(TARGET_ALPHA)
-        struct target_stat *target_st;
-#else
+#if defined(TARGET_HAS_STRUCT_STAT64)
         struct target_stat64 *target_st;
+#else
+        struct target_stat *target_st;
 #endif
 
         if (!lock_user_struct(VERIFY_WRITE, target_st, target_addr, 0))
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index 5f53a28..fe540f6 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -1178,6 +1178,7 @@ struct target_stat {
 /* This matches struct stat64 in glibc2.1, hence the absolutely
  * insane amounts of padding around dev_t's.
  */
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	unsigned short	st_dev;
 	unsigned char	__pad0[10];
@@ -1213,6 +1214,7 @@ struct target_stat64 {
 } QEMU_PACKED;
 
 #ifdef TARGET_ARM
+#define TARGET_HAS_STRUCT_STAT64
 struct target_eabi_stat64 {
         unsigned long long st_dev;
         unsigned int    __pad1;
@@ -1262,6 +1264,7 @@ struct target_stat {
 	abi_ulong	__unused4[2];
 };
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	unsigned char	__pad0[6];
 	unsigned short	st_dev;
@@ -1317,6 +1320,7 @@ struct target_stat {
 	abi_ulong	__unused4[2];
 };
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	unsigned char	__pad0[6];
 	unsigned short	st_dev;
@@ -1384,6 +1388,8 @@ struct target_stat {
 #endif
 };
 
+#if !defined(TARGET_PPC64) || defined(TARGET_ABI32)
+#define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
 	unsigned long long st_dev;
         unsigned long long st_ino;
@@ -1406,6 +1412,7 @@ struct QEMU_PACKED target_stat64 {
         unsigned int   __unused4;
         unsigned int   __unused5;
 };
+#endif
 
 #elif defined(TARGET_MICROBLAZE)
 
@@ -1431,6 +1438,7 @@ struct target_stat {
 };
 
 /* FIXME: Microblaze no-mmu user-space has a difference stat64 layout...  */
+#define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
 	uint64_t st_dev;
 #define TARGET_STAT64_HAS_BROKEN_ST_INO 1
@@ -1486,6 +1494,7 @@ struct target_stat {
 /* This matches struct stat64 in glibc2.1, hence the absolutely
  * insane amounts of padding around dev_t's.
  */
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	unsigned long long	st_dev;
 	unsigned char	__pad1[2];
@@ -1594,6 +1603,7 @@ struct target_stat {
  * struct stat of the 64-bit kernel.
  */
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	unsigned int	st_dev;
 	unsigned int	st_pad0[3];	/* Reserved for st_dev expansion  */
@@ -1665,6 +1675,7 @@ struct target_stat {
  * struct stat of the 64-bit kernel.
  */
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
 	abi_ulong	st_dev;
 	abi_ulong	st_pad0[3];	/* Reserved for st_dev expansion  */
@@ -1721,6 +1732,7 @@ struct target_stat {
        unsigned int    st_gen;
 };
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
        abi_ulong    st_dev;
        abi_ulong    st_ino;
@@ -1770,6 +1782,7 @@ struct target_stat {
 /* This matches struct stat64 in glibc2.1, hence the absolutely
  * insane amounts of padding around dev_t's.
  */
+#define TARGET_HAS_STRUCT_STAT64
 struct QEMU_PACKED target_stat64 {
 	unsigned long long	st_dev;
 	unsigned char	__pad0[4];
@@ -1897,6 +1910,7 @@ struct target_stat {
     unsigned int __unused5;
 };
 
+#define TARGET_HAS_STRUCT_STAT64
 struct target_stat64 {
     uint64_t st_dev;
     uint64_t st_ino;
commit bdf523e6923f1e667055e947e71fc600549cefae
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sun Oct 20 18:39:21 2013 +0200

    configure: Add config.status to recreate the current configuration
    
    The latest configure invocation was saved in config-host.mak and could
    be extracted from that file to recreate the configuration.
    
    Now it is saved in a new file config.status which can be directly executed
    to recreate the configuration. The file name and the comments were copied
    from GNU autoconf.
    
    Makefile now uses config.status, but also includes transitional code
    for the old mechanism.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>
    Reviewed-by: Fam Zheng <famz at redhat.com>

diff --git a/Makefile b/Makefile
index b15003f..073f18b 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,14 @@ CONFIG_ALL=y
 include $(SRC_PATH)/rules.mak
 config-host.mak: $(SRC_PATH)/configure
 	@echo $@ is out-of-date, running configure
-	@sed -n "/.*Configured with/s/[^:]*: //p" $@ | sh
+	@# TODO: The next lines include code which supports a smooth
+	@# transition from old configurations without config.status.
+	@# This code can be removed after QEMU 1.7.
+	@if test -x config.status; then \
+	    ./config.status; \
+        else \
+	    sed -n "/.*Configured with/s/[^:]*: //p" $@ | sh; \
+	fi
 else
 config-host.mak:
 ifneq ($(filter-out %clean,$(MAKECMDGOALS)),$(if $(MAKECMDGOALS),,fail))
diff --git a/configure b/configure
index 9addff1..a1cc5be 100755
--- a/configure
+++ b/configure
@@ -27,6 +27,19 @@ printf " '%s'" "$0" "$@" >> config.log
 echo >> config.log
 echo "#" >> config.log
 
+# Save the configure command line for later reuse.
+cat <<EOD >config.status
+#!/bin/sh
+# Generated by configure.
+# Run this file to recreate the current configuration.
+# Compiler output produced by configure, useful for debugging
+# configure, is in config.log if it exists.
+EOD
+printf "exec" >>config.status
+printf " '%s'" "$0" "$@" >>config.status
+echo >>config.status
+chmod +x config.status
+
 error_exit() {
     echo
     echo "ERROR: $1"
@@ -3757,8 +3770,6 @@ config_host_mak="config-host.mak"
 echo "# Automatically generated by configure - do not modify" >config-all-disas.mak
 
 echo "# Automatically generated by configure - do not modify" > $config_host_mak
-printf "# Configured with:" >> $config_host_mak
-printf " '%s'" "$0" "$@" >> $config_host_mak
 echo >> $config_host_mak
 
 echo all: >> $config_host_mak
commit 40b9cc5e40ca69c15a2243852fa20fd1a35a0ea6
Author: Stefan Weil <sw at weilnetz.de>
Date:   Sat Sep 28 10:34:30 2013 +0200

    nsis: Improved support for parallel installation of 32 and 64 bit code
    
    32 and 64 bit variants of QEMU already had different default installation
    directories, but used a common registry key for saving the choosen
    directory. This is confusing for users who want to install both variants,
    so fix it by using different registry keys.
    
    Signed-off-by: Stefan Weil <sw at weilnetz.de>

diff --git a/qemu.nsi b/qemu.nsi
index 0dc1f52..cc5fafd 100644
--- a/qemu.nsi
+++ b/qemu.nsi
@@ -60,7 +60,11 @@ InstallDir $PROGRAMFILES\qemu
 
 ; Registry key to check for directory (so if you install again, it will
 ; overwrite the old one automatically)
-InstallDirRegKey HKLM "Software\qemu" "Install_Dir"
+!ifdef W64
+InstallDirRegKey HKLM "Software\qemu64" "Install_Dir"
+!else
+InstallDirRegKey HKLM "Software\qemu32" "Install_Dir"
+!endif
 
 ; Request administrator privileges for Windows Vista.
 RequestExecutionLevel admin
commit 0fd53fec92c5b636ef4774fe130f6029fde9fc3c
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Oct 17 16:47:52 2013 +0200

    KVM: x86: fix typo in KVM_GET_XCRS
    
    Only the first item of the array was ever looked at.  No
    practical effect, but still worth fixing.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
    Signed-off-by: Gleb Natapov <gleb at redhat.com>

diff --git a/target-i386/kvm.c b/target-i386/kvm.c
index 749aa09..27071e3 100644
--- a/target-i386/kvm.c
+++ b/target-i386/kvm.c
@@ -1314,8 +1314,8 @@ static int kvm_get_xcrs(X86CPU *cpu)
 
     for (i = 0; i < xcrs.nr_xcrs; i++) {
         /* Only support xcr0 now */
-        if (xcrs.xcrs[0].xcr == 0) {
-            env->xcr0 = xcrs.xcrs[0].value;
+        if (xcrs.xcrs[i].xcr == 0) {
+            env->xcr0 = xcrs.xcrs[i].value;
             break;
         }
     }


More information about the Spice-commits mailing list